Cluster setup - mixed authentications (user/password & JWT)

[Autoshi-k]

Hey, I'm trying to set two NATS servers with two different authentications methods - jwt and user/password. What I got so far is a connection between the servers, but the messages do not pass through. Is it possible to achieve this?
These are the two conf files:

jwt.conf

port: 5222

operator: eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5LW5rZXkifQ.eyJqdGkiOiJERVFIVjVTN0s2V1RORUtQSUpGQzNXWVNDNzZPMkkzQ0JDTUlDV1ZOSFVRWEZURklPNEJRIiwiaWF0IjoxNzEwMDY4MzU4LCJpc3MiOiJPQ0hENjJNSzJFRUo1WklBWUtESE9GWUdGVTVKWkJRUFpVSEdYWEs3RUs2N01HN0lRNlpENTRMSSIsIm5hbWUiOiJ0ZXN0X21lIiwic3ViIjoiT0NIRDYyTUsyRUVKNVpJQVlLREhPRllHRlU1SlpCUVBaVUhHWFhLN0VLNjdNRzdJUTZaRDU0TEkiLCJuYXRzIjp7Im9wZXJhdG9yX3NlcnZpY2VfdXJscyI6WyJuYXRzOi8vbG9jYWxob3N0OjQyMjIiXSwidHlwZSI6Im9wZXJhdG9yIiwidmVyc2lvbiI6Mn19.RwfhzWRg1rMujpC0TKXOxYXMG2noT_q3VAzaed2JOH9YrYnbLwoZK__vjr2Bc0EOAabvgo4CvzVsF42uRwB0Bg
# same as Account "SYS" in resolver_preload
system_account: ACBZ7YLV7ZYDKSTWOGOOJK4CWCNQYYV3OY56YGPP6IEHZJMYESRAAZHR


cluster {
  name: main
  listen: 127.0.0.1:5248
  routes = [
    nats://127.0.0.1:4248
  ]
}

resolver: {
    type: full
    dir: './jwt'
    allow_delete: false
    interval: "2m"
    limit: 1000
    timeout: "1.9s"
}

resolver_preload: {
  # Account "accountA"
  AB5DKPVGJU275KCFWNDIAWUL7NZNDOGGP2U4XG7UXWLVPDSVG3RR2ZZN: eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5LW5rZXkifQ.eyJqdGkiOiJKWjZETERBREkyU0tLRUlTRkVLRlQyM05TUjY2RE1ZTzVUUjZCTU1YSjcyTTM1VEJPRFdBIiwiaWF0IjoxNzEwMDY4MjQ3LCJpc3MiOiJPQ0hENjJNSzJFRUo1WklBWUtESE9GWUdGVTVKWkJRUFpVSEdYWEs3RUs2N01HN0lRNlpENTRMSSIsIm5hbWUiOiJmaXJzdF9hY2NvdW50Iiwic3ViIjoiQUI1REtQVkdKVTI3NUtDRldORElBV1VMN05aTkRPR0dQMlU0WEc3VVhXTFZQRFNWRzNSUjJaWk4iLCJuYXRzIjp7ImxpbWl0cyI6eyJzdWJzIjotMSwiZGF0YSI6LTEsInBheWxvYWQiOi0xLCJpbXBvcnRzIjotMSwiZXhwb3J0cyI6LTEsIndpbGRjYXJkcyI6dHJ1ZSwiY29ubiI6LTEsImxlYWYiOi0xfSwiZGVmYXVsdF9wZXJtaXNzaW9ucyI6eyJwdWIiOnt9LCJzdWIiOnt9fSwiYXV0aG9yaXphdGlvbiI6eyJhdXRoX3VzZXJzIjpudWxsfSwidHlwZSI6ImFjY291bnQiLCJ2ZXJzaW9uIjoyfX0.2H3A7IeCusknwfYY3o26ptsmnHqx7G1SMQcV7rLp78nWxzibaQ4F0NioLqmUw_5SKFtfWgFF_GYQYvExUCYsCg

  # Account "SYS"
  ACBZ7YLV7ZYDKSTWOGOOJK4CWCNQYYV3OY56YGPP6IEHZJMYESRAAZHR: eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5LW5rZXkifQ.eyJqdGkiOiJBNFNSTFZQTDVVSDQ0Mkw0TVZXUVQ1TjRUNlFIVFg3NVZCVFpZQUFSM1c1SDNaTDVRQVZRIiwiaWF0IjoxNzEwMDg0OTg0LCJpc3MiOiJPQ0hENjJNSzJFRUo1WklBWUtESE9GWUdGVTVKWkJRUFpVSEdYWEs3RUs2N01HN0lRNlpENTRMSSIsIm5hbWUiOiJTWVMiLCJzdWIiOiJBQ0JaN1lMVjdaWURLU1RXT0dPT0pLNENXQ05RWVlWM09ZNTZZR1BQNklFSFpKTVlFU1JBQVpIUiIsIm5hdHMiOnsibGltaXRzIjp7InN1YnMiOi0xLCJkYXRhIjotMSwicGF5bG9hZCI6LTEsImltcG9ydHMiOi0xLCJleHBvcnRzIjotMSwid2lsZGNhcmRzIjp0cnVlLCJjb25uIjotMSwibGVhZiI6LTF9LCJkZWZhdWx0X3Blcm1pc3Npb25zIjp7InB1YiI6e30sInN1YiI6e319LCJhdXRob3JpemF0aW9uIjp7ImF1dGhfdXNlcnMiOm51bGx9LCJ0eXBlIjoiYWNjb3VudCIsInZlcnNpb24iOjJ9fQ.CVkUlMpcAOZXnNoYG4GLy-h5lXwpSuQBfNYyNhZRyWMxjIGhSJPVfMCnFNQnSrsXu1nBO3DFNB9xlcJgxzELBw
}

userpass.conf

port: 3222

system_account: ACBZ7YLV7ZYDKSTWOGOOJK4CWCNQYYV3OY56YGPP6IEHZJMYESRAAZHR

cluster {
  name: main
  listen: 127.0.0.1:4248
  routes = [
    nats://127.0.0.1:5248
  ]
}

authorization {
  timeout: 0.5

  users [
      # alice foo
       { user: alice, password: "$2a$10$UHR6GhotWhpLsKtVP0/i6.Nh9.fuY73cWjLoJjb2sKT8KISBcUW5q" }
    ]
}


accounts {
  # Account SYS
  ACBZ7YLV7ZYDKSTWOGOOJK4CWCNQYYV3OY56YGPP6IEHZJMYESRAAZHR {}

  # first_account
  AB5DKPVGJU275KCFWNDIAWUL7NZNDOGGP2U4XG7UXWLVPDSVG3RR2ZZN {}
}

Looks like the servers are connected:

After running the two servers, I connect (with a user belonging to "accountA") and subscribe to subject 'test' on nats://127.0.0.1:5222. Then connect (with the user alice) and publish to subject 'test' on nats://127.0.0.1:3222.

sever -c jwt.conf

[2752606] 2024/03/21 09:30:59.123289 [TRC] 127.0.0.1:42824 - cid:13 - <<- [SUB test  1]
[2752606] 2024/03/21 09:30:59.123304 [TRC] 127.0.0.1:4248 - rid:7 - ->> [RS+ AB5DKPVGJU275KCFWNDIAWUL7NZNDOGGP2U4XG7UXWLVPDSVG3RR2ZZN test]

sever -c userpass.conf

[2771771] 2024/03/21 09:33:12.352444 [TRC] 127.0.0.1:44598 - cid:14 - <<- [PUB test 5]
[2771771] 2024/03/21 09:33:12.352452 [TRC] 127.0.0.1:44598 - cid:14 - <<- MSG_PAYLOAD: ["hello"]

The message on subject 'test' doesn't arrive to the subscriber.
So again, is it possible? and if it is, than what am I doing wrong?

Thanks!

[neilalexander]

You may need to define user alice in userpass.conf under the accounts block for the correct account rather than the top-level authorization block, otherwise your clients on either side may be connecting to different accounts.

[Autoshi-k]

It worked! thank you so much!

[derekcollison]

A cluster needs to be homogenous in terms of server config or operator mode.

If you want a setup like this, you could achieve it with leafnodes.