Services

To share services that other accounts can reach via request reply, you have to Export a Service. Services are associated with the account performing the replies and are advertised in the exporting accounts’ JWT.

Adding a Public Service Export

To add a service to your account:

  1. nsc add export --name help --subject help --service

Output

  1. [ OK ] added public service export "help"

To review the service export:

  1. nsc describe account

Example output

  1. ╭──────────────────────────────────────────────────────────────────────────────────────╮
  2. Account Details
  3. ├───────────────────────────┬──────────────────────────────────────────────────────────┤
  4. Name A
  5. Account ID ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE
  6. Issuer ID OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG
  7. Issued 2019-12-04 18:20:42 UTC
  8. Expires
  9. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  10. Max Connections Unlimited
  11. Max Leaf Node Connections Unlimited
  12. Max Data Unlimited
  13. Max Exports Unlimited
  14. Max Imports Unlimited
  15. Max Msg Payload Unlimited
  16. Max Subscriptions Unlimited
  17. Exports Allows Wildcards True
  18. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  19. Imports None
  20. ╰───────────────────────────┴──────────────────────────────────────────────────────────╯
  21. ╭────────────────────────────────────────────────────────────╮
  22. Exports
  23. ├──────┬─────────┬─────────┬────────┬─────────────┬──────────┤
  24. Name Type Subject Public Revocations Tracking
  25. ├──────┼─────────┼─────────┼────────┼─────────────┼──────────┤
  26. help Service help Yes 0 -
  27. ╰──────┴─────────┴─────────┴────────┴─────────────┴──────────╯

Importing a Service

Importing a service enables you to send requests to the remote Account. To import a Service, you have to create an Import. To create an import you need to know:

  • The exporting account’s public key
  • The subject the service is listening on
  • You can map the service’s subject to a different subject
  • Self-imports are not valid; you can only import services from other accounts.

To learn how to inspect a JWT from an account server, check this article.

First let’s create a second account to import the service into:

  1. nsc add account B

Example output

  1. [ OK ] generated and stored account key "AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H"
  2. [ OK ] added account "B"

Add the import of the subject ‘help’

  1. nsc add import --src-account ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE --remote-subject help --service

Example output

  1. [ OK ] added service import "help"

Verifying our work:

  1. nsc describe account

Example output

  1. ╭──────────────────────────────────────────────────────────────────────────────────────╮
  2. Account Details
  3. ├───────────────────────────┬──────────────────────────────────────────────────────────┤
  4. Name B
  5. Account ID AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  6. Issuer ID OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG
  7. Issued 2019-12-04 20:12:42 UTC
  8. Expires
  9. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  10. Max Connections Unlimited
  11. Max Leaf Node Connections Unlimited
  12. Max Data Unlimited
  13. Max Exports Unlimited
  14. Max Imports Unlimited
  15. Max Msg Payload Unlimited
  16. Max Subscriptions Unlimited
  17. Exports Allows Wildcards True
  18. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  19. Exports None
  20. ╰───────────────────────────┴──────────────────────────────────────────────────────────╯
  21. ╭──────────────────────────────────────────────────────────────────────────╮
  22. Imports
  23. ├──────┬─────────┬────────┬──────────────┬─────────┬──────────────┬────────┤
  24. Name Type Remote Local/Prefix Expires From Account Public
  25. ├──────┼─────────┼────────┼──────────────┼─────────┼──────────────┼────────┤
  26. help Service help help A Yes
  27. ╰──────┴─────────┴────────┴──────────────┴─────────┴──────────────┴────────╯

Let’s also add a user to make requests from the service:

  1. nsc add user b

Example output

  1. [ OK ] generated and stored user key "UDKNTNEL5YD66U2FZZ2B3WX2PLJFKEFHAPJ3NWJBFF44PT76Y2RAVFVE"
  2. [ OK ] generated user creds file "~/.nkeys/creds/O/B/b.creds"
  3. [ OK ] added user "b" to account "B"

Pushing the changes to the nats servers

If your nats servers are configured to use the built-in NATS resolver, remember that you need to ‘push’ any account changes you may have done (locally) using nsc add to the servers for those changes to take effect.

e.g. ncs push -i or nsc push -a B -u nats://localhost

Testing the Service

To test the service, we can install the ‘nats’ CLI tool:

Set up a process to handle the request. This process will run from account ‘A’ using user ‘U’:

  1. nats reply --creds ~/.nkeys/creds/O/A/U.creds help "I will help"

Remember you can also do:

  1. nsc reply --account A --user U help "I will help"

Send the request:

  1. nats request --creds ~/.nkeys/creds/O/B/b.creds help me

The service receives the request:

  1. Received on [help]: 'me'

And the response is received by the requestor:

  1. Received [_INBOX.v6KAX0v1bu87k49hbg3dgn.StIGJF0D] : 'I will help'

Or more simply:

  1. nsc reply --account A --user U help "I will help"
  2. nsc req --account B --user b help me

Output

  1. published request: [help] : 'me'
  2. received reply: [_INBOX.GCJltVq1wRSb5FoJrJ6SE9.w8utbBXR] : 'I will help'

Securing Services

If you want to create a service that is only accessible to accounts you designate you can create a private service. The export will be visible in your account, but subscribing accounts will require an authorization token that must be created by you and generated specifically for the requesting account. The authorization token is simply a JWT signed by your account where you authorize the client account to import your service.

Creating a Private Service Export

  1. nsc add export --subject "private.help.*" --private --service --account A

Output

  1. [ OK ] added private service export "private.help.*"

As before, we declared an export, but this time we added the --private flag. The other thing to note is that the subject for the request has a wildcard. This enables the account to map specific subjects to specifically authorized accounts.

  1. nsc describe account A

Example output

  1. ╭──────────────────────────────────────────────────────────────────────────────────────╮
  2. Account Details
  3. ├───────────────────────────┬──────────────────────────────────────────────────────────┤
  4. Name A
  5. Account ID ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE
  6. Issuer ID OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG
  7. Issued 2019-12-04 20:19:19 UTC
  8. Expires
  9. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  10. Max Connections Unlimited
  11. Max Leaf Node Connections Unlimited
  12. Max Data Unlimited
  13. Max Exports Unlimited
  14. Max Imports Unlimited
  15. Max Msg Payload Unlimited
  16. Max Subscriptions Unlimited
  17. Exports Allows Wildcards True
  18. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  19. Imports None
  20. ╰───────────────────────────┴──────────────────────────────────────────────────────────╯
  21. ╭─────────────────────────────────────────────────────────────────────────────╮
  22. Exports
  23. ├────────────────┬─────────┬────────────────┬────────┬─────────────┬──────────┤
  24. Name Type Subject Public Revocations Tracking
  25. ├────────────────┼─────────┼────────────────┼────────┼─────────────┼──────────┤
  26. help Service help Yes 0 -
  27. private.help.* Service private.help.* No 0 -
  28. ╰────────────────┴─────────┴────────────────┴────────┴─────────────┴──────────╯

Generating an Activation Token

For the foreign account to import a private service and be able to send requests, you have to generate an activation token. The activation token in addition to granting permission to the account allows you to subset the service’s subject:

To generate a token, you’ll need to know the public key of the account importing the service. We can easily find the public key for account B by running:

  1. nsc list keys --account B

Example output

  1. ╭──────────────────────────────────────────────────────────────────────────────────────────╮
  2. Keys
  3. ├────────┬──────────────────────────────────────────────────────────┬─────────────┬────────┤
  4. Entity Key Signing Key Stored
  5. ├────────┼──────────────────────────────────────────────────────────┼─────────────┼────────┤
  6. O OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG *
  7. B AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H *
  8. b UDKNTNEL5YD66U2FZZ2B3WX2PLJFKEFHAPJ3NWJBFF44PT76Y2RAVFVE *
  9. ╰────────┴──────────────────────────────────────────────────────────┴─────────────┴────────╯
  1. nsc generate activation --account A --target-account AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H --subject private.help.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H -o /tmp/activation.jwt

Example output

  1. [ OK ] generated "private.help.*" activation for account "AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H"
  2. [ OK ] wrote account description to "/tmp/activation.jwt"

The command took the account that has the export (‘A’), the public key of account B, the subject where requests from account B will be handled, and an output file where the token can be stored. The subject for the export allows the service to handle all requests coming in on private.help.*, but account B can only request from a specific subject.

For completeness, the contents of the JWT file looks like this:

  1. cat /tmp/activation.jwt

Example output

  1. -----BEGIN NATS ACTIVATION JWT-----
  2. eyJ0eXAiOiJqd3QiLCJhbGciOiJlZDI1NTE5In0.eyJqdGkiOiJUS01LNEFHT1pOVERDTERGUk9QTllNM0hHUVRDTEJTUktNQUxXWTVSUUhFVEVNNE1VTDdBIiwiaWF0IjoxNTc1NDkxNjEwLCJpc3MiOiJBREVUUFQzNldCSUJVS00zSUJDVk00QTVZVVNEWEZFSlBXNE02R0dWQllDQlc3UlJORlRWNU5HRSIsIm5hbWUiOiJwcml2YXRlLmhlbHAuQUFNNDZFM1lGNVdPWlNFNVdOWVdITjNZWUlTVlpPU0k2WEhURjJRNjRFQ1BYU0ZRWlJPSk1QMkgiLCJzdWIiOiJBQU00NkUzWUY1V09aU0U1V05ZV0hOM1lZSVNWWk9TSTZYSFRGMlE2NEVDUFhTRlFaUk9KTVAySCIsInR5cGUiOiJhY3RpdmF0aW9uIiwibmF0cyI6eyJzdWJqZWN0IjoicHJpdmF0ZS5oZWxwLkFBTTQ2RTNZRjVXT1pTRTVXTllXSE4zWVlJU1ZaT1NJNlhIVEYyUTY0RUNQWFNGUVpST0pNUDJIIiwidHlwZSI6InNlcnZpY2UifX0.4tFx_1UzPUwbV8wFNIJsQYu91K9hZaGRLE10nOphfHGetvMPv1384KC-1AiNdhApObSDFosdDcpjryD0QxaDCQ
  3. ------END NATS ACTIVATION JWT------

When decoded it looks like this:

  1. nsc describe jwt -f /tmp/activation.jwt

Example output

  1. ╭─────────────────────────────────────────────────────────────────────────────────────────╮
  2. Activation
  3. ├─────────────────┬───────────────────────────────────────────────────────────────────────┤
  4. Name private.help.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  5. Account ID AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  6. Issuer ID ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE
  7. Issued 2019-12-04 20:33:30 UTC
  8. Expires
  9. ├─────────────────┼───────────────────────────────────────────────────────────────────────┤
  10. Hash ID DD6BZKI2LTQKAJYD5GTSI4OFUG72KD2BF74NFVLUNO47PR4OX64Q====
  11. ├─────────────────┼───────────────────────────────────────────────────────────────────────┤
  12. Import Type Service
  13. Import Subject private.help.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  14. ├─────────────────┼───────────────────────────────────────────────────────────────────────┤
  15. Max Messages Unlimited
  16. Max Msg Payload Unlimited
  17. Network Src Any
  18. Time Any
  19. ╰─────────────────┴───────────────────────────────────────────────────────────────────────╯

The token can be shared directly with the client account.

If you manage many tokens for many accounts, you may want to host activation tokens on a web server and share the URL with the account. The benefit to the hosted approach is that any updates to the token would be available to the importing account whenever their account is updated, provided the URL you host them in is stable. When using a JWT account server, the tokens can be stored right on the server and shared by an URL that is printed when the token is generated.

Importing a Private Service

Importing a private service is more natural than a public one because the activation token stores all the necessary details. Again, the token can be an actual file path or a remote URL.

  1. nsc add import --account B -u /tmp/activation.jwt --local-subject private.help --name private.help

Example output

  1. [ OK ] added service import "private.help.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H"

Describe account B

  1. nsc describe account B

Example output

  1. ╭──────────────────────────────────────────────────────────────────────────────────────╮
  2. Account Details
  3. ├───────────────────────────┬──────────────────────────────────────────────────────────┤
  4. Name B
  5. Account ID AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  6. Issuer ID OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG
  7. Issued 2019-12-04 20:38:06 UTC
  8. Expires
  9. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  10. Max Connections Unlimited
  11. Max Leaf Node Connections Unlimited
  12. Max Data Unlimited
  13. Max Exports Unlimited
  14. Max Imports Unlimited
  15. Max Msg Payload Unlimited
  16. Max Subscriptions Unlimited
  17. Exports Allows Wildcards True
  18. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  19. Exports None
  20. ╰───────────────────────────┴──────────────────────────────────────────────────────────╯
  21. ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
  22. Imports
  23. ├──────────────┬─────────┬───────────────────────────────────────────────────────────────────────┬──────────────┬─────────┬──────────────┬────────┤
  24. Name Type Remote Local/Prefix Expires From Account Public
  25. ├──────────────┼─────────┼───────────────────────────────────────────────────────────────────────┼──────────────┼─────────┼──────────────┼────────┤
  26. help Service help help A Yes
  27. private.help Service private.help.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H private.help A No
  28. ╰──────────────┴─────────┴───────────────────────────────────────────────────────────────────────┴──────────────┴─────────┴──────────────┴────────╯

When importing a service, you can specify the local subject you want to use to make requests. The local subject in this case is private.help. However when the request is forwarded by NATS, the request is sent on the remote subject.

Testing the Private Service

Testing a private service is no different than a public one:

  1. nsc reply --account A --user U "private.help.*" "help is here"
  2. nsc req --account B --user b private.help help_me

Example output

  1. published request: [private.help] : 'help_me'
  2. received reply: [_INBOX.3MhS0iCHfqO8wUl1x59bHB.jpE2jvEj] : 'help is here'