Bayi portalına direkt giriş JSON Web Tokens ile yapılmaktadır. Portal, istek parametresinde ya da çerezde bir JSON Web Token beklemektedir. (istek parametresinin ismi ya da çerez ismi "jwt" olmalıdır). Bağlantı noktası urli /directlogin/[merchantBusinessId] dir. Bu token, sadece kullanıcı sisteme giriş yaptıktan sonra sizin tarafınızda oluşturulmalıdır.
Bu akışın bir örneği:JWT'nin header kısmı şu formatta olmalıdır: {"alg": "HS256","typ": "JWT"}
JWT'nin payload verisi minimum şu formatta olmalıdır {sub: email, iat: (unix timestamp(in seconds)) , exp: (unix timestamp(in seconds))}
JWT'nin imzası header ve payload verisinin HMAC SHA256 hash kombinasyonunu içermelidir (Secret key ile imzalanan): HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)
<script type="text/javascript">
function generateJWT() {
var email = 'dealeruser@testmerchant.com';
var secret = '12345678';
var iss = 'http://www.merchantb2b.com';
var aud = 'https://neon-app.asseco-see.com.tr';
var dealerCode = 'bayitest';
var jwtHeader = {
alg: 'HS256',
typ: 'JWT'
};
var utcMillis = Date.now();
//Some Window machines are not in sync with UTC time, so we give additional 1 minute offset, so IAT(Issues At) is not before Server's UTC time
var jwtPayload = {sub: email, iat: ((utcMillis - 60000) / 1000), exp: ((utcMillis - 60000) / 1000) + (60*30)};
//expiry is set to ~30 minutes from now expiration date
//optional issuer
if (iss) {
jwtPayload.iss = iss;
}
//optional audience
if (aud) {
jwtPayload.aud = aud;
}
//optional dealer code
if (dealerCode) {
jwtPayload.dealerCode = dealerCode;
}
var jwtHeader64 = CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(JSON.stringify(jwtHeader)));
var jwtPayload64 = CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(JSON.stringify(jwtPayload)));
var jwtSignature64 = CryptoJS.HmacSHA256(jwtHeader64 + '.' + jwtPayload64, secret).toString(CryptoJS.enc.Base64);
return jwtHeader64 + '.' + jwtPayload64 + '.' + jwtSignature64;
}
</script>
<html>
<head>
<title>PHP Script: JwtGenerator</title>
</head>
<body>
<?php
class JwtGenerator {
function generateJWT($email, $secret, $iss, $aud, $dealerCode) {
$jwtHeader = json_encode(array(
'alg' => 'HS256',
'typ' => 'JWT'
));
$jwtPayload = json_encode(array(
'sub' => $email,
'iat' => time(),
'exp' => time() + (60 * 30)
));
$dataToAugment = json_decode($jwtPayload, true);
if ($iss) {
$dataToAugment['iss'] = $iss;
}
if ($aud) {
$dataToAugment['aud'] = $aud;
}
if($dealerCode) {
$dataToAugment['dealerCode'] = $dealerCode;
}
$jwtPayload = json_encode($dataToAugment);
$jwtHeader64 = base64_encode($jwtHeader);
$jwtPayload64 = base64_encode($jwtPayload);
$jwtSignature = hash_hmac('sha256', $jwtHeader64 . '.' . $jwtPayload64, $secret, true);
$jwtSignature64 = base64_encode($jwtSignature);
return $jwtHeader64 . '.' . $jwtPayload64 . '.' . $jwtSignature64;
}
}
$email = 'dealeruser@testmerchant.com';
$secret = '12345678';
$iss = 'http://www.merchantb2b.com';
$aud = 'https://neon-app.asseco-see.com.tr';
$dealerCode = 'bayitest';
$instance = new JwtGenerator();
$jwt = $instance->generateJWT($email, $secret, $iss, $aud, $dealerCode);
print_r($jwt);
print_r(PHP_EOL);
?>
</body>
</html>
public class JwtGenerator {
public String generateJWT(String email, String secret, String iss, String aud, String dealerCode) {
String jwtHeader = "{\"alg\": \"HS256\",\"typ\": \"JWT\"}";
long iat = new Date().getTime() / 1000;
long exp = iat + (60L * 30);
String jwtPayload = "{\"sub\": \"" + email + "\", \"iat\": " + iat + ", \"exp\": " + exp;
//optional issuer
if (iss != null && !iss.trim().equals("")) {
jwtPayload += ", \"iss\": \"" + iss + "\"";
}
//optional audience
if (aud != null && !aud.trim().equals("")) {
jwtPayload += ", \"aud\": \"" + aud + "\"";
}
//optional dealer code
if (dealerCode != null && !dealerCode.trim().equals("")) {
jwtPayload += ", \"dealerCode\": \"" + dealerCode + "\"";
}
jwtPayload += "}";
Charset charset = Charset.forName("UTF-8");
try {
String jwtHeader64 = Base64.getEncoder().encodeToString(jwtHeader.getBytes(charset));
String jwtPayload64 = Base64.getEncoder().encodeToString(jwtPayload.getBytes(charset));
Mac hmacSHA256 = Mac.getInstance("HmacSHA256");
SecretKeySpec secretKey = new SecretKeySpec(secret.getBytes(charset), "HmacSHA256");
hmacSHA256.init(secretKey);
byte[] jwtSignature = hmacSHA256.doFinal(new String(jwtHeader64 + "." + jwtPayload64).getBytes(charset));
String jwtSignature64 = Base64.getEncoder().encodeToString(jwtSignature);
return jwtHeader64 + "." + jwtPayload64 + "." + jwtSignature64;
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
} catch (InvalidKeyException e) {
e.printStackTrace();
}
return "";
}
public static void main(String[] args) {
JwtGenerator jwtGenerator = new JwtGenerator();
String email = "dealeruser@testmerchant.com";
String secret = "12345678";
String iss = "http://www.merchantb2b.com";
String aud = "https://neon-app.asseco-see.com.tr";
String dealerCode = "bayitest";
String jwt = jwtGenerator.generateJWT(email, secret, iss, aud, dealerCode);
System.out.println(jwt);
}
}