Cross account streams using JWT

[zs-ko]

how can we export a stream from one account and import that stream into multiple other accounts using jwt.

Looking at the documentation we have tried a few different ways but it seems that we are doing something wrong.
in the documentatin we can find the following where account A exports stream b to account b. how would we replicate the following using JWT tokens and NACK streams.

I am having a hard time to understand the difference between jwt and standard configuration layouts. it ssems that they operate completley different.ly. is there a possibilitiy to add more exmaples on sources, import and exports using jwt and even maybe nack.

Config ex from doc

accounts: {
    A: {
        users: [
            {user: a, password: a}
        ]
        exports: [
            {stream: puba.>}
            {service: pubq.>}
            {stream: b.>, accounts: [B]}
            {service: q.b, accounts: [B]}
        ]
    },
    B: {
        users: [
            {user: b, password: b}
        ]
        imports: [
            {stream: {account: A, subject: b.>}}
            {service: {account: A, subject: q.b}}
        ]
    }
    C: {
        users: [
            {user: c, password: c}
        ]
        imports: [
            {stream: {account: A, subject: puba.>}, prefix: from_a}
            {service: {account: A, subject: pubq.C}, to: Q}
        ]
    }
}

NACK source stream

spec:
  account: A
  allowDirect: false
  allowRollup: false
  compression: ''
  creds: ''
  denyDelete: false
  discard: old
  discardPerSubject: false
  firstSequence: 0
  maxAge: ''
  maxBytes: -1
  maxConsumers: -1
  maxMsgSize: -1
  maxMsgs: -1
  maxMsgsPerSubject: 0
  name: xdr
  nkey: ''
  noAck: false
  preventDelete: false
  preventUpdate: false
  replicas: 1
  retention: limits
  servers: []
  storage: file
  subjects:
    - test.B.sub.>

NACK dst stream

spec:
  account: B
  allowDirect: false
  allowRollup: false
  compression: ''
  creds: ''
  denyDelete: false
  discard: old
  discardPerSubject: false
  firstSequence: 0
  maxAge: ''
  maxBytes: -1
  maxConsumers: -1
  maxMsgSize: -1
  maxMsgs: -1
  maxMsgsPerSubject: 0
  name: xdr
  nkey: ''
  noAck: false
  preventDelete: false
  preventUpdate: false
  replicas: 1
  retention: limits
  servers: []
  sources:
    - externalApiPrefix: $JS.A.API
      externalDeliverPrefix: B.S
      name: xdr
  storage: file

[amitamit281]

Are you using nsc tool to manage your accounts & export/imports https://nats-io.github.io/nsc/?

[zs-ko]

Hi @amitamit281 not exactly. we are using NATS Vault plugin https://github.com/edgefarm/vault-plugin-secrets-nats
Just trying to figure out the jwt requirements so i can validate that the plugin generates the correct jwt tokens.

I could also try the nsc command line and check what the output is there to validate the JWT. But just dont understand how to replicate it with that tool

[amitamit281]

Hi @zs-ko Thanks for sharing this. I haven't used this but it looks like it can achieve exactly same thing whatever nsc does.

you can mimic the same thing in JWT, i see you are using private export from account A to B. let us not do that initially to understand because that is bit complex. Otherwise it pretty straight forward. you can use remote Subject & "localSubject" in jwt. Hope this might give you some idea.
Feel free to reach out if you have any further question.

[zs-ko]

@amitamit281 thank you for your help. we scrapped the idea of cross account exports and imports since it just lead to more complexity. The other functionality seems to work fine. it was only the cross account import and export that was unclear with regards to the JWT. Maybe the documentation could have a seperate part about the JWT fields and their usage and function

[aricart]

Take a look at the following writeup - it explains in terms of JWT, but if you know what the layout of the JWT is, you can then generate your own JWTs to match.

https://gist.github.com/aricart/50607a7b5ed0150aaa163f0bfe64f72a

[brettinternet]

@aricart Wonderful write up, thank you!

In your consumer examples, is it possible to reverse the publishing without reversing the export/import? Am I able to have a user from account B publish a message to a consumer listening on account A on the imported stream from your examples?

js, err := jetstream.NewWithDomain(nc, importedStreamDomainFromAccountA)
js.PublishAsync("S.1", []byte("hello account A, from account B!"))

[aricart]

In that case your publishing to a stream on the other account, and the consumer is on the stream account. So you would export a service with the subject the stream listens on... Service so you can get the ack

[brettinternet]

If I understand you correctly, do you mean that I will indeed need to export a different service from account B and import it to account A in order to reverse the publishing direction?