Building a dedicated JWT endpoint for the Support SDK

According to the above steps , now I can test our JWT endpoint, the result same as the picture , return 200 and the result with "jwt" data. but when I call the zenDesk related api on android mobile, the zenDesk log hint 401 and return "{"error":"Couldn't authenticate you"}".

Please give me some hints how to solve this issue？

I have the same problem as candiceyang

Any updates?

This isn't secure though if I open an endpoint to get user information and return it without authentication of the requester. Is there an IP Address I can white label for this request or a way to verify that Zendesk is asking for a JWT?

How is user_identifier_provided_by_the_app used by Zendesk? Do you create a customer/user based on user identifier or is it based on returned email and phone from jwt token?

Providing simply the user identifier is not secure at all as mentioned by Colbey W. We're thinking to provide another token (retrieved by mobile app) which will be accepted by our jwt service and return the data based on the token.

Thanks!

Hi @Colbey W @Ladislav Lenčucha - Zendesk maintains a list of IPs that can be whitelisted here: Configuring your firewall for use with Zendesk

There have been discussions and interest in making the getting of this list more dynamic (versus just listing them in this article), but currently this is the list to use to configure whitelisting by your service.

Zendesk passes through the "user_identifier_provided_by_the_app" to your service. Your app can can encode a user ID, looking however you like. This process is to authenticate an existing user. The returned JWT from your service requires the user's email. See also Setting a unique identify -- it rounds out some of the information given in this article.

@Bryan - Community Manager, @Brett - Community Manager

When I go into ZenDesk settings for the Mobile SDK and change the authentication type from anonymous to JWT, for a little while afterwards mobile applications trying to use ZenDesk JWT authentication get an error from ZenDesk saying that they are using the wrong authentication type. After a while, it starts working however. Is there a delay between when JWT authentication is enabled in the ZenDesk settings admin interface and when ZenDesk starts using those new settings? And if so, about how long is the delay? We've seen the delay last anywhere from as little as 10 minutes to as long as 3 hours. Is there any way to make this delay more consistant? Also, we've noticed that the delay is shorter for some clients than others. My theory is that there is some distributed system that settings changes get replicated across, and that some ZenDesk instances get the changes before others. Is that correct, or is there some other reason for the variable delay?

Here is PHP/symfony Implementation. 

https://gist.github.com/bhaktaraz/edbaa25c4100c9699bf1e5e2a80a8a90

Thanks @Bhaktaraz Bhatta for posting that example!

@Michael H -- I don't see any documentation on an expected delay, but because a mobile app's setup should be relatively static and not change (at least not that often), there could perhaps be a delay. Do you have a use case where a mobile app's setup is changing often for some reason? Can you provide more details?

I'm also referencing this KB article: Building a dedicated JWT endpoint for the Support SDK 

One of our devs shared with us today that there could potentially be a delay when updating settings in the SDK, so I wanted to share this:

1. It is possible that there is a delay of up to 15 mins caching time at our edge servers before the updated settings would be returned from the back-end
2. The SDK caches settings for 1 hour, so if you try to use the SDK again during that 1 hour time, it will still be using the “old” settings. You can wait an hour, or you can uninstall/reinstall the app if you want to test the new settings.

I also want to point out that you can use both an anonymous identity, as well as a JWT identity in the same app. Just go to Channels >> Mobile SDK >> Add app and then you can create the other identity. You can choose when to initialize the two!