HTTP JSON API JWT Authentication

JWT Authentication and Authorization will be implemented on the Ledger side. HTTP JSON API would not do any JWT validation by default. However we provide a functionality to override the default pass-through logic. Anyone customizing HTTP JSON API can pass validateJwt argument to com.digitalasset.http.HttpService#start: https://github.com/digital-asset/daml/blob/689d4d876ca168e0d680a9e24a3d23e53a22c6b4/ledger-service/http-json/src/main/scala/com/digitalasset/http/HttpService.scala#L44-L49

JWT pass-through is blocked by: #2523 also depends on: #2540

[gerolf-da]

@darkedges: great questions, thank you. Let me put some more color to these statements:

Regarding not verifying the token in this layer: How we currently envision the Ledger API Authentication story to pan out is the following:

• The operator of a ledger needs to integrate the ledger into some identity management system.
• The Ledger API Server will provide a hook for the ledger operator to implement token validation. It is up to the ledger operator to do this as they see fit.
• The High Level API (i.e. HTTP JSON API) currently simply operates just like any other ledger application and can be run by any user. Therefore it cannot do the actual validation (it doesn’t know the secret or the keys), but can only pass on the received token to the Ledger API Server, which will then do the validation.

On the topic of requiring unencrypted tokens, this is mostly a “restriction” for convenience in the experimental stage of the High Level API. We are aware that it is practice to put some claims into the unencrypted header.

This is mostly just a preview of what is to come in the next couple of weeks, as we spec out the Ledger API authentication story for the whole stack.

[leo-da]

See #2658