text:
Beaver County Blue: Voice of the 17th CD of Progressive Democrats of America
–About 17th CD PDA (formerly the 12th)
Category Archives: safety net
elections, health care, Organizing, safety net, Seniors
Despite Trump, State Progressives Advance Pro-Worker Policies
July 11, 2017 carldavidson	Leave a comment
While the president goes on the attack, Democratic-controlled states and municipalities forge ahead
By Justin Miller
American Propect
July 11, 2017 – In the face of the Trump administration's predictably antagonistic stance on pro-worker policies, coupled with the escalating onslaught against worker power in Republican-controlled states, progressives are racing ahead to enact innovative labor laws to help working people in the places where they can.
Over the past eight years, Democrats' control of government has receded to 1920s-levels, severely hindering progressives' ability to advance pro-worker labor policy in Washington, D.C., or in the states. As of now, the Democratic Party controls the governorship and legislature in just six states, while progressive power is most concentrated in a few dozen municipalities.
It's in those places in recent weeks that lawmakers have pushed forward a number of innovative labor laws that present a clear contrast to the Chamber of Commerce-influenced, deregulation-driven labor agenda in the White House.
Improving Home Care
Last week, Hawaii passed a law establishing a cash assistance program for people who are struggling to take care of a sick or elderly family member while maintaining a full-time job. The policy, the first of its kind in the country, takes aim at the increasingly urgent elder care crisis as the massive boomer generation ages and their children struggle to care for them.
"Every eight seconds, somebody turns 65 in America," Ai-jen Poo, co-director of Caring Across Generations, a group that advocates for policies that improve home care, said on a call with reporters Monday. "It's a great thing; we've extended longevity. And we are wholly unprepared for what the implications are in terms of care."
Fully half of the workforce will be called on to provide care for an elder within the next five years, the group says. And that's not a small commitment. Of the 45 million people who currently provide some level of unpaid home care to a relative, more than half are spending about 20 hours a week while also holding down a full-time job.
The Kapuna (the Hawaiian word for elder) Caregiver program would establish a fund to provide full-time workers who are providing care to a dependent elder $70 a day to help offset the burden. A recipient could use that money to help pay for health care, a caregiver, or transportation to a doctor's appointment.
There are more than 150,000 unpaid caregivers in Hawaii currently, according to estimates by the AARP. And while in-home care or assisted living is expensive, costing between $5,000 and $10,000 a month in the state, the $70-a-day benefit is a small step to helping caregivers balance their lives.
The legislature has provided an initial $600,000 for the program and advocates say they will return to the statehouse next year to bolster funding. Continue reading Despite Trump, State Progressives Advance Pro-Worker Policies →
Low Wage workers, Organizing, safety net
Raise the Minimum wage!
April 20, 2015 carldavidson	1 Comment
Our County Commissioners agree!
They will be passing a resolution on Thursday evening at their regularly scheduled meeting to support raising the minimum wage.
They have invited us to attend.
THURSDAY 4/23/15 BEAVER COUNTY COURTHOUSE 6:00 PM
Here in Beaver County, we once had a wonderful standard of living. One wage earner made enough to support an entire family. That money flowed through our community, making life better for everyone. We and our neighbors had money for the services that a proliferation of small businesses offered. Our children went to college and happily shopped for their supplies. Hobbies and recreation abounded. Now we have more minimum wage jobs in our County than ever. More of our neighbors are struggling just to pay rent and put food on the table. If their car breaks down, or they get sick and miss work, their family experiences a crisis. On an everyday basis they have trouble buying warm school clothes for their children. More and more of us are winding up in this position.
Continue reading Raise the Minimum wage! →
2016 Election, Harrisburg, PDA, Right Wing, safety net, Wall Street
Bernie Sanders Lights a Fire under Pennsylvania Democrats at Keystone Progress's Annual Summit in Harrisburg
February 10, 2015 carldavidson	2 Comments
By Carl Davidson
BeaverCountyBlue.org
Feb 8, 2015, Harrisburg, PA. If the vote were taken for the Democratic presidential candidate at the Harrisburg Hilton on Saturday, Feb. 7, Senator Bernie Sanders, Independent of Vermont, would likely have won by a landslide.
That was the spirit in the hotel ballroom as Sanders addressed the 800 people gathered for the PA Progressive Summit. The annual meeting, sponsored by Keystone Progress, brought together progressive activists—community and trade union organizers, women's right and civil rights groups, hopeful candidates and door knockers—all of whom made up the democratic wing of the Democratic Party, from all across the Keystone State.
"I'm going to try something a little different this morning," said Sanders to start things rolling, "I'm going to tell you the truth." He got a wave of laughter and cheers from people who often got something else from politicians.
Sanders with Tina Shannon
Sanders started off with the 'Citizen United' Supreme Court decision taking limits off the superrich in funding elections and candidates. "It will go down is history as one of the worse ever made in modern times" Sanders said by way of description. "By a five-to-four vote, it undermined the very foundations of democracy. I know you think the situation is bad, believe me, it's worse than you think it is." Billionaires are not satisfied with owning the economy, he explained. They were buying government as well."
The Koch Brothers, with 85 billion in wealth, were taken as the case in point. Sanders explained that they alone intended to spend over 900 million dollars on the 2016 election—more than the combined total of Obama and Romney in 2012. This meant these "counter-revolutionaries with a far right agenda" would wield more power than both political parties in the recent past.
Turning to the economy, Sanders said while the economy was clearly in better shape than when Obama, first took office, it was still clearly in bad shape. He explained the different meanings of official unemployment figures, with 5.8 percent being the most common number cited, but double that, near 12%, was more accurate.
Then he broke it down further: "We talk a lot about Ferguson, as we should. But we also need to talk more about Black youth unemployment, which is 30 percent. Nobody should be satisfied with where we are today. We have 45 million people living in poverty, another word we need to talk more about today."
For those worried about deficits, Sanders noted that they had been reduced under Obama. But he also insisted that if they were truly concerned about deficits, they would have stood up against the Iraq war. This remark got wild cheers and everyone out of their seats.
Unfair Impact of Technological Change
Sanders went on to examine 'the explosion in technology,' not only i-Phones and i-Pads, but robotics in factories. "All of this has led to a tremendous growth in productivity on the part of American workers." Such changes logically might suggest workers were paid more or worked shorter hours, he added, "but all of you know, tens of millions of Americans today are working longer hours for less pay."
This meant anger and stress among workers—impacting both men and women, even if in slightly different ways—needed discussion as a national issue. There was a time, "ancient history" said Sanders, when one worker could work 40 hours and support a family reasonably well. Now women were working along with men, sometimes at two or three jobs, at long hours and low pay, to hobble together enough to support a family. "This causes a lot of anger, and often it's being angry at the wrong people for the wrong reasons," he added. "The average male worker, right in the center of the economy, now makes $800 a year less in inflation adjusted dollars than he did 40 years ago. The average female worker in the center makes $1300 a year, even less. They have a lot to be angry about. They want to know why, and our job is to explain it to them."
Continue reading Bernie Sanders Lights a Fire under Pennsylvania Democrats at Keystone Progress's Annual Summit in Harrisburg →
Aliquippa, Organizing, Poverty, safety net
Beaver County Aid Providers Experience Tough Decisions During Poverty Simulation
November 4, 2014 carldavidson	Leave a comment
Poverty Simulation
A poverty simulation experience presented by Aliquippa Weed and Seed, in conjunction with the Franklin Center's Disproportionate Minority Contact Project, was held Friday at the Church in the Round. The simulation experience is designed to help participants begin to understand what it might be like to live in a typical low-income family trying to survive month to month. Here, the Rev. Marvin C. Moreland calls to be let out of "jail" during the simulation.
By Daveen Rae Kurutz
Beaver County Times
Nov. 4, 2014 ALIQUIPPA — Food, medicine or utilities.
It's one of several stressful choices low-income families have to make each month. Keeping a budget in balance when necessary costs — such as housing, transportation and food — require almost all income is just one stressor that leaves people frustrated and looking for help.
That's the situation several dozen Beaver County-area human-service providers found themselves in last week during a poverty simulation conducted by Aliquippa Weed and Seed and the Franklin Center of Beaver County. The program put participants in the shoes of a family living in poverty.
Participants were assigned to family roles — parents, children and grandparents — and given a budget and a series of responsibilities as part of Missouri's Community Action Poverty Simulation.
"The whole idea is for human-service providers to have an idea what their clients go through," said Jonathan Pettis, executive director at the Franklin Center. "They can take the lessons they learned back to their agencies. It's really powerful."
The simulation included representatives from Children and Youth Services, county Behavioral Health Services, Uncommon Grounds and other human-service organizations; members of the clergy; and officials from Aliquippa, Midland, Baden and the Blackhawk School District.
Groups were given different scenarios that low-income families regularly experience. Some families had absentee fathers or included children being raised by their grandparents. Other families struggled with divorce, affording college and teen pregnancy.
"The needs are very great," said Abigail Young, virtual visitation coordinator for Trails Ministries Inc. in Beaver Falls, a faith-based re-entry ministry that works with incarcerated individuals and their families. "There is so much we all can do."
Young, two of her co-workers and another participant played the roles of the Zuppot family — grandparents "Zola" and "Zeke" and children "Zenobia" and "Zander" — who struggled for four weeks in poverty.
A cashier at the local grocery store, Zola is the breadwinner for the family. Her husband has limited mobility and has to stay at home unless someone can help him travel.
The family was not able to buy food this week. There weren't enough transportation passes to get Zola to work, the market and the Paycheck Advance office. When she did make it to cash her check, the office closed before workers could cash the check.
"Even when this family has cash, they can't get where they need to go," said Lola Thomas, a family coach with Trails Ministries who portrayed Zeke.
The family still can't buy food. Zola never made it to work after she and Zeke visited an interfaith service where workers gave them all-day transportation passes that they used to get to the bank to cash Zola's paycheck and Zeke's disability check.
Continue reading Beaver County Aid Providers Experience Tough Decisions During Poverty Simulation →
Green Energy, Green Jobs, Infrastructure, NAACP, safety net, trade unions, Voting Rights
'Moral Mondays' Launched in Western PA
October 28, 2014 carldavidson	1 Comment
Protesters Rally for Officials to 'Do the Right Thing'
People gather at the Beaver County Courthouse to raise awareness of several social and economic issues.
By Kirstin Kennedy
Oct 28, 2014 – BEAVER — Everyone knows the First Amendment gives citizens the right to assemble. Few regularly exercise it.
But that wasn't the case Monday evening on the steps of the Beaver County Courthouse, when over 30 people gathered with signs and chants.
Willie Sallis, president of the NAACP in Beaver County, said he helped to gather the protest to pressure elected officials to "just do the right thing."
"What is the moral thing to do? … That's what we're trying to keep alive with the union and the civil rights leaders," he said. Sallis paired with several other organizations — including members of local labor unions — for the rally, with the hope of raising awareness of several social and economic issues.
Inspired by a recent lecture given locally by the Rev. William Barber, president of the North Carolina State Conference of the NAACP, Sallis dubbed the rally Moral Monday.
"What's the right thing to do for the poor?" Sallis said. "What's the right thing to do for health benefits? What's the right thing to do when it comes to jobs? What's the right thing to do when it comes to minimum wages? All we're saying is, 'Look, do the right thing.'"
On the courthouse lawn, participants chanted, "Keep it fair; we care."
Continue reading 'Moral Mondays' Launched in Western PA →
NAACP, PDA, Poverty, safety net, Solidarity, Voting Rights
Oct 27: 'Moral Monday' Rally at the Courthouse Monday Evening!
From Tina Shannon:
Monday, October 27th, is a big day for Beaver County.
It's the day we'll have our first Moral Monday rally at the Beaver County Court House.
At 6:00 PM we'll all gather on the steps of the Court House in Beaver to announce our intentions. We intend to follow our moral compass & use our energy to address the issues facing Beaver County & Pennsylvania.
Public education is under attack. It's harder than ever to make a living because unions are under attack too. There aren't enough jobs. Our very water is being threatened because of cuts to the agencies that are supposed to protect it. Inequality is at an all time high, with our brothers & sisters in the African American community suffering the worst. We intend to gather people together & address these issues & other issues that hurt our beloved community.
Please please join us. It's the beginning of coming together. It's the beginning of reaching out. It's the beginning of standing & listening to each other & finding the way forward.
With love & solidarity,
Tina Shannon, 12th CD Progressive Democrats of America
Read more on Moral Mondays:
http://www.thenation.com/article/180491/how-moral-mondays-fusion-coalition-taking-north-carolina-back#
Activists to Watch: Rev. Dr. William J. Barber | BillMoyers.com
GOP, Harrisburg, safety net
The Right Wing's ALEC Takes a Hit in Harrisburg
October 19, 2014 carldavidson	Leave a comment
Preserving Democracy in Pennsylvania
By: Ellen Bravo
Beaver County Blue via FireDogLake
Oct. 17, 2014 – It had all the trappings of an ALEC-backed attack on democracy: Push out a bill prohibiting local governments from passing workplace protections in their own communities. If all else failed, tack the measure onto some popular bill as an amendment and hope the supporters of that bill would want it badly enough to allow the hostile amendment to stand.
Only this time the strategy didn't work, thanks to the strong stand of progressive legislators and the smart organizing of a broad coalition – particularly the leadership of anti-violence advocates.
In this case, the state was Pennsylvania. The preemption attempt was aimed at stopping future passage of a municipal paid sick days ordinance. And the popular bill held hostage was one to aid those who experience domestic violence.
First Rep. Seth Grove, a member of the American Legislative Exchange Council or "ALEC," tried to pass a stand-alone bill that would take away the right of local units of government to pass laws ensuring workers could earn paid sick days – or even unpaid leave. Other legislators added multiple amendments to the bill that would have required every elected official to take votes that might have been unpopular with their constituents. The measure didn't move.
So another ALEC member, John Eichelberger, decided to try a different tack: stick the preemption provision as an amendment onto a bipartisan bill to help those experiencing domestic violence. HB 1796 was written to exempt victims of domestic violence from "nuisance ordinances" that allow landlords to evict those who call 911 more than a certain number of times within a given period. The bill had passed the House with broad bipartisan support.
Continue reading The Right Wing's ALEC Takes a Hit in Harrisburg →
Austerity, Poverty, safety net
Beaver County Still Battling Poverty Problem
September 28, 2014 carldavidson	Leave a comment
Pickup day at a food pantry
By J.D. Prose
Sept 28, 2014 – Pastor Avril Vreen doesn't need newly released data from the U.S. Census Bureau to tell her that poverty is a problem in Beaver County.
All she had to do was watch two young brothers split a free lunch at her Holy Spirit Fellowship Church in New Brighton this past summer. One of the boys agonized over precisely dividing a slice of bread, "which suggested to me that this child has done it before," she said.
"Right there, I said, 'This is more necessary than we thought,'" Vreen said of her church's summer lunch program that served about 2,500 meals to children this year.
According to data recently released by the Census' American Community Survey, nearly 20,700 Beaver County residents, or 12.4 percent, live below the poverty line, including 6,700 children. That total number represents about a 33 percent increase from 2007, when the county's poverty rate was 9.1 percent.
In Allegheny County, nearly 13 percent of its 1.19 million residents, or more than 151,000 people, live below the poverty line while almost 14 percent of Lawrence County residents, about 12,200 people, do.
RELATED: How is the poverty level in Beaver County different from the state average? (Info graphic)
The national poverty rate is 14.5 percent, representing about 45 million Americans, according to TalkPoverty.org.
The government's poverty line is based on annual income. For 2012, the poverty line for a family of four was $23,050 regardless of where the family lives in the United States.
Maj. Richard Lyle, the commander of the Salvation Army in Beaver Falls, said he's seen the effects of poverty firsthand in the Army's food pantries and soup kitchens. Five years ago in Beaver Falls the Salvation Army was servicing about 2,000 families a month, but that crept up before making "a significant jump" to about 2,600 18 months ago.
Continue reading Beaver County Still Battling Poverty Problem →
African-Americans, Poverty, Racism, Right Wing, safety net, Voting Rights
Meet the Preacher Behind Moral Mondays
April 29, 2014 carldavidson	Leave a comment
Coming to Beaver County in June, The Reverend William Barber is charting a new path for protesting Republican overreach in the South—and maybe beyond.
By Lisa Rab
Beaver County Blue via Mother Jones
April 14, 2014 – The Reverend William Barber is charting a new path for protesting conservative overreach in the North Carolina—and beyond.
On a recent Sunday afternoon, the Reverend William Barber II [1] reclined uncomfortably in a chair in his office, sipping bottled water as he recovered from two hours of strenuous preaching. When he was in his early 20s, Barber was diagnosed with ankylosing spondylitis, a painful arthritic condition affecting the spine. Still wearing his long black robes, the 50-year-old minister recounted how, as he'd proclaimed in a rolling baritone from the pulpit that morning, "a crippled preacher has found his legs."
It began a few days before Easter 2013, recalled Barber, pastor at the Greenleaf Christian Church in Goldsboro, North Carolina, and president of the state chapter [2] of the National Association for the Advancement of Colored People (NAACP). "On Maundy Thursday, they chose to crucify voting rights," he said.
"They" are North Carolina Republicans, who in November 2012 took control of the state Legislature and the governor's mansion for the first time in more than a century. Among their top priorities—along with blocking Medicaid expansion and cutting unemployment benefits and higher-education spending—was pushing through a raft of changes to election laws, including reducing the number of early voting days, ending same-day voter registration, and requiring ID at the polls. "That's when a group of us said, 'Wait a minute, this has just gone too far,'" Barber said.
Barber "believed we needed to kind of burst this bubble of 'There's nothing we can do for two years until the next election.'"
On the last Monday of April 2013, Barber led a modest group of clergy and activists into the state legislative building in Raleigh. They sang "We Shall Overcome," quoted the Bible, and blocked the doors to the Senate chambers. Barber leaned on his cane as capitol police led him away in handcuffs.
That might have been the end of just another symbolic protest, but then something happened: The following Monday, more than 100 protesters showed up at the capitol. Over the next few months, the weekly crowds at the "Moral Mondays" protests grew to include hundreds, and then thousands, not just in Raleigh but also in towns around the state. The largest gathering, in February, drew tens of thousands of people [3]. More than 900 protesters have been arrested for civil disobedience over the past year. Copycat movements have started in Florida [4], Georgia [5], South Carolina [6], and Alabama [7] in response to GOP legislation regarding Medicaid and gun control.
Continue reading Meet the Preacher Behind Moral Mondays →
GOP, health care, safety net, Seniors
The Main Target: Obamacare Is Right-Wing Proxy For Social Security and Medicare
October 8, 2013 carldavidson	1 Comment
By Karoli
Progressive America Rising via Crooks and Liars
Oct 7, 2013 – Despite all the sound and fury about Obamacare, here's the truth: It's not the prime target of the right. The real targets are Medicare and Social Security, as Rep. Barton admits in the video above when he says he wants "real reforms in entitlements".
Over the past couple of weeks, it's become apparent to me and many others that this entire showdown is not over Obamacare. The ACA is a convenient patsy because it is new, untested, and they've managed to poison public opinion around it over the past three years.
The real target is Social Security and Medicare. From a political standpoint, waging a war using those programs as hostage would be so wildly unpopular no sane or insane politician would dare choose that route. And so Obamacare has become the convenient stand-in, a cardboard stand-in for their real goals.
Continue reading The Main Target: Obamacare Is Right-Wing Proxy For Social Security and Medicare →
Get Email Notices of New Postings
Subscribe to Beaver County Blue by Email
Beaver County: Working-Class Unity & the 2008 Election
Sweeney Touring with Obama
-Docs & Papers
–Randy Shannon: Working Class Unity and Obama
-Time to Fight for Full Employment
-HealthCare Campaign Links
Conyers on Health Care
Healthcare-NOW!
Local Governments and HR676
Western PA for Single Payer
-Podcasts
The Union Edge Talk Radio – Randy Shannon on Single Payer
Progressive Democrats of America
United for Peace & Justice
We Connect Dots
Healthcare Crisis
Water Quality Slideshow
Winning Against Walmart
Our Newsfeeds
Health Care Now News
Healthcare in the Netherlands: Public or Private?
Racial Justice and Medicare for All
Should we support the individual mandate?
US Mail Not for Sale: The Fight for the USPS
Keep On Keepin' On… Posts from Carl Davidson's Blog
Book Review: Globalization, Police and Fascism The Global Police...
Book Review: Mike Stout's 'Homestead Steel Mill' Is a Manual for...
INSTANT ANALYSIS, NIGHT FOUR. My two cents. By Carl DavidsonThis...
Green Jobs, Clean Energy News
–South Heights Resolution
–Aliquippa Resolution on HR 676
-Ambridge Borough HR 676 Resolution
–Steelworkers Local Union Resolution
–Beaver County Commissioners Resolution
Medicare for All Campaign
–Healthcare Power Point
–About 17th CD PDA (formerly 12th and 4th CD PDA)
Cartoon 06/29/13
–Albany City Council Resolution
Opinion: Indefinite Solitary Violates Human Rights
Quote 12/12/13
Time to Fight for Full Employment
Working Class Unity and the 2008 Election
-Avatar Review
-Giving Thanks
Technorati Fave!
Beaver County Blue
Pittsburgh, Beaver County, Pda

redpajama_set_name: RedPajamaCommonCrawl


You can accentuate your living space by giving it with HANÁK doors.
Luxury interior doors HANÁK not only divide the interior into different residential areas, but also contribute to the appearance and character of your entire house or apartment with their sophisticated design.
HANÁK interior doors are unified with other furniture, thus creating a harmonious interior in a unique style and surface quality. With their rabbetless design, a height of up to 2,500 mm and the special jamb and door wing structure, they represent the absolute top of the range of interior doors available on the market.
The rabbetless design of the interior doors is unrivalled for its appearance, functionality, and clearness of shape. It ensures that the door wing is embedded into the architrave without protruding into the space, thus being on one level with the architrave.
The door wing hangs on hidden embedded hinges, which provide silent operation and excellent bearing capacity. To seal the interior doors completely, you can use an integrated threshold shaped into the bottom edge of the door wing.
The overall appearance of the door is finished with a door handle, which you can choose from hardware manufacturers recommended by our company.
There are many different surface finishes but only paint is a synonym for real quality, resistance and exclusiveness. The doors are painted on modern roll-on lines on both sides, including all the edges.
For painted surfaces, we apply five layers of acrylic paint on both sides of the doors including the edges, and after UV hardening, two more final polyurethane high-gloss layers.
For veneer surfaces in matt finish, we apply four layers of paint on both sides of the door including the edges, and for high gloss, seven layers of acrylic urethane transparent paint.
Interior jambs are replacing obsolete steel jambs, which are not aesthetic. The jambs are put in the door openings in the final phase of construction, when the plastering has been finished and the floor is laid.
Architraves up to a height of 2,100 mm are fitted with two hidden hinges. If the height exceeds 2,100 mm, they are fitted with three hidden hinges. The finish of all surfaces and edges resists humid environments.
The joints of the architraves in the corners can be 45° in the case of veneer and 45° or 90° in the case of painted architraves. The jambs can be produced in a surface finish different from the finish and colour design of the door wing.


text:
# jwt_signed callout

This directory contains the Java source code and Java jars required to compile a
Java callout for Apigee Edge that does generation and parsing / validation of
signed JWT. It also can generate and verify signed JWS. It has support for limited algorithms: HS256, RS256, PS256. This callout uses [the Nimbus
library for JOSE](https://connect2id.com/products/nimbus-jose-jwt).

You do not need to build this Java code in order to use the JWT Generator or Verifier
callout.  The callout will work, with the pre-built JAR file.  Find the pre-built JAR
file in (the API Proxy subdirectory)[../apiproxy/resources/java].

You may wish to modify this code for your own purposes. In that case,
you can modify the Java code, re-build, then copy that JAR into the
appropriate apiproxy/resources/java directory for your API Proxy.

## What Good is This?

Suppose you need to generate a JWT in response to an API call, or a series of API calls
(for example, as part of an Open ID Connect flow).  You could use this callout within an
Apigee Edge API Proxy to generate a JWT.

Suppose a caller presents a JWT that was generated by an external system - like Google
ID, or Azure AD, or Paypal, etc. You could use this callout within an Apigee Edge API
Proxy to validate that JWT.

## Reminder: What's a JWT?

A JWT is just a payload of JSON, with claims about something or someone. The claims
state the identity of the someone/something, the identity of the token issuer, the time
the token was issued, the time the token expires, and maybe some other information about
the person or token holder. A typical signed JWT looks like this:

```
eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.
eyJzdWIiOiJ1cm46NzVFNzBBRjYtQjQ2OC00QkNFLxxxxxx.
D1OlHFCXAF4DPF7TfOphJ7AzpUOXHh7owZF
```

(newlines added for clarity) It's three parts, each separated by a dot.  The indivdual parts are each base64url-encoded payloads.  They represent:

* the header
* the JWT body
* the signature

The JWT body (payload), base64url-decoded, might look like this:

```json
{
  "sub": "api-key-might-go-here-78B13CD0-CEFD-4F6A-BB76",
  "aud": "https://api.mycompany.com/oauth2/token",
  "iss": "https://mycompany.net",
  "exp": 1471902991,
  "iat": 1471902961,
  "nbf": 1471902961,
  "jti": "2e8a36bc-5c14-4105-837f-3245abc03027",
  "scope": "https://www.example.com/accounts.readonly"
}
```

The payload can actually be *any* JSON. The JWT spec defines a set of particular claims to have well-defined meanings. These "registered" claim names include iss, sub, aud, exp, nbf, iat, and jti, to indicate issuer, ubject, audience, expiry, not-before time, issued-at time, and JTI or unique identifier of the token.  The "scope" claim shown above is not a registered claim name, which means it can mean anything the issuer wants it to mean.  This payload, plus the JWT Header, is signed; then the JWT is formed by the dot-concatenation of the base64url-encoded version of the three parts: header, payload signature.

Someone who receives that JWT can then cryptographically verify the signature value against the payload and header, to determine whether the claims within the JWT should be trusted.

## What's a JWS?

A signed JWT is a special case of JWS. Whereas in a JWT, the payload must be
JSON and there are registered names of some of the JSON properties, in a JWS,
the payload is any bytestream. It need not be JSON, and there is no special
meaning attributed to the properties if it is JSON. You could use JWS to sign an
XML document, for example, or a .png image.  A JWS is structured just like a
JWT - the dot-concatenation of three base64url-encoded parts: header, payload,
and signature. The key difference is the middle-part cannot necessarily be
base64-decoded into a JSON string.

## Using the Jar

You do not need to build the JAR in order to use it.
To use it:

1. Include the Java callout policy in your
   apiproxy/resources/policies directory. The configuration should look like
   this:
    ```xml
    <JavaCallout name="JavaJwtHandler" >
      <DisplayName>Java JWT Creator</DisplayName>
      <Properties>...</Properties>
      <ClassName>com.google.apigee.callout.jwtsigned.JwtCreatorCallout</ClassName>
      <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
    </JavaCallout>
   ```

2. Deploy your API Proxy, using
   [pushapi](https://github.com/carloseberhardt/apiploy), [importAndDeploy.js](https://github.com/DinoChiesa/apigee-edge-js/blob/master/examples/importAndDeploy.js),
   [the Import-EdgeApi cmdlet for Powershell](https://github.com/DinoChiesa/Edge-Powershell-Admin/blob/develop/PSApigeeEdge/Public/Import-EdgeApi.ps1),
   or another similar tool.

For some examples of how to configure the callout, see [the related api proxy bundle](../apiproxy).

## Dependencies

Maven will download all of these dependencies for you. If for some
reason you want to download these dependencies manually, you can visit
https://mvnrepository.com .

## Configuring the Callout Policy

There are four callout classes, all in the com.google.apigee.callout.jwtsigned package:

| class name         | description  |
| ------------------ | ------------ |
| JwtCreatorCallout  | create a signed JWT, using HS256, RS256, or PS256 for the algorithm |
| JwtVerifierCallout | parse and verify a signed JWT that uses HS256, RS256, or PS256 |
| JwsCreatorCallout  | create a signed JWS with any string as the payload, using HS256, RS256, or PS256 |
| JwsVerifierCallout | parse and verify a signed JWS that uses HS256, RS256, or PS256 for the algorithm |

How the JWT (or JWS) is generated or validated, respectively,
depends on configuration information you specify for the callout, in the
form of properties on the policy. Some examples follow.

**Generate a JWT using HS256**
```xml
  <JavaCallout name='JavaCallout-JWT-Create'>
    <DisplayName>JavaCallout-JWT-Create</DisplayName>
    <Properties>
      <Property name="algorithm">HS256</Property>
      <!-- the key is likely the client_secret -->
      <Property name="secret-key">{organization.name}</Property>
      <!-- claims -->
      <Property name="subject">{apiproxy.name}</Property>
      <Property name="issuer">http://dinochiesa.net</Property>
      <Property name="audience">{desired_jwt_audience}</Property>
      <Property name="expiresIn">86400</Property> <!-- in seconds -->
      <Property name="continueOnError">false</Property>
    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwtCreatorCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

This configuration of the policy causes Edge to create a JWT with these standard claims:
 - subject (sub)
 - audience (aud)
 - issuer (iss)
 - issued-at (iat)
 - expiration (exp)

It uses HMAC-SHA256 for signing.

Because there is no "id" Property included in the configuration, the "jti" claim
is not included.

The values for the properties can be specified as string values, or
as variables to de-reference, when placed inside curly braces.

It emits the dot-separated JWT into the variable named
    jwt_jwt

There is no way to explicitly set the "issued at" (iat) time.  The iat
time automatically gets the value accurately indicating when the JWT is
generated.

You can set a not-before (nbf) time, to the same time the JWT was
issued, by including this property:

```
      <Property name="not-before"/>
```

You can configure the policy to compute a not-before relative to "now"
using a time-span expression, like 10m to indicate 10 minutes
from now, 3h to indicate 3 hours from now. It looks like this:

```
   <!-- three minutes from now -->
   <Property name="not-before">3m</Property>
```

You can also
specify an explicit not-before time as
number of seconds since epoch:

```
   <Property name="not-before">1601582274</Property>
```

And you can specify an explicit not-before as a string,
in one of these forms:

- ISO-8601: 2017-08-14T11:00:21.269-0700
- RFC-3339: 2017-08-14T11:00:21-07:00
- RFC 1123: Mon, 14 Aug 2017 11:00:21 PDT
- RFC 850: Monday, 14-Aug-17 11:00:21 PDT
- ANSI-C: Mon Aug 14 11:00:21 2017

```
   <Property name="not-before">2017-08-14T11:00:21-07:00</Property>
```

**Properties supported by JwtCreatorCallout**

| property     | description  |
| ------------ | ------------ |
| issuer       | set "iss" claim in payload |
| algorithm    | set "alg" in header        |
| audience     | set "aud" claim in payload |
| subject      | set "sub" claim in payload |
| id           | set "jti" claim in payload |
| kid          | set "kid" in header        |
| secret-key   | specify the secret key to use for HS256 signing. Used only when algorithm=HS256. |
| private-key  | specify the PEM-encoded RSA private key.  Used for algorithm=RS256 or PS256 |
| private-key-password | the password for the private key, if there is one. |
| claim_xxx    | set an arbitrary claim in the JWT.  The `xxx` will be the name of the claim in the JWT, and must not be a registered claim name. |
| json-payload | a JSON payload to use for the JWT; can use this in lieu of specifying individual claims. |

As per [the JWT specification (IETF RFC 7519)](https://tools.ietf.org/html/rfc7519), all claims are optional.
If you include `Property` elements for subject, issuer, audience, and
id, or if you specify  `json-payload` property with any of those claims, they'll be inserted as
claims into the generated JWT. If you don't include that configuration, the generated
JWT won't include those claims. In either case, the JWT is valid.

The continueOnError property is optional. If present, and the value is
"true", then the policy will not return a Fault when there is a policy
error for any reason.  This is mostly useful when parsing and verifying
a JWT. Using this property, you can instruct the policy to not cause the
flow to enter fault status, but only set appropriate context variables,
if the JWT is expired, if the time is before the not-before claim, if
the time is before the issued-at time, if the required claims are not present, or if the signature does not verify.

**Generate a JWT using RS256**

To generate a key signed with RS256, you can specify the private RSA key inside the policy configuration, like this:

```xml
  <JavaCallout name='JavaCallout-JWT-Create-RS256-2' >
    <DisplayName>JavaCallout-JWT-Create-RS256-2</DisplayName>
    <Properties>
      <Property name="algorithm">RS256</Property>

      <!-- private-key and private-key-password used only for algorithm = RS256 -->
      <Property name="private-key">
      -----BEGIN PRIVATE KEY-----
      Proc-Type: 4,ENCRYPTED
      DEK-Info: DES-EDE3-CBC,049E6103F40FBE84

      EZVWs5v4FoRrFdK+YbpjCmW0KoHUmBAW7XLvS+vK3BdSM2Yx/hPhDO9URCVl9Oar
      ApEZC1CxzsyRfvKDtiKWfQKdYKLccl8pA4Jj0sCxVgL4MBFDNDDEau4vRfXBv2EF
      ....
      7ZOF1UXVaoldDs+izZo5biVF/NNIBtg2FkZd4hh/cFlF1PV+M5+5mA==
      -----END PRIVATE KEY-----
      </Property>

      <!-- The password value for the private key should not be hardcoded.
        Put it in the Encrypted KVM, and reference a variable here. -->
      <Property name="private-key-password">{private.privkey_password}</Property>

      <!-- this value goes into the JWT header to identify the
        key with which the JWT is signed. To support key rotation. -->
      <Property name="kid">{key_id}</Property>

      <!-- standard claims -->
      <Property name="subject">{subject_uuid}</Property>
      <Property name="issuer">https://mycompany.net</Property>
      <Property name="audience">Optional-String-or-URI</Property>
      <Property name="expiresIn">86400</Property> <!-- in seconds -->
      <Property name="id"/> <!-- an ID will be dynamically generated -->

      <!-- custom claims to inject into the JWT -->
      <Property name="claim_primarylanguage">English</Property>
      <Property name="claim_shoesize">8.5</Property>

    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwtCreatorCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

The resulting JWT is signed with RSA, using the designated private-key. The payload looks like this:

```json
{
  "sub": "urn:75E70AF6-B468-4BCE-B096-88F13D6DB03F",
  "aud": ["Optional-String-or-URI"],
  "iss": "https://mycompany.net",
  "exp": 1471902991,
  "iat": 1471902961,
  "nbf": 1471902961,
  "jti": "2e8a36bc-5c14-4105-837f-3245abc03027",
  "primarylanguage" : "English",
  "shoesize" : 8.5
}
```

The private key should be in pkcs8 format.
You can produce a keypair in the correct format with this set of shell commands:
```
openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -outform PEM -pubout -out public.pem
openssl pkcs8 -topk8 -inform pem -in private.pem -outform pem -nocrypt -out private-pkcs8.pem
```

The private key need not be encrypted. If it is, obviously you need to
specify the private-key-password. That password can be (should be!) a variable - specify it in curly braces in that case. You should retrieve it from secure storage before invoking this policy.

To use `PS256`, just set the algorithm appropriately:
```
    <Properties>
      <Property name="algorithm">PS256</Property>

```

**Generate a JWS using RS256**

```xml
  <JavaCallout name='JavaCallout-JWS-Create-RS256' >
    <DisplayName>JavaCallout-JWS-Create-RS256</DisplayName>
    <Properties>
      <Property name="algorithm">RS256</Property>

      <!-- private-key and private-key-password used only for algorithm = RS256 -->
      <Property name="private-key">
      -----BEGIN PRIVATE KEY-----
      MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDkgKKKutQu7T8z
      ww0qWXHGEASVZZlhZ/bLdn2BAsmvpfyj8V40LDgKQUbX2d56aYmeYzENAINrLKUX
      ApEZC1CxzsyRfvKDtiKWfQKdYKLccl8pA4Jj0sCxVgL4MBFDNDDEau4vRfXBv2EF
      ....
      7ZOF1UXVaoldDs+izZo5biVF/NNIBtg2FkZd4hh/cFlF1PV+M5+5mA==
      -----END PRIVATE KEY-----
      </Property>

      <!-- this value goes into the JWT header to identify the
        key with which the JWT is signed. To support key rotation. -->
      <Property name="kid">{key_id}</Property>

      <Property name="payload">{request.content}</Property>
    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwsCreatorCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

You can also ask for [detached content](https://tools.ietf.org/html/rfc7515#appendix-F) for the JWS, by specifying `detach-content` boolean as `true`:

```xml
    <Properties>
       ...
      <Property name="detach-content">true</Property>
       ...
```

**Generate a JWT using RS256 - specify PEM file as resource in JAR**

You can also specify the PEM as a named file resource that is bundled in the jar itself. To do this, you need to recompile the jar with your desired pemfile(s) contained within it. The class looks for the file in the jarfile under the /resources directory. Follow the example of the existing pem files.  (Note: you will want to remove the existing PEM files from the JAR, as they are useful only for the examples given, and they should not be used in your own production deployment of the JWT policy)  The configuration when using pem files bundled this way looks like this:

```xml
  <JavaCallout name='JavaCallout-JWT-Create'>
    <DisplayName>JavaCallout-JWT-Create</DisplayName>
    <Properties>
      <Property name="algorithm">RS256</Property>

      <!-- pemfile + private-key-password} used only for algorithm = RS256 -->
      <Property name="pemfile">private.pem</Property>
      <Property name="private-key-password">{var.that.contains.password.here}</Property>

      <!-- claims to inject into the JWT -->
      <Property name="subject">{apiproxy.name}</Property>
      <Property name="issuer">http://dinochiesa.net</Property>
      <Property name="audience">{context.var.that.contains.audience.name}</Property>
      <Property name="expiresIn">86400</Property> <!-- in seconds -->
      <Property name="id"/>
    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwtCreatorCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

The pemfile need not be encrypted. If it is, obviously you need to specify the
password in the configuration of the policy. You can generate encrypted keypairs using the command-line openssl tool, like this:

```
openssl genrsa -des3 -out private-encrypted.pem 2048
```

This callout has been tested with Triple-DES (des3) and with AES256-CBC (-aes256) encrypted PEM files.

The PEM file(s) must be in PEM PKCS8 format, not DER format. (You can
convert keys between various formats using the openssl command line
tool).  The class looks for the file in the jarfile under the /resources
directory.

**Generating a JWT with custom claims**

If you wish to embed other claims into the JWT, you can do so by using
the Properties elements, like this:

```xml
  <JavaCallout name='JavaCallout-JWT-Create'>
    <DisplayName>JavaCallout-JWT-Create</DisplayName>
    <Properties>
      <Property name="algorithm">RS256</Property>

      <!-- pemfile + private-key-password} used only for algorithm = RS256 -->
      <Property name="pemfile">private.pem</Property>
      <Property name="private-key-password">deecee123</Property>

      <!-- standard claims to embed -->
      <Property name="subject">{user_name}</Property>
      <Property name="issuer">http://apigee.net/{apiproxy.name}</Property>
      <Property name="audience">Optional-String-or-URI</Property>
      <Property name="expiresIn">86400</Property> <!-- in seconds -->
      <Property name="id"/>

      <!-- custom claims to embed in the JWT. -->
      <!-- Property names must begin with claim_ . -->
      <Property name="claim_shoesize">{user_shoesize}</Property>
      <Property name="claim_gender">{user_gender}</Property>

    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwtCreatorCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

The value of either standard or custom claims can be fixed strings or references to context variables - strings wrapped in curly braces.

If you would like to embed an array claim in the JWT, then you should use a variable reference, like so:

```xml
      <Property name="claim_api_products">{api_products_list}</Property>
```

And the context variable api_products_list should resolve to a String[].

**Generate a JWT with custom claims from raw JSON**

You can also use the `json-payload` property to just specify claims to include:

```xml
  <JavaCallout name='JavaCallout-JWT-Create'>
    <DisplayName>JavaCallout-JWT-Create</DisplayName>
    <Properties>
      <Property name="algorithm">RS256</Property>

      <!-- pemfile + private-key-password} used only for algorithm = RS256 -->
      <Property name="pemfile">private.pem</Property>
      <Property name="private-key-password">{private.pempassphrase}</Property>

      <Property name="expiresIn">1h</Property>

      <Property name="json-payload">{
      "sub" : "{user_name}",
      "iss" : "https://apigee.net/{apiproxy.name}",
      "aud" : "Optional-String-or-URI",
      "custom-claim" : { "foo": "bar", "quan": 123}
      }
      </Property>
    </Properties>
    <ClassName>com.google.apigee.callout.jwtsigned.JwtCreatorCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

**Verifying a JWT - HS256**

For parsing and verifying a JWT, you need to specify a different Java class. Configure it like so for HS256:

```xml
  <JavaCallout name='JavaCallout-JWT-Parse'>
    <DisplayName>JavaCallout-JWT-Parse</DisplayName>
    <Properties>
      <Property name="algorithm">HS256</Property>

      <Property name="jwt">{request.formparam.jwt}</Property>

      <!-- name of var that holds the shared key (likely the client_secret) -->
      <Property name="secret-key">{organization.name}</Property>

    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwtVerifierCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

This class accepts a signed JWT in dot-separated format, verifies the
signature with the specified key, and then parses the resulting claims.

It sets these context variables:

      jwt_jwt - the jwt string you passed in
      jwt_claims - a json-formatted string of all claims
      jwt_issuer
      jwt_jti
      jwt_audience
      jwt_subject
      jwt_issueTime
      jwt_issueTimeFormatted ("yyyy-MM-dd'T'HH:mm:ss.SSSZ")
      jwt_hasExpiry  (true/false)
      jwt_expirationTime
      jwt_expirationTimeFormatted
      jwt_secondsRemaining
      jwt_timeRemainingFormatted   (HH:mm:ss.xxx)
      jwt_signed (true/false indicating if JWT is signed)
      jwt_verified (true/false indicating if signature has been verified)
      jwt_isExpired  (true/false)
      jwt_isValid  (true/false)
      jwt_reason - human explanation for the reason a JWT is not valid

The "Formatted" versions of the times are for diagnostic or display
purposes. It's easier to understand a time when displayed that way.

The isValid indicates whether the JWT should be honored - true if and only if the
signature verifies and the times are valid, and all the required claims match.

Regarding the times: The policy checks the iat, nbf, and exp times, if they are
present. You can tell the policy to ignore the iat claim - in other words tell
the policy to not validate that iat was in the past - by using this property:

```
      <Property name="ignore-issued-at">true</Property>
```

**Properties supported by JwtVerifierCallout**

| property     | description  |
| ------------ | ------------ |
| algorithm    | require that the specified "alg" appear in the header        |
| claim\_xxx    | verify the claim "xxx" (replace with whatever you like) has the given value in the payload |
| secret-key  | specify the Symmetric key.  Used for algorithm=HS256 |
| public-key  | specify the PEM-encoded RSA public key.  Used for algorithm=RS256 or PS256 |

### Let's talk about Verification

The policy may return SUCCESS or ABORT - in other words it may succeed, or it may put the proxy into Fault processing. Faults occur only case of an un-foreseeable runtime error, or when there is an incorrect configuration. Examples of incorrect configuration:

* if you specify algorithm=RS256 but do not specify a
  certificate or public-key with which to perform the validation.
* if you specify algorithm=HS256 but do not specify a secret-key.
* if you do not specify a jwt property

In all other cases, the callout will return SUCCESS, even if the signature does not verify properly, or if it is expired, and so on. SUCCESS indicates that the policy has completed its check, it does not indicate that the policy found the provided JWT to satisfy the configured constraints. For this reason, api proxy logic should check for the presence and value of variables like jwt_isValid, jwt_isExpired, and jwt_verified.

It is possible for a JWT to be signed and verified but not valid, according to the configured claims you are enforcing. If the JWT signature is not verifiable, then the JWT will also be not valid (jwt_isValid = false).

**Parsing without Verifying - HS256**

For parsing without verifying a JWT, you can specify wantVerify = false.

```xml
  <JavaCallout name='JavaCallout-JWT-Parse'>
    <DisplayName>JavaCallout-JWT-Parse</DisplayName>
    <Properties>
      <Property name="algorithm">HS256</Property>
      <Property name="wantVerify">false</Property>
      <Property name="jwt">{request.formparam.jwt}</Property>
    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwtVerifierCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

This will simply parse the JWT and set the appropriate context variables from the payload, without verifying the signature.
wantVerify defaults to true.

**Verifying and Decoding a JWT - RS256**

To verify and decode a RS256 JWT, you can use a configuration like this:

```xml
  <JavaCallout name='JavaCallout-JWT-Parse-RS256-2'>
    <DisplayName>JavaCallout-JWT-Parse-RS256-2</DisplayName>
    <Properties>
      <Property name="algorithm">RS256</Property>
      <Property name="jwt">{request.formparam.jwt}</Property>
      <Property name="timeAllowance">30000</Property>

      <!-- public-key used only for algorithm = RS256 -->
      <Property name="public-key">
      -----BEGIN PUBLIC KEY-----
      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtxlohiBDbI/jejs5WLKe
      Vpb4SCNM9puY+poGkgMkurPRAUROvjCUYm2g9vXiFQl+ZKfZ2BolfnEYIXXVJjUm
      zzaX9lBnYK/v9GQz1i2zrxOnSRfhhYEb7F8tvvKWMChK3tArrOXUDdOp2YUZBY2b
      sl1iBDkc5ul/UgtjhHntA0r2FcUE4kEj2lwU1di9EzJv7sdE/YKPrPtFoNoxmthI
      OvvEC45QxfNJ6OwpqgSOyKFwE230x8UPKmgGDQmED3PNrio3PlcM0XONDtgBewL0
      3+OgERo/6JcZbs4CtORrpPxpJd6kvBiDgG07pUxMNKC2EbQGxkXer4bvlyqLiVzt
      bwIDAQAB
      -----END PUBLIC KEY-----
      </Property>

      <!-- claims to verify. Can include custom claims. -->
      <Property name="claim_iss">http://dinochiesa.net</Property>
      <Property name="claim_shoesize">8.5</Property>

      <Property name="continueOnError">false</Property>

    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwtVerifierCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

By default, the Verifier callout, whether using HS256 or RS256, verifies
that the nbf (not-before) and exp (expiry) claims are valid - in other
words the JWT is within it's documented valid time range. By default the
Parser allows a 1s skew for iat, exp and nbf claims. You can modify this with
an additional property, as shown above, "timeAllowance". This is useful
if the time on the issuing system is skewed from the time on the
validating system. Set this value in milliseconds. In the example above,
the value 30000 means that a JWT with a nbf time that is less than 30
seconds in the future will be treated as valid.  Similarly a JWT with an
exp which is less than 30 seconds in the past will also be treated as
valid. Use a negative value (eg, -1) to completely disable validity checks on nbf
and exp.

Beyond times, you may wish to verify other arbitrary claims on the
JWT. At this time the only supported check is for string equivalence. So
you may verify the issuer, the audience, or the value of any custom
custom claim (either public/registered, or private). If the claim in the JWT is an array,
the check verifies that the value provided is present in the array.  For example,
consider this JWT:

```json
{
  "sub": "urn:75E70AF6-B468-4BCE-B096-88F13D6DB03F",
  "aud": "https://api.example.com/oauth2/token",
  "iss": "422720CE-6690-463E-9C5A-275423594FE7",
  "exp": 1471902991,
  "iat": 1471902961,
  "jti": "2e8a36bc-5c14-4105-837f-3245abc03027",
  "products" : [ "A", "B", "C"]
}
```

Then, you could verify the presence of ONE of the values of the products array, with
a configuration like this:

```xml
  <JavaCallout name='JavaCallout-JWT-Parse-RS256-2'>
    <DisplayName>JavaCallout-JWT-Parse-RS256-3</DisplayName>
    <Properties>
      <Property name="algorithm">RS256</Property>
      <Property name="jwt">{request.formparam.jwt}</Property>
      <Property name="timeAllowance">30000</Property>
      <Property name="public-key">...</Property>

      <Property name="claim_products">A</Property>

    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwtVerifierCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

Regarding audience - [the spec](https://tools.ietf.org/html/rfc7519) states that the audience is an array of
strings. The parser class validates that the audience value you pass
here (as a string) is present as one of the elements in that array.
Currently there is no way to verify that the JWT is directed to more
than one audience. To do so, you could invoke the Callout twice, with different
configurations.

Alteratively, AFTER invoking the JwtVerifierCallout, compare the context variable 'jwt_claim_aud' to the
result of array.join('|').  In other words, if you want to verify A, B, and C, then compare jwt_claim_aud to 'A|B|C' .  The ordering in the JWT matters. To disregard ordering, you'd need to use a JavaScript to parse the jwt_claim_aud and check for each expected element.

As described previously, you can use the continueOnError property to instruct the policy to return Success, and not enter a fault, if the JWT verification does not succeed for any reason - times, signature, claims, well-formedness, etc.

**Verifying a JWS - RS256**

To verify a RS256-signed JWS, use a configuration like this:

```xml
  <JavaCallout name='JavaCallout-JWS-Verify-RS256'>
    <DisplayName>JavaCallout-JWS-Verify-RS256</DisplayName>
    <Properties>
      <Property name="algorithm">RS256</Property>
      <Property name="jws">{request.formparam.jws}</Property>

      <!-- public-key used only for algorithm = RS256 -->
      <Property name="public-key">
      -----BEGIN PUBLIC KEY-----
      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtxlohiBDbI/jejs5WLKe
      Vpb4SCNM9puY+poGkgMkurPRAUROvjCUYm2g9vXiFQl+ZKfZ2BolfnEYIXXVJjUm
      zzaX9lBnYK/v9GQz1i2zrxOnSRfhhYEb7F8tvvKWMChK3tArrOXUDdOp2YUZBY2b
      sl1iBDkc5ul/UgtjhHntA0r2FcUE4kEj2lwU1di9EzJv7sdE/YKPrPtFoNoxmthI
      OvvEC45QxfNJ6OwpqgSOyKFwE230x8UPKmgGDQmED3PNrio3PlcM0XONDtgBewL0
      3+OgERo/6JcZbs4CtORrpPxpJd6kvBiDgG07pUxMNKC2EbQGxkXer4bvlyqLiVzt
      bwIDAQAB
      -----END PUBLIC KEY-----
      </Property>
    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwsVerifierCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

You can also verify a JWS that uses detached content by specifying the `detached-content` property. This should specify
a string value that has been signed.

```xml
    <Properties>
       ...
      <Property name="detached-content">{request.content}</Property>
       ...

```

**Verify the signature on a JWT, and also Verify specific claims**

To verify specific claims in the JWT after verifying the signature, use additional properties.
Do this by specifying Property elements with name attributes that begin with claim_ :

```xml
  <JavaCallout name='JavaCallout-JWT-Parse'>
    <DisplayName>JavaCallout-JWT-Parse</DisplayName>
    <Properties>
      <Property name="algorithm">RS256</Property>

      <!-- name of var that holds the jwt -->
      <Property name="jwt">{request.formparam.jwt}</Property>

      <!-- name of the pemfile. This must be a resource in the JAR!  -->
      <Property name="pemfile">rsa-public.pem</Property>

      <!-- specific claims to verify, and their required values. -->
      <Property name="claim_sub">A6EE23332295D597</Property>
      <Property name="claim_aud">http://example.com/everyone</Property>
      <Property name="claim_iss">urn://edge.apigee.com/jwt</Property>
      <Property name="claim_shoesize">9</Property>

    </Properties>

    <ClassName>com.google.apigee.callout.jwtsigned.JwtVerifierCallout</ClassName>
    <ResourceURL>java://apigee-callout-jwt-signed-1.0.21.jar</ResourceURL>
  </JavaCallout>
```

All the context variables described above are also set in this scenario.

As above, the isValid variable indicates whether the JWT should be
honored. In this case, though, it is true if and only if the times
are valid AND if all of the claims listed as required in the
configuration are present in the JWT, and their respective values
are equal to the values provided in the <Property> elements.

To specify required claims, you must use the claim names as used within the
JSON-serialized JWT.  Hence "claim_sub", "claim_jti", and "claim_iss", not
"claim_subject" and "claim_issuer".

Verifying specific claims works whether the algorithm is HS256 or RS256.

If you do not include such claims to verify, then the callout doesn't check
claims at all.  You may wish to include checks for claims in the Edge flow,
after the callout returns. To do that, you can reference the context variables,
set by the policy.

**Key sources for Verifying a JWT signed with RS256 and PS256**

There are different ways to specify the public key to use, to verify the
signature on the JWT. Each one uses a different property to specify that value
to the callout.

* `public-key` - specify the PEM-encoded public key directly.

  ```xml
      <Property name="public-key">
      -----BEGIN PUBLIC KEY-----
      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtxlohiBDbI/jejs5WLKe
      Vpb4SCNM9puY+poGkgMkurPRAUROvjCUYm2g9vXiFQl+ZKfZ2BolfnEYIXXVJjUm
      zzaX9lBnYK/v9GQz1i2zrxOnSRfhhYEb7F8tvvKWMChK3tArrOXUDdOp2YUZBY2b
      sl1iBDkc5ul/UgtjhHntA0r2FcUE4kEj2lwU1di9EzJv7sdE/YKPrPtFoNoxmthI
      OvvEC45QxfNJ6OwpqgSOyKFwE230x8UPKmgGDQmED3PNrio3PlcM0XONDtgBewL0
      3+OgERo/6JcZbs4CtORrpPxpJd6kvBiDgG07pUxMNKC2EbQGxkXer4bvlyqLiVzt
      bwIDAQAB
      -----END PUBLIC KEY-----
      </Property>
  ```

* `pemfile` - specify the name of a resource which is compiled into the JAR file.
  ```xml
     <!-- name of the pemfile. This must be a resource in the JAR. -->
     <Property name="pemfile">rsa-public.pem</Property>
  ```

* `certificate`
  ```xml
      <!-- certificate used only for algorithm = RS256 -->
      <Property name="certificate">
      -----BEGIN CERTIFICATE-----
      MIIC4jCCAcqgAwIBAgIQ.....aKLWSqMhozdhXsIIKvJQ==
      -----END CERTIFICATE-----
      </Property>
   ```

* `jwks-uri` - string specifying the JWKS URI.
  ```
    <Property name="jwks-uri">https://www.googleapis.com/oauth2/v3/certs</Property>
  ```
  When you use this, the JWKS will be cached for 10 minutes.

* `modulus` and `exponent` - you need to specify two properties for this one.
  ```
    <!-- these properties are used only for algorithm = RS256 -->
    <Property name="modulus">{context.var.containing.modulus}</Property>
    <Property name="exponent">{context.var.containing.public.exponent}</Property>
  ```

The order of precedence the callout uses for determining the public key is this:

A. jwks-uri
B. public-key
C. modulus and exponent
D. certificate
E. pemfile

If you specify more than one of the above, the callout will use the first
one it finds. It's not the order in which the properties appear in the
configuration file; it's the order described here.

The way you specify the public key does not affect the way the callout verifies
the signature or claims in a JWT or JWS.  It only affects how the public key is
retrieved.

## Some comments about Performance

Performance of this policy will vary depending on many factors: the machine (CPU, memory) that supports the message processor, the other things running on the machine, the other traffic being handled by the message processor, and so on.

In my tests, it takes between 4ms and 12ms to generate a HS256-signed JWT on the Trial (free) version of hosted Apigee Edge. Caching the MACSigner in the Java code optimizes that. When the key is in cache, HS256 signing takes <1ms. Verifying signatures with HS256 takes about 1ms, with caching.

The signers and verifiers for RS256 are also cached, as of 2016 March 20. I haven't measured verification or creation of RS256-signed JWT. The cache will make a difference only at high load.

## Runtime Errors

When verifying a JWT, you may see one of the following errors:

| Error Reason | Explanation |
|--------------|-------------|
| the signature could not be verified. | If using RS256, the certificate or public keydoes not match the private key used to sign the token.  Or, if using HS256, the secret key does not match the secret key used to sign the token.  Or, the token has been modified after having been signed. For example a claim in the JWT was added or removed after signing, or an existing claim was modified after signing. |
| notBeforeTime is in the future | the not-before-time (nbf) claim on the token is in the future. This means the issuer intended that the token should not yet be used. |
| the token is expired | the expiry (exp) claim on the token is in the past. This means the issuer intended that the token should not be used past that time. |
| there is a mismatch in a claim | One of the claims to be verified did not match what was found in the token. |
| audience violation | None of the audience values on token token match the audience given in the policy configuration |
| Algorithm mismatch | the token is signed with an algorithm that does not match what is provided in the policy configuration |

## Building the Jar

To build the binary JAR yourself, follow these instructions.

1. unpack (if you can read this, you've already done that).

2. build the binary with [Apache maven](https://maven.apache.org/). You need to first install it, and then you can:
   ```
   mvn clean package
   ```
   This will also run all relevant tests.

   If during the running of tests, you see an error like this in output:
   ```
       org.bouncycastle.openssl.EncryptionException: exception using cipher - please check password and data.
   ```
   ...it's probably because you don't have the unlimited strength ciphers installed for the JDK.  Install that, and re-build.

3. maven will copy all the required jar files to your apiproxy/resources/java directory.
   If for some reason your project directory is not set up properly, you can do this manually.
   copy target/apigee-callout-jwt-signed-1.0.21.jar to your apiproxy/resources/java directory, as well as all the dependencies.

## License

This project and all the code contained within is Copyright 2017-2020 Google Inc, and is licensed under the [Apache 2.0 Source license](LICENSE).

## Limitations

- This callout does not support JWT with encrypted claim sets.
- This callout does not support EC algorithms

redpajama_set_name: RedPajamaGithub


Edward Estlin Cummings, aka E.E. Cummings, was born in Cambridge, Massachusetts in 1894. While at Harvard, he published his first work in 1917 in the anthology Eight Harvard Poets. He volunteered for a French ambulance service during World War I and was interned at a prison camp on suspicion of espionage. Cummings returned to Paris to study art and pursue a writing career. While there, he published his first book of poetry, Tulips and Chimneys, with the help of the novelist John Dos Passos. For most of the 1920s, he divided his time between Paris and New York City, eventually returning to the United States for good. Cummings became well-known for his innovative use of slang and experimentation with form, syntax, and spelling. He won many awards, including an Academy of American Poets Fellowship, two Guggenheim Fellowships, the Charles Eliot Norton Professorship at Harvard, the Bollingen Prize in Poetry, and a Ford Foundation grant. He died in 1962 having completely altered the face of American poetry.


text:
Read Next Sam Smith Dances His Feelings Away in 'How Do You Sleep?' Video	Send Us a Tip	Subscribe
Home Music Country Music
Aaron Watson Goes From Indie 'Underdog' to Country Chart's Top Dog
The Texas star explains how he topped the Billboard Country Albums chart without a record label or national radio support
Andrew Leahey
Andrew Leahey's Most Recent Stories
Fourth of July Concerts: Who's Playing, How to Watch
How Bon Jovi's Cowboy Anthems Inspired Today's Country Sound
Flashback: See Patsy Cline Croon 'I Fall to Pieces' in Final TV Appearance
Aaron Watson's 'The Underdog' made its debut at the top of the country charts.
Lindsey Cotton
For the second week in a row, America's top-selling country record isn't a big budget release by Jason Aldean, Florida Georgia Line, Miranda Lambert or any of the usual suspects. It's Aaron Watson's The Underdog, an independent album released without the help of a traditional record label or a national radio campaign.
Haven't heard of it? You must not live in Texas.
For the past decade and a half, Aaron Watson has been one of the Lone Star State's heaviest hitters. National trends have come and gone during those 15 years — country-pop, hick-hop, bro-country — but his spurs-and-Stetson traditionalism remains unchanged. He's the kind of country artist you'd take home to mama: a church-going family man whose songs are filled not with AutoTuned vocals and half-lit salutes to Jack Daniel's, but fiddle solos and PG-rated lyrics that sing the praises of truck stop coffee, Frank Sinatra and marital bliss.
Aaron Watson Puts Bite Back into Traditional Country With 'The Underdog'
As of this morning, Watson is also the kind of artist who sells 26,340 copies of his 12th album, The Underdog, during its first week of release. That's enough to place him at the top of the country charts, outpacing his closest competitor, Sam Hunt, by more than 10,000 units. Over on the Billboard 200 chart — which ranks all records together, regardless of genre — The Underdog sits at Number Eight. To help put those numbers into perspective, consider this: last week's Number One country record, Blackberry Smoke's Holding all the Roses, climbed to the top without even cracking 20,000 copies.
"A lot of people call me 'up and coming,' but it's more like 'slow and steady,'" says Watson, speaking to Rolling Stone Country via cellphone during a tour stop in Texas. Soundcheck is just around the corner, but he's still happy to talk at length, speaking with the unhurried Texas twang of a man who wants to stop, sit down and savor the moment rather than rush ahead to the next milestone.
"I've been doing this for 15 years, 12 albums and 2,000-plus shows," he adds. "I've been with my manager, my booking agent and my distributor forever. We have wonderful working relationships, and what we're doing right now is pretty much a 'David versus Goliath' kind of situation, because I've never been embraced by the music industry. There's only so many times you can be told you'll never make it. At some point, you have to say, 'Hey, we're gonna need to take a different route to get where we're wanting to go.' And that's what we did. If someone shuts a door in your face, you don't let that stop you; you pick the lock, take it off its hinges or find another door that's open."
Watson didn't pick those doors locks alone. Multiple times during our conversation, he credits the same triumvirate — "my faith, family and fans" — for taking him from the smallest dancehall in Texas to the stage of the Grand Ole Opry, where he'll play next month. Other key players in Watson's uphill climb include CAA booking agent Aaron Tannenbaum, who's been assembling his 200-plus yearly tour dates for the better part of a decade, and longtime manager Gino Genaro.
Watson has been with Thirty Tigers for more of his career, too, joining the company's roster during its very first year. These days, Thirty Tigers — a business that offers its clients an à la carte menu of management, marketing and distribution services — is one of the biggest names in Americana music, its logo stamped onto the back flaps of albums by Jason Isbell, Sturgill Simpson and St. Paul & the Broken Bones. Back in 2002, though, the company was untested and unproven — much like Watson, who'd only released one album at the time. The songwriter wasn't even making enough money on the road to pay for his own hotel rooms, which was why he found himself sleeping on the floor of the Nashville home owned by David Macias, Thirty Tigers' co-founder, during a trip to Tennessee's capital. The two underdogs hit it off, kickstarting a decade-plus business relationship that continues to this day.
With Thirty Tigers' help, Watson enjoys many of the benefits that a record label would normally provide — especially distribution — without giving up his independence. It's a win/win situation for both sides. Thirty Tigers' biggest success stories have always been the songwriters who, like Watson and Isbell, operate outside of the Nashville norm, relying not on radio airplay (although Watson has enjoyed several Number One hits on Texas radio) but on heavy touring, a strong social media presence and a grassroots fanbase to sell albums. Instead of spending time developing those artists' following, Thirty Tigers can throw its weight behind targeted areas — say, getting Watson's music into record stores outside of Texas, or pairing him up with the same publicist who helped break Brandy Clark's career in 2013.
"There's a value system behind the guy," says Macias, who signed Watson as his first client. "He'll play a show and start talking to a 10-year-old kid afterwards, and his manager will come up and try to get him to talk to a radio programmer instead, but Aaron's not gonna do anything until he sits down and finishes that conversation with that kid. Sometimes, you say, 'Come on, we've gotta conduct business,' but it took us a long time to understand this is who Aaron is, and this is what motivates him. And that's good business."
"When we first started working with Thirty Tigers," Watson remembers, "David asked me, 'How many records do you guys move a week?' And I said, 'Well… about four. We sell about four records a week.' But we felt like we had something with a lot of potential to sell more, and David actually listened to that. The people at Thirty Tigers have become like family since then."
What does all of this recent success mean, though? Is Nashville losing its stranglehold on country music? Is Texas's music scene about to gallop into the national spotlight? Or, as Macias puts it, is Watson's Number One album a sign that listeners are looking to abandon the beers n' babes motif of bro-country in favor of a "more traditional type of country music that's largely been absent from the airwaves?"
Watson doesn't know the answer, but he does think there's enough room on the field for everyone to play ball.
"People ask me about the Sam Hunt record," he says of Montevallo, the pop-influenced, heavily synthesized album that's currently sitting just below The Underdog on the country charts. "Sam Hunt's record is killing it. I own that record. It's probably the most un-country record I've ever heard in the country music industry, but at the same time, it's a great record. My record is incredibly country in comparison, and that's ok. I've told people, 'Hey, wouldn't it be a shame if you went to the store and the only kind of jelly on the shelf was grape?' Sometimes you want apricot. Sometimes you want strawberry. You need different flavors."
Different flavors, indeed. In an industry that's spent the last half-decade dishing out a litany of undercooked songs about country girls, dirt roads and Sundaze, it's The Underdog — not its competition — that's spicing up the menu. If Blackberry Smoke's chart-topping Holding All the Roses was a victory for the little guy, then Watson's album is something much bigger: a sign that maybe, in a genre whose leaders still view radio airplay and major-label record deals as the biggest keys to success, an outsider can climb to the top without playing by Music Row's rules.
"I'm not creating some New Age outlaw movement here," Watson insists. "There's plenty of love to go around. It's not me versus Luke Bryan — although he does owe me a couple of shows. I let Luke open up for me in 2009, and the whole deal was, I was supposed to go out to the southeast and open up some shows for him. Six years later, I'm still waiting for that phone call. Ha! I guess he can send me a text to let me know where to show up."
Hey Luke — your move, bro.
In This Article: Blackberry Smoke,	Sam Hunt


Have you ever tried to wiggle while being injected??
Now, here is how it is when God is working in the life of a man.
Every time you try to influence his work by doing what he has not sent you to do… You are not being still!
When you worry, doubt, fear…You are not being still!
When you don't read or study the word to know the ways of God… You cant be still to let him do his work.
When you don't pray… You can't be still.
When you are not obedient to all he asks of you… You are not being still.
This morning I encourage you to be still as you Look to *Jesus* the author and finisher of Our Faith.
Jesus is exalted in (mention your name), in my life.


text:
Napoli keep pressure on Juve, Roma outlast Torino revival
Patrick Middleton
El Shaaraway found a winner for AS Roma against Torino (AS Roma Twitter)
ROME – A quickfire double against Lazio ensured Napoli kept the pressure on Juventus at the top of the table this weekend, while an inspired comeback from Torino wasn't enough to prevent another win for AS Roma.
Having recovered from a poor opening to the season, Roma secured their fourth win in five matches in the Serie A, recovering well to find a winner against Torino at the Stadio Olimpico after the away side's second-half revival.
A scrappy opener from Nicolo Zainolo was backed up on 34 minutes by Aleksander Kolarov's penalty after Stefan El Shaaraway was brought down in the box. The Italian winger, influential in the game, found the home side's winner with 15 minutes to play after a rejuvenated Torino came out swinging in the second-half and managed to get back on terms.
In Naples, Carlo Ancelotti's side reduced the gap to Juventus to six points, though the Turin side have a game in hand. Two goals in three first-half minutes were enough to see Napoli past fifth-placed Lazio, though a Ciro Immobile strike on 65 minutes threatened to spark a comeback. A straight red for Francesco Acerbi just five minutes later derailed any hopes Lazio fans had of coming away with a draw, as the away side's 10-men weren't able to push for an equaliser.
Third-placed Inter Milan weren't able to keep pace with Napoli, slipping seven points behind after a 0-0 draw with Sassuolo at the San Siro. In the red side of the city, AC Milan travel to Genoa on Monday without striker Gonzalo Higuain, who has been dropped from the matchday squad after rumours about a possible loan move to Chelsea have developed in recent days.
Juventus face Chievo on Monday night at the Allianz Stadium, giving Cristiano Ronaldo the chance to cement his place at the top of the Serie A goalscoring charts. Both Duvan Zapata and Fabio Quagliarella joined the Portuguese striker on 14 goals after hitting four and two, respectively, at the weekend. Zapata's Atalanta thrashed relegation dead-certs Frosinone 5-0, while a Quagliarella brace almost stole three points for Samporia, only to be denied by a last-minute equaliser from Fiorentina.
Elsewhere, SPAL, Bologna and Empoli all made slight ground on Udinese in their fight to avoid relegation. SPAL and Bologna played out a 1-1 draw, while Empoli were denied a 2-1 win by a last-gasp Cagliari equaliser. Udinese, now equal on points with SPAL, were beaten 2-1 at home by Parma.


Make a special gift in memory of or in celebration of loved ones and blessings and be a part of decorating the Sanctuary with Easter Flowers. You may do this online below. You may also complete a Lily envelope and place in the collection plate on Sunday. Please submit your gift by Tuesday, April 16. Names will be listed in the Easter Order of Worship as you enter them here.
Thank you for ordering your Easter Lilies. If you would like to pay online, click here.
Text PLYMOUTH Easter to 73256 to make your payment via text message. Standard text message rates do apply.


Beautiful historical inspired new construction by Sullivan Brothers Builders with access to the Heights Hike and Bike Trail. Walking distance to The Heights Mercantile shops and restaurants. 2 story first floor living with 4 large treated wood porches. Interior features include reclaimed oak flooring throughout entire home, level 5 sheetrock museum finish walls, crown molding, built ins in the living room and Master closet, double hung Jeld Wen wood windows, solid core doors. This is the only current inventory home under construction left. All photos are from other homes built in the Tulane Trails community.


Bhopal, January 1, 2019 (Muslim Saleem): Shri Basant Pratap Singh has assumed the charge of State Election Commissioner. Shri Singh retired from the post of Chief Secretary on December 31, 2018. In a discussion with the officers in the Commission, Shri Singh said that his goal is to conduct free and fair elections. He said that special emphasis will be given on training. He acquainted himself with the officers and employees of the Commission.
Secretary of State Election Commissioner Smt. Sunita Tripathi informed about the system of working of the Commission to the State Election Commissioner. Information about the Commission's activities were given through a film and power point presentation. Other officers-employees were also present.


text:
Giving Cashlessness A Boost
The electronic payment app Boost has been revolutionising the way Malaysians pay for goods and services. No more fiddling with bulky wallets bulging out of trouser pockets; no more rummaging around roomy or cavernous handbags looking for one's wallet, while irate customers in the queue behind you sigh exasperatedly.
You have your phone, you're ready to pay with Boost. It's that simple.
Business Today spoke with the management team at Boost recently, to learn more about the electronic payment method, sometimes referred to as an e-wallet, and gathered some insights about the digital payments ecosystem as well as consumer behaviour and trends.
As a fully-owned subsidiary of telecommunications giant Axiata, Boost the organisation began by digitising telecommunication. It soon progressed into digital vouchers, when the management team realised that while there was increased activity in online shopping, there was no single place where shoppers could purchase said digital vouchers to be used at some of the retailers.
It was through that journey, says a company spokesperson, that good relationships with partners were created.
DIGITISING THE PROCESS
"It was also a time when we realised how phenomenally popular certain target markets were, such as the popularity of gaming with the younger consumers and we also managed to get insights into their behavioural traits," says a member of the management team. "In gaming, they want to be online and they want to continue playing now."
For Boost, creating the environment for consumers who wanted to transact digitally – and more importantly, who wanted the transaction to happen instantaneously, without having to wait – became a natural next step in the larger journey that is the digitising of processes.
SUPPORTING THE DIGITAL ECONOMY
Though the product, the Boost app, is a boon for many consumers and customers who love the ease, simplicity and instantaneous nature of the mobile payment facility, for the organisation, it is also about supporting the digital economy as well as financial inclusion.
"Inevitably, every market will be interested in a digital economy and a cashless society," says a senior manager at Boost, "but financial inclusion also becomes a key question; within Malaysia it is quite interesting because there is a 92% bank population (people who have access to banking facilities) but when we look at those who have actual access to credit, the percentage is only 30."
BOOSTING BENEFITS
"One of the benefits that we see is much as it is a payment solution, the company sees itself the provider of e-money lifestyle app. In doing that, the company is creating an environment and ecosystem to want to come in to, to do everyday transaction."
One of the elements that the Boost app brings to consumers is the instant gaming gratification. Every time a transaction takes place, consumers are notified to do the "shake" and in return, they get cash. It could either be twenty-cents or RM5.
The "shake" system leads to creating instant loyalty and gratification at the same time.
The team at Boost looks beyond the focus of just making profits. They believe, in order to drive change, it takes time. It's about interacting and having consumers use the application instead of focusing on driving the numbers up.
"We do make money at various points of the process; like selling a voucher comes with a certain profit share and if you top-up, there is a certain percentage. It's more about driving adoption and touching the customer before we start focusing on how we can monetise or create value in the long run," says a member of the management team.
A DIGITAL SOLUTION TO CHANGE BEHAVIOURS
The organisation saw a window of opportunity for them to create a digital solution. There was a lot of dependency for case among university students. Not only for day to day activities but the dependency was strong between parents and their children.
Public universities, UTM and UiTM shared a similar vision, with UiTM becoming the first cashless campus by adopting the Boost app into their system.
"We are just one component of the digital campuses at the end of the day. In order to move forward, we had to drive adoption, bring convenience and peace of mind to students and parents as well as create a seamless experience."
BRINGING THE RIGHT VISION INTO PLAY
For Boost, the journey to establishing the app has been a huge learning curve. A journey that taught them, in order to attract the right tenant meant creating the right environment that was very much linked to a start-up.
"Recently, Sweden reached a point of only two percent of their transactions that are done with physical transactions and the Swedish government concerned with the shift, is scaling back on the cashless society shift. I think with anything, there should be a good balance, if too skewed to one side, it could be quite dangerous," says a senior member of the management team.
BOOSTING THE ADOPTION
"The mobile maturity has accelerated significantly in the five years I have been in Malaysia," says a member of the management team, "But the understanding of tech is not always there."
Smartphone penetration being at seventy-percent right now has been the key driver of technology adoption and tech usage. Boost is hoping, as a digital lifestyle e-wallet, to revolutionise day-to-day transaction in a safe, fun, rewarding and secure manner.
Business Today Editorial
MasterChef Australia Judge Is Next Story Group F&B Consultant
Bringing PWTC Back To Its Glory
Small Cells – A Key Driver For A Hyperconnected World
Monash Launches R&D Facility
Growth Focus on Digital Economy: PM
Payment Data Security Key Priority In Digital Economy
MaGIC and MGTC Partner Up to Launch ClimateLaunchpad
An Approach to Big Data
The HP Elite Dragonfly; Made For The Modern Business Professional
Urban Wind Turbine Claims Prestigious International James Dyson Award
A safe way to smoke? Tobacco heating devices obfuscate the issue...
Malindo Air Says Hello To Sydney


How can this be? Dachshunds drop out of top-10 of favorite breeds!
It's a doggone tragedy! For the first time since 1985, Dachshunds are not in the top 10 for the list of most popular breeds of dogs.
It's not because of a lack of love for the ergonomically incorrect canine, but it's because the mushed-face bulldog has gained in popularity. Labrador retrievers still set the record for being the most popular dog around, having been on the number one spot for the past 24 years, but the French Bulldog sneaked its way into the top 10, and that unseated the wiener dog.
Dachshunds have dropped to number 11 in the list as the favorite dog in the United States, according to the American Kennel Club, which has kept these lists for nearly a century.
Poodles were the favorite for decades, but in 2013, the lovable Lab took the number one spot, according to the stats released last week. Just regular bulldogs have raised in pup-ularity to the Number 4 spot, but their bat-eared cousins, the French Bulldogs swaggered up to the top 10 for the first time. Quel dommage!
The rest of the list is as expected: German shepherds, Golden Retrievers, Beagles, and then the Boxers, Yorkshire Terriers and Rottweilers (yes, Rottweilers) somehow beat out the cute Dachshunds. Of course, the AKC numbers reflect puppies and other newly registered dogs, and animal rights activists criticize the AKC for drawing attention to specific breeds because it ignores the mixed-breed dogs, and fuels an interest in puppy mills.
Dachshunds were number 8 in 2009, and are not divided up by mini-Dachshund or tweenies or long-hairs. The breed will not keep their head in the ground. It was officially recognized as a breed by the AKC in 1885.
Of course, those of us in-the-know, will always rank our Dachshunds in the top 10 all the time.
The Havanese jumped from 52nd in 2004 to 25th last year, while the border collie rose from 60th to 39th. Meanwhile, the wirehaired pointing griffon rose from 112th to 74th.
And, if you had any doubt, check out the photo gallery and video of Dachshunds.


BCGA member David Safarik is throwing out a challenge to all BCGA members to consider donating the equivalent of 1 hour of your fuel burn per year to BCGA. .
Unlike most member based organizations, the BCGA does not have an annual membership fee and relies on voluntary member contributions when and if the time is right for its members. .
Thank you David and all of those that have volunteered, donated or contributed to allow this organization to continue to grow and promote GA in British Columbia!
This is a great idea. I'm going to go ahead and donate now. I really appreciate the good work the BCGA is doing for our flying community.


« Santa is coming to Niseko!
Join 150 other skiers and snowboarders for the 43rd New Year's Torchlight Skiing event on the Grand Hirafu ski slopes with torches in hand.
Participants will receive a certificate of participation and there will also be a Lucky Draw.
Alternatively, you can enjoy watching their descent from the village along with a New Year's fireworks display.


Telangana Chief Minister K. Chandrashekhar Rao on Friday decided to form a new Parakala revenue division in Warangal rural district of Telangana.
The Chief Minister signed on the file pertaining to this decision on Friday, a statement said.
The new Parakala division will be formed with Parakala, Atmakur, Sayampet, Damera and Nadikudi mandals.


Celebrate better bike access, view the heavens, and of course, shop local. There are a couple of Oakland book signings coming up, too.
Holiday Popup Artisan Market - Sunday, December 18, 12-4pm. Urban Legend Cellars hosts a popup artisan market featuring Tina Tamale, Boucherie Meats, Semita Dulce, The Uncommon Pickle, Urban Preserves, Sajen Jamu, Baia Pasta and more.


text:
hello@tgtp.co.uk
#70YearsOn
The Exhibition #70YearsOn
The Grand Trunk Project has been developed in partnership with faith leaders, community activists and facilitated by the Faiths Forum for London. Seeking inspiration from the ancient and unifying Grand Trunk Road (G.T. Road) which runs across the subcontinent, we aim to build common ground and open up a much needed dialogue.
2017 will mark 70 years since the independence of India and the creation of modern day Pakistan and Bangladesh. The happenings of 1947 are an important part of the cultural memory of the faith communities disproportionately affected, yet very little has been done to explore the impact. Despite being a divisive and emotional time for many, stories of altruism, bravery and courage have often been underrepresented.
Living in one of the most diverse societies in the world, much has been done to build bridges and develop lasting inter community relations. However, the historical, political and religious divides in the British Asian Faith communities have yet been explored in a relevant manner. The Grand Trunk Project is about opening up dialogue, rediscovering crucial stories of coexistence and developing lasting relationships in our communities that have been fractured.
Inspired by ancient Grand Trunk Road, we work in collaboration with faith leaders, community groups and others, to celebrate our similarities and support much needed dialogue about our differences.
Princess Sophia Duleep Singh – #IWD18 March 8, 2018
Women and Unity: The Unforgettable Legacy of Sridevi February 27, 2018
Celebrating Unity – Lohri January 15, 2018
© Copyright 2018 The Grand Trunk Project. All Rights Reserved. Web Design by Dervish Creative


Nestled along the beautiful Blue Ridge Mountains, the 3-star Hampton Inn Bristol features an outdoor pool and fitness room. Printing, copying and faxing services are offered at the business center. The air-conditioned rooms come with carpeted floors and dark wood headboards. Guests can watch cable TV or enjoy complimentary tea-and-coffee-making facilities. Hot breakfast is served every morning, with special on-the-run breakfast bags for busy visitors. Choose from a number of eateries just minutes from the Bristol Hampton Inn, from Irish pubs to Japanese steakhouses and Southern cuisine. Bristol International Raceway is 8 miles from the Hampton Inn Bristol and the Historic Barter Theater is 12 miles away. The hotel is within 15 miles of the Tri-City Regional Airport.
the hotel Hampton Inn Bristol so we can give you detailed rates for the rooms in the desired period.


An internship abroad as a communication assistant takes place under the responsibility of the communication manager. He is the person in charge of designing and conveying his company's relevant values and image to its stakeholders. He defines the communication strategy so that it serves the company's global objectives. On a daily basis, he redacts contents for partners, deals with press relations, oversees digital communication… Thus, the intern can support the manager on these different tasks or even have a project of his own.
Spreading those media to the targeted audience.
Follow-up and management of press relations.
Follow-up of the media plan.
Studying communication is a requirement to get this internship as it demands a proper training. Thus, students in Corporate Communication, Communication & Marketing or Communication & Journalism have the relevant knowledge. They can be enrolled in a communication or business school or at university.
The further you are in your studies, the more responsibility you could be given. Indeed, a student following studies leading to a Bachelor in corporate communication may be a good fit for an assistant position. On the other hand, a student already following his Masters degree might be given a medium-sized project to achieve.
Some qualities are mandatory to obtain a communication internship abroad.
First of all, you evidently have to be a good communicator. This discipline is at the heart of all of your missions. You have to be familiar with methods, tools and main principles of internal and external communication.
Beyond those technical skills, you need some soft skills. To begin with, your presentation and speech must be impeccable. Indeed, the communication intern is the main representative of the company's values. His own image must therefore convey the one of the company. His speech must be professional and adapted to every person he has the opportunity to interact.
On the other hand, your writing abilities have to be one of your assets. Indeed, the communication assistant has a perfect syntax as he is in charge of creating contents for partners and targets. From the invitation to an event to press relations, his language register must be appropriate to the context. You therefore have to master English and sometimes even the local language professionally.
After a communication internship abroad, you will have improved in various fields.
First, this real-world experience will allow you to master communication tools. You will be taught to write professional contents adapted to the public targeted and the context. You will use office software and digital media. You will manage relations with partners and/or press. After an internship in your discipline, your profile will be even more attractive to recruiters. You will be able to search your next job or internship more comfortably while leaning on this fulfilling experience.
Finally, you will be able to develop a whole new set of cross-disciplinary skills for your future career. Adaptability, as you will live in a country with a different culture and working methods. But also, your organization, rigor, writing abilities… just to mention a few. All these values will be useful for your future, professionally as well as personally.
Our communication internships are available all year long. You can be in the end of your studies, in a gap year or between two academic years. We can find what you're looking for!
Most of our communication assistant internships are available for 6 months. As tasks need a proper training, companies are looking for students for a longer period. Yet, it is sometimes possible to negotiate 5 months internships with some partners. Occasionally, we have this kind of internship for 3 to 6 months.
At PIC Management, we offer the following destinations for a communication internship: Spain, United Kingdom, South America… Discover all our communication assistant internships abroad.


Exactly the bat I've been dreaming of! One piece highest quality! No goofy colors or names! Right on Marucci. You're a ckass act!
My little niece loves her Cat FX softball bat! She purchased it at the Mary nutter earlier this year and everyone at the both we're so nice and helpful and answered all our questions! My hubby even purchased a baseball bat just in case he ever wants to play again! LoL! Keep up the great work ya'll!
This bat has TONS of pop! Really great bat!


TheFishie's Kitchen and Home: It's National Scrapbook Day!
Although this is technically the second one I've celebrated, I was a baby scrapbooker last year and all I did was marvel over all the spiffy events on the web and the neat projects I saw. Robyn is having an all-day event at My Pink Stamper.com which started at 10am CST. I just finished my first project and will have it up shortly. Other events going on include Laura at Following the Paper Trail who is participating in a Ustream blog hop, the Creaking Keepsakes Magazine blog celebration. Also, the Greeting Farm is having a weekend-long challenge.
Check back for more later! Have a wonderful, scrappin Saturday!


Do you know a soccer mom? Soccer moms do so much for their athletes. They chauffeur them to countless practices and games, they're cheerleaders, equipment managers, and lots more. No matter the weather, you can find them on the sidelines at every game showing their support for their favorite player.
If you're looking for a fun gift for the soccer mom in your life, then look no further. We've rounded up 20 fun ideas that any soccer mom will love. I have a few favorites on this list. Which ones do you like?