NATS环境下Angular与.NET服务的认证配置问题咨询

我当前使用NATS、Angular和.NET技术栈：

• Angular客户端通过登录时生成的JWT连接NATS服务器
• .NET服务需连接NATS完成发布、订阅逻辑，但目前仅能在启动时生成新Token，担忧服务器运行期间Token过期
• 期望为.NET服务配置用户名/密码或秘钥Token的认证方式，但不知如何操作

# Operator named RW_Operator
operator: eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5LW5rZXkifQ.eyJqdGkiOiJINVREWDc1Qk83SlkyTTNZRTJPNzI0UEpPUlJWWldVTzNIR1JPNU9HN01MQ1dRS05LUDdBIiwiaWF0IjoxNzE3NzQzMjcxLCJpc3MiOiJPQjVWRVFZRzc2RzRJSEdQWVg3TVFITkMzNlVPWUNOSUdEWDY0VEtEM1VKNjNaTUFHTFNOQkozSyIsIm5hbWUiOiJSV19PcGVyYXRvciIsInN1YiI6Ik9CNVZFUVlHNzZHNElIR1BZWDdNUUhOQzM2VU9ZQ05JR0RYNjRUS0QzVUo2M1pNQUdMU05CSjNLIiwibmF0cyI6eyJzaWduaW5nX2tleXMiOlsiT0I0M1pESDVUSkpVS1ZONVdSMkNGV0tBVVUzRVJGN0tMRVozUkdVTFRJMjRKUFpCUVNKTEVSUk4iXSwiYWNjb3VudF9zZXJ2ZXJfdXJsIjoibmF0czovL2xvY2FsaG9zdDo0MjIyIiwic3lzdGVtX2FjY291bnQiOiJBRE5JU0ZTVFlOVldZWkFDQzdEUTY2SVlaMjZOVVpGWTRUUTRSSzdUMko0M1hTSFFGSEg2TFkyUCIsInN0cmljdF9zaWduaW5nX2tleV91c2FnZSI6dHJ1ZSwidHlwZSI6Im9wZXJhdG9yIiwidmVyc2lvbiI6Mn19.iJuvBfktgJ6IJVHbC4M21xKcDQfZrVoYjrrlg4LTpgxM34VUHrAxNJuXetAIuCySjoQqenXUGryo9rj6ZJhRBg
# System Account named SYS
system_account: ADNISFSTYNVWYZACC7DQ66IYZ26NUZFY4TQ4RK7T2J43XSHQFHH6LY2P

websocket {
    port: 443
    no_tls: true
}

# configuration of the nats based resolver
resolver {
    type: full
    # Directory in which the account jwt will be stored
    dir: './jwt'
    # In order to support jwt deletion, set to true
    # If the resolver type is full delete will rename the jwt.
    # This is to allow manual restoration in case of inadvertent deletion.
    # To restore a jwt, remove the added suffix .delete and restart or send a reload signal.
    # To free up storage you must manually delete files with the suffix .delete.
    allow_delete: false
    # Interval at which a nats-server with a nats based account resolver will compare
    # it's state with one random nats based account resolver in the cluster and if needed, 
    # exchange jwt and converge on the same set of jwt.
    interval: "2m"
    # Timeout for lookup requests in case an account does not exist locally.
    timeout: "1.9s"
}

# Preload the nats based resolver with the system account jwt.
# This is not necessary but avoids a bootstrapping system account. 
# This only applies to the system account. Therefore other account jwt are not included here.
# To populate the resolver:
# 1) make sure that your operator has the account server URL pointing at your nats servers.
#    The url must start with: "nats://" 
#    nsc edit operator --account-jwt-server-url nats://localhost:4222
# 2) push your accounts using: nsc push --all
#    The argument to push -u is optional if your account server url is set as described.
# 3) to prune accounts use: nsc push --prune 
#    In order to enable prune you must set above allow_delete to true
# Later changes to the system account take precedence over the system account jwt listed here.
resolver_preload: {
    ADNISFSTYNVWYZACC7DQ66IYZ26NUZFY4TQ4RK7T2J43XSHQFHH6LY2P: eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5LW5rZXkifQ.eyJqdGkiOiJLWTdLRFc0WllXVktXNFczQVZXR1hMR09TRklSV0hJTVJWR09BMlpJUjczRTM0VlVVTFJBIiwiaWF0IjoxNzE3NzQzMjM1LCJpc3MiOiJPQjQzWkRINVRKSlVLVk41V1IyQ0ZXS0FVVTNFUkY3S0xFWjNSR1VMVEkyNEpQWkJRU0pMRVJSTiIsIm5hbWUiOiJTWVMiLCJzdWIiOiJBRE5JU0ZTVFlOVldZWkFDQzdEUTY2SVlaMjZOVVpGWTRUUTRSSzdUMko0M1hTSFFGSEg2TFkyUCIsIm5hdHMiOnsiZXhwb3J0cyI6W3sibmFtZSI6ImFjY291bnQtbW9uaXRvcmluZy1zdHJlYW1zIiwic3ViamVjdCI6IiRTWVMuQUNDT1VOVC4qLlx1MDAzZSIsInR5cGUiOiJzdHJlYW0iLCJhY2NvdW50X3Rva2VuX3Bvc2l0aW9uIjozLCJkZXNjcmlwdGlvbiI6IkFjY291bnQgc3BlY2lmaWMgbW9uaXRvcmluZyBzdHJlYW0iLCJpbmZvX3VybCI6Imh0dHBzOi8vZG9jcy5uYXRzLmlvL25hdHMtc2VydmVyL2NvbmZpZ3VyYXRpb24vc3lzX2FjY291bnRzIn0seyJuYW1lIjoiYWNjb3VudC1tb25pdG9yaW5nLXNlcnZpY2VzIiwic3ViamVjdCI6IiRTWVMuUkVRLkFDQ09VTlQuKi4qIiwidHlwZSI6InNlcnZpY2UiLCJyZXNwb25zZV90eXBlIjoiU3RyZWFtIiwiYWNjb3VudF90b2tlbl9wb3NpdGlvbiI6NCwiZGVzY3JpcHRpb24iOiJSZXF1ZXN0IGFjY291bnQgc3BlY2lmaWMgbW9uaXRvcmluZyBzZXJ2aWNlcyBmb3I6IFNVQlNaLCBDT05OWiwgTEVBRlosIEpTWiBhbmQgSU5GTyIsImluZm9fdXJsIjoiaHR0cHM6Ly9kb2NzLm5hdHMuaW8vbmF0cy1zZXJ2ZXIvY29uZmlndXJhdGlvbi9zeXNfYWNjb3VudHMifV0sImxpbWl0cyI6eyJzdWJzIjotMSwiZGF0YSI6LTEsInBheWxvYWQiOi0xLCJpbXBvcnRzIjotMSwiZXhwb3J0cyI6LTEsIndpbGRjYXJkcyI6dHJ1ZSwiY29ubiI6LTEsImxlYWYiOi0xfSwic2lnbmluZ19rZXlzIjpbIkFCRElURFRPSERQVEs1S05YRVkyU1Q0NlVXUEtDUEdRWUtBTUZOVVlGVkxMTUJORFdFWEhOSDMzIl0sImRlZmF1bHRfcGVybWlzc2lvbnMiOnsicHViIjp7fSwic3ViIjp7fX0sImF1dGhvcml6YXRpb24iOnt9LCJ0eXBlIjoiYWNjb3VudCIsInZlcnNpb24iOjJ9fQ.paEVbf-2vbxM4e7_8lQCB43Zh2f8UtVwDSiJi7Z9zdkBaBNksgc0bAaYRceJgUJUTf6FUGZacBvUT7dAgA5dBw,
}

一、配置用户名/密码认证方式 #

1. 创建带用户名密码的NATS账户 #

使用nsc工具创建专属账户及用户：

# 创建名为DotNetService的账户
nsc add account DotNetService
# 切换到该账户上下文
nsc env --account DotNetService
# 添加用户并设置密码（替换为你的强密码）
nsc add user dotnet_service_user --password YourSecurePassword@2024

2. 推送账户配置到NATS服务器 #

确保Operator的账户服务器URL指向NATS节点，再推送账户：

nsc edit operator --account-jwt-server-url nats://localhost:4222
nsc push --account DotNetService

3. .NET服务中使用用户名密码连接 #

通过NATS客户端库配置连接：

using NATS.Client;
using System.Text;

var connOpts = ConnectionFactory.GetDefaultOptions();
connOpts.Url = "nats://localhost:4222"; // 替换为你的NATS服务地址
connOpts.User = "dotnet_service_user";
connOpts.Password = "YourSecurePassword@2024";

using (var connection = new ConnectionFactory().CreateConnection(connOpts))
{
    // 发布消息示例
    connection.Publish("service.subject", Encoding.UTF8.GetBytes("Hello from .NET service"));
    
    // 订阅消息示例
    connection.SubscribeAsync("service.subject", (sender, args) =>
    {
        var messageContent = Encoding.UTF8.GetString(args.Message.Data);
        // 处理接收到的消息
    });
}

二、配置静态秘钥Token认证方式 #

1. 创建带静态秘钥的NATS用户 #

使用nsc生成静态秘钥用户：

# 在DotNetService账户下创建用户并生成静态秘钥
nsc add user dotnet_token_user --sk generate
# 查看生成的静态秘钥（输出的SUA开头字符串即为秘钥）
nsc describe user dotnet_token_user

2. 推送账户配置到NATS服务器 #

执行推送命令同步配置：

nsc push --account DotNetService

3. .NET服务中使用秘钥Token连接 #

在代码中配置静态秘钥：

using NATS.Client;
using System.Text;

var connOpts = ConnectionFactory.GetDefaultOptions();
connOpts.Url = "nats://localhost:4222";
connOpts.Token = "生成的静态秘钥字符串"; // 替换为实际秘钥

using (var connection = new ConnectionFactory().CreateConnection(connOpts))
{
    // 发布订阅逻辑同用户名密码方式
}

三、关键注意事项 #

• 用户名密码和静态秘钥均为长期有效认证方式，无需担心Token过期
• 确保NATS服务器的resolver配置为full类型（当前已满足），可正确加载推送的账户JWT
• 生产环境建议关闭websocket配置中的no_tls: true，启用TLS加密连接

内容的提问来源于stack exchange，提问作者Alex Andrei