CouchDB with Azure Entra ID (Active Directory) (public key roll over on a periodic basis)

[cfeltz34]

I have a CouchDB configured to use Azure Entra Id authentification.
The public key (kid) is configured in my local.ini file :
[jwt_keys] rsa:***********
But, the Azure Entra Id public key roll over on a periodic basis and, in an emergency, could be rolled over immediately (see https://learn.microsoft.com/en-us/entra/identity-platform/signing-key-rollover).

I tried to modify the jwt_keys via the HTTP API of CouchDB, but this configuration have a read only state.

Is it possible to compare the kid with what we find in the Azure openid-configuration file ?
Or there are another solution ?

[rnewson]

You can modify the couchdb config (including the jwt_keys section) via the http api, but you must authenticate as an administrator. Sounds like you will need to periodically add new public keys (and presumably remove the old ones after some interval).

[cfeltz34]

I'm connected as an administrator.
But when y execute the request to update my config with http api, I receive a message "method_not_allowed : only GET allowed".
I have no problem to get kid value.

http://127.0.0.1:5984/_session
{ "ok": true, "name": "admin", "roles": [ "_admin" ] }

curl --location --request PUT '[http://127.0.0.1:5984/_node/_local/_config/jwt_keys' --header 'Content-Type: application/x-www-form-urlencoded' \ --header 'Cookie: AuthSession=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \ --data-urlencode 'NewKid='

[big-r81]

I'm connected as an administrator. But when y execute the request to update my config with http api, I receive a message "method_not_allowed : only GET allowed". I have no problem to get kid value.

http://127.0.0.1:5984/_session { "ok": true, "name": "admin", "roles": [ "_admin" ] }

curl --location --request PUT '[http://127.0.0.1:5984/_node/_local/_config/jwt_keys' --header 'Content-Type: application/x-www-form-urlencoded' \ --header 'Cookie: AuthSession=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \ --data-urlencode 'NewKid='

Hi, you are using the wrong API endpoint. You shoud use this.

For /_node/{node-name}/_config/{section} only the GET method is allowed.

Setting a new value in jwt_keys:

curl -X PUT http://localhost:5984/_node/_local/_config/jwt_keys/NewKid -d '"new-value"'

[cfeltz34]

Perfect, thanks