# How to do workflow api authentication using jwt in java, please help me on this.i need required code changes for client ad server side for this? **URL:** \ **Category:** Community Support\ **Tags:** java-sdk\ **Created:** [February 8, 2021, 4:24am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459 "2021-02-08T04:24:31Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![vikash\_kumar](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/vikash_kumar/32/551_2.png) [@vikash\_kumar](https://community.temporal.io/u/vikash_kumar)\ **Post date:** [February 8, 2021, 4:24am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/1 "2021-02-08T04:24:31Z")
how to do workflow api authentication using jwt in java, please help me on this.i need required code changes for client ad server side for this? ---
**Author:** ![SergeyBykov](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sergeybykov/32/335_2.png) [@SergeyBykov](https://community.temporal.io/u/SergeyBykov)\ **Post date:** [February 8, 2021, 7:22pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/2 "2021-02-08T19:22:58Z")
Have you already looked at [Temporal Server security / Authorization](https://docs.temporal.io/docs/server-security/#authorization)? ---
**Author:** ![vikash\_kumar](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/vikash_kumar/32/551_2.png) [@vikash\_kumar](https://community.temporal.io/u/vikash_kumar)\ **Post date:** [February 9, 2021, 4:28am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/3 "2021-02-09T04:28:34Z")
@SergeyBykov Yes, I have gone through this ([Temporal Server security | Temporal](https://docs.temporal.io/docs/server-security/#authorization))? but i am using java sdk so i am looking for java library only, so i could make changes for client/server side changes in java lang only to achieve authentication. I have found these but all are in go lang only [common/authorization/authorizer.go] [common/authorization/claimMapper.go] i have found this sample git project to do authorizer but this is also in go lang > **[temporalio/customization-samples](https://github.com/temporalio/customization-samples/tree/master/extensibility/authorizer)** > > master/extensibility/authorizer is java support for this is work in process or some exists in some other code base/documentation? ---
**Author:** ![SergeyBykov](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sergeybykov/32/335_2.png) [@SergeyBykov](https://community.temporal.io/u/SergeyBykov)\ **Post date:** [February 10, 2021, 3:02am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/4 "2021-02-10T03:02:28Z")
`Authorizer` and `ClaimMapper` are server plugin interfaces, and hence the plugins need to be written in Go. Default plugins, [NewDefaultJWTClaimMapper()](https://github.com/temporalio/temporal/blob/7ea0ee040d57d446043ef5e999250e99981a18cd/common/authorization/defaultJWTClaimMapper.go#L57) and [NewDefaultAuthorizer()](https://github.com/temporalio/temporal/blob/7ea0ee040d57d446043ef5e999250e99981a18cd/common/authorization/defaultAuthorizer.go#L32), we hope, cover most of the typical authorization scenarios or, worst case, can be tweaked to fit somebody’s needs easily. You can use Java SDK to send Bearer tokens to the server for authorization via a gRPC interceptor. ---
**Author:** ![vikash\_kumar](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/vikash_kumar/32/551_2.png) [@vikash\_kumar](https://community.temporal.io/u/vikash_kumar)\ **Post date:** [February 12, 2021, 11:49am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/6 "2021-02-12T11:49:36Z")
@SergeyBykov Thanks for the quick response, I have some more questions on implementing JWT based authentication. I am using the docker image and have gone through the information provided at [customization-samples/extensibility/authorizer at master · temporalio/customization-samples · GitHub](https://github.com/temporalio/customization-samples/tree/master/extensibility/authorizer). Do we have to build our own temporal image to enable golang plugins? We do not use go lang for development, is it possible to enable authentication with some server configurations? Like some property/configuration files? ---
**Author:** ![vikash\_kumar](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/vikash_kumar/32/551_2.png) [@vikash\_kumar](https://community.temporal.io/u/vikash_kumar)\ **Post date:** [February 14, 2021, 5:15pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/7 "2021-02-14T17:15:13Z")
@SergeyBykov Could you please suggest the solution of my last query? I am waiting for your response.Thanks. ---
**Author:** ![SergeyBykov](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sergeybykov/32/335_2.png) [@SergeyBykov](https://community.temporal.io/u/SergeyBykov)\ **Post date:** [February 15, 2021, 4:22am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/8 "2021-02-15T04:22:57Z")
In general, yes, building your own image is a more flexible way to configure Temporal server with all the available Server Options. To make cases like yours easier though, I’ll submit soon a long overdue PR for selecting noop or default authorizer and claim mapper via config settings. ---
**Author:** ![SergeyBykov](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sergeybykov/32/335_2.png) [@SergeyBykov](https://community.temporal.io/u/SergeyBykov)\ **Post date:** [February 15, 2021, 4:42am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/9 "2021-02-15T04:42:50Z")
I submitted a draft PR - [Add config parameters for selecting authorizer and claim mapper by sergeybykov · Pull Request #1291 · temporalio/temporal · GitHub](https://github.com/temporalio/temporal/pull/1291). Will work on getting it merged after we return from the long weekend. ---
**Author:** ![SergeyBykov](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sergeybykov/32/335_2.png) [@SergeyBykov](https://community.temporal.io/u/SergeyBykov)\ **Post date:** [February 17, 2021, 3:25am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/10 "2021-02-17T03:25:53Z")
[PR](https://github.com/temporalio/temporal/pull/1291) has been merged. ---
**Author:** ![Gordon\_Bean](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/gordon_bean/32/224_2.png) [@Gordon\_Bean](https://community.temporal.io/u/Gordon_Bean)\ **Post date:** [August 24, 2021, 6:01pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/12 "2021-08-24T18:01:17Z")
@SergeyBykov - is golang still the only option for server security plugins? Does providing a plugin require building our own instance of the server? What is the current suggested approach for Java users to enable JWT-based auth on the temporal server? What is the current suggested approach for Java users to enable alternate/custom auth on the temporal server? Thank you ---
**Author:** ![SergeyBykov](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sergeybykov/32/335_2.png) [@SergeyBykov](https://community.temporal.io/u/SergeyBykov)\ **Post date:** [August 25, 2021, 7:39pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/13 "2021-08-25T19:39:11Z")
> is golang still the only option for server security plugins? Since server code is in Go, and Go plugins story is very limited even for plugins written in Go, this is the only feasible option at the moment. > Does providing a plugin require building our own instance of the server? Yes, again primarily because of Go’s poor support for plugins. > What is the current suggested approach for Java users to enable JWT-based auth on the temporal server? I see two options here. 1. Implement the whole logic in Go. Conceptually, such logic is simple - comparing a set of claims to the ACL. 2. Implement a proxy-like plugin that would channel calls to a separate JVM process via an IPC mechanism, and have that JVM process handle all the logic. I’m biased towards option 1. ---
**Author:** ![Gordon\_Bean](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/gordon_bean/32/224_2.png) [@Gordon\_Bean](https://community.temporal.io/u/Gordon_Bean)\ **Post date:** [August 25, 2021, 10:36pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/14 "2021-08-25T22:36:31Z")
@SergeyBykov - thank you for the input. If we wrote the plugins to support our JWT, how would we configure the Java client to send the Authorization header? ---
**Author:** ![spikhalskiy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/spikhalskiy/32/1250_2.png) [@spikhalskiy](https://community.temporal.io/u/spikhalskiy)\ **Post date:** [August 26, 2021, 3:11pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/15 "2021-08-26T15:11:10Z")
There is probably only one way to do that right now and it’s not ideal: Implement two Grpc Stubs interceptors that set the right header and specify them in WorkflowServiceStubsOptions#Builder#setBlockingStubInterceptor and WorkflowServiceStubsOptions#Builder#setFutureStubInterceptor It’s a little bit painful, I know. I submitted an issue to make it better: [Add an easy way to provide JWT tokens to java-sdk for server calls · Issue #671 · temporalio/sdk-java · GitHub](https://github.com/temporalio/sdk-java/issues/671) ---
**Author:** ![Gordon\_Bean](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/gordon_bean/32/224_2.png) [@Gordon\_Bean](https://community.temporal.io/u/Gordon_Bean)\ **Post date:** [August 26, 2021, 4:29pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/16 "2021-08-26T16:29:53Z")
@spikhalskiy - thank you for the tip. What field in the `WorkflowServiceStub` do I need to modify to set the Authorization header? `.withCallCredentials`? `.withOption`? Something else? ---
**Author:** ![spikhalskiy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/spikhalskiy/32/1250_2.png) [@spikhalskiy](https://community.temporal.io/u/spikhalskiy)\ **Post date:** [August 28, 2021, 2:34pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/17 "2021-08-28T14:34:46Z")
Let me just implement a more straightforward Temporal Server JWT tokens support in Java SDK and it will become a part of the next SDK (1.3.0) release hopefully next week. ---
**Author:** ![spikhalskiy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/spikhalskiy/32/1250_2.png) [@spikhalskiy](https://community.temporal.io/u/spikhalskiy)\ **Post date:** [September 10, 2021, 5:08pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/18 "2021-09-10T17:08:08Z")
Temporal java-sdk 1.3.0 was just released with added simple support for Auth tokens. ```auto AuthorizationTokenSupplier tokenSupplier = //... your implementation of token supplier WorkflowServiceStubsOptions serviceStubOptions = WorkflowServiceStubsOptions.newBuilder() //... .addGrpcMetadataProvider(new AuthorizationGrpcMetadataProvider(tokenSupplier)) .build(); ``` ---
**Author:** ![aschrijver](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/aschrijver/32/1331_2.png) [@aschrijver](https://community.temporal.io/u/aschrijver)\ **Post date:** [September 20, 2021, 7:45pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/19 "2021-09-20T19:45:56Z")
> [@SergeyBykov](#): > > Yes, again primarily because of Go’s poor support for plugins. @SergeyBykov, you may consider looking into Hashicorp’s [go-plugin](https://github.com/hashicorp/go-plugin) project (which I am looking for in [my use case](https://community.temporal.io/t/temporal-for-small-scale-plugin-architecture/2978)). It has a slight overhead as it uses gRPC to communicate between plugins, but you get dynamic pluggability and polyglot plugins in return. ---
**Author:** ![SergeyBykov](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sergeybykov/32/335_2.png) [@SergeyBykov](https://community.temporal.io/u/SergeyBykov)\ **Post date:** [September 22, 2021, 5:59am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/20 "2021-09-22T05:59:58Z")
Yes, we considered go-plugin. It’s a way to implement option 2 I mentioned above. > 1. Implement a proxy-like plugin that would channel calls to a separate JVM process via an IPC mechanism, and have that JVM process handle all the logic. We couldn’t use it as a general purpose plugin mechanism because the overhead would be too big for popular use cases like authorization where the plugin is invoked on every request. But it can be used by one of the custom plugins if the overhead is acceptable for that use case. ---
**Author:** ![phani](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/phani/32/1309_2.png) [@phani](https://community.temporal.io/u/phani)\ **Post date:** [September 23, 2021, 2:11pm UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/21 "2021-09-23T14:11:39Z")
The AuthorizationGrpcMetadataProvider has protected constructor the below code wont work. Is it a bug ? AuthorizationTokenSupplier tokenSupplier = //… your implementation of token supplier WorkflowServiceStubsOptions serviceStubOptions = WorkflowServiceStubsOptions.newBuilder() //… .addGrpcMetadataProvider(new AuthorizationGrpcMetadataProvider(tokenSupplier)) .build(); ---
**Author:** ![SergeyBykov](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sergeybykov/32/335_2.png) [@SergeyBykov](https://community.temporal.io/u/SergeyBykov)\ **Post date:** [September 25, 2021, 12:12am UTC](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459/22 "2021-09-25T00:12:55Z")
I believe it was address in [this PR](https://github.com/temporalio/sdk-java/pull/763). [Next page](https://community.temporal.io/t/how-to-do-workflow-api-authentication-using-jwt-in-java-please-help-me-on-this-i-need-required-code-changes-for-client-ad-server-side-for-this/1459.md?page=2)