End User Auth: Cannot generate a valid JWKS and token pair to pass the authentication

Security
1

I was trying to implement end user authentication with our own JWKS and token pair but then found out only the provided sample can pass the authentication. I also tried following the steps to generate new pairs with the get-pem.py script and it would also fail.
I am including the private key file, the generated JWKS and JWT file to the thread, please take a look and help me figure out what is wrong.

FYI: I used the same policy configuration in the example here. https://github.com/istio/istio/tree/master/security/tools/jwt/samples

Private Key:
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAuIHVKpNOgsYwrvb37iQgRdLvMGp0wcqpBc1SsSE+tmFx99VA
SfiURc8l2ibh4rLa3yDsqpK5dVsz6j//HBEo7/NftnifIV3LmVMpfbv0/4+i3pt2
9f0DDa59MJQ8wcuI2OIJufHXaMQnFx/6qJXKbl1tAysix3pu5BAwK7RIaq5IZv7j
eHIIZcs0f4Gf7aUtKtRH0+P4bnaEId9T9TRJHA6NyufjLgJeHaJZPzDIZuv1nR5G
mMQg5RfoWO5Bnwf63W3X6LLczeybG3MRQsMGhlQLZF3kTIxC3Csw41gXTHVzVoI7
mOMxFOdX7QPgH0MPDVRbuPYooTFXTI/Z/GQggQIDAQABAoIBAQCgKQuaVp6LRHEU
IAvdq3xcQBsjIvXRFxOblrzWR26BsJrWsEWLMH29D3DjKmdgezMlBxaJhq34Yj/x
crYHbhnkGJYX9iLkOuA2awsUOukUQmH17GvaYlOZN8MyPSt0ajKTWbtprrX3GnZ4
S2kxmD1NiknLu1EIaY4C6M530ZofB0sNUzxDEXtrqLkgkLS/fsCt0Qemp1LodwHd
+V8f5XNAmrKDHCR8V0TnvmXjESbQbxD/C8Ai5aEL8OPfSdYa+YvuXwFccaCekRex
wjImrKEf6krcP9AYlEhMsjq6Rp3tpvTNvIER/Yl9LZ5rMsryqXwLwZjRv90eRWLt
pXKw96OxAoGBAOBwOlRwtPpOh2dZH3cJWlHXCNxRXTJG1Cj46k/BgdnpoIegpznu
BgY0+uxFFdh7JBUgYwkCtdrlvmAbfGbp9S/JU47yaGy8s4zuPUMS/yV2XLbt/zLu
EmsK3h1Nrah/hqFB0hMrSh5bIR3xOTY21orR1dcKNksTYVPqWYmnpwLNAoGBANJ0
FQ+X9uCy5qFIYIr2sxpOf9qgBP8LbuI6MOSR/wl7wwmSiXRubmUCGsaPim8bK7Po
6Y7jmuvAh7doer6Z6bxcA0hCD8oB+ms4Fk91WqARCQZgR+mPBSin0DMopuPxbafD
p8ehjn3TphbhRIuZMfIqhZgcrTtInlB9p+ogFlyFAoGBAN4GJ63g0SfNB6X1RGs9
lVvgnaNV2hwidT8S/rhndU1dELEa/FMSZGM/hfq1XScKqmc74rzHMZ+aJvpsNmSY
jTT4tPB0XVk0U2rXQ0NXR5CHxrAwQIThftblqVTTwzcs8MIVmvvblzbwb5JvT2mS
Vip96k0QjSU3xtB8xJaog08BAoGAHAVkwHzFXEm1t4fBgv8x/bCyCVQBFkxZaTnC
RMzDnmmiIGYocx45CK3tDr8R+ZUujnfWkTXw7K7n4x3AKhyoKHI/5aEWJRl6VEhV
gCLp/CIIh5bOPGTUlQMzD3y8K+F7bjj43/W82TgTBzzbOZMeOVY8D3LSBfC3U5RH
hT7ce1kCgYBeYmuVx46/32XG7Byl0kpSU+ZvqEViqFIeziewDiFKaKNWsFJzSGDa
fAJyxJsH+wdth5c45nSTfdgb9vk6FEjTXmQwb2nPYrgKgTNJH9ZgjuHY2vgr9sHQ
jFY9tXT9ksHPuftWWLKwjak/+dM/IhifRWZ6v+YPPMALLRmzAVUa5w==
-----END RSA PRIVATE KEY-----

TOKEN:
eyJhbGciOiJSUzI1NiIsImtpZCI6IkluVmk2cUE5ZHdtemFvZWRvVkVpT28ydnFqei1IbGp1dDJpLW16VUlZV3MiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjQ3MTc2Nzc3NDAsImZvbyI6ImJhciIsImlhdCI6MTU2NDA3Nzc0MCwiaXNzIjoidGVzdEBnYXRld2F5LmF1dGgiLCJzdWIiOiJ0ZXN0QGdhdGV3YXkuYXV0aCJ9.d4u6MMLFu0mwLhSF7r8YPdXik8kKHSE0XYdVLwsgjE-fZgl-VDiIVxgzAWcnrx0kYz85CYhd-e0v_I5QAuLeoWn3_sD4cEZ_1haEniOJ5X_67EP_6qCeN3jREHfFm17Z79t50jzDwRGUkOY2cSSI-m_U_rVi8VNilcmj4zBBJzBll7E_s6q8oCi_P0i82xJZ9pLDHV2Vh7MO9mMvVFQqTEAOOnvvcq1WEod7v8UfCUyH9pd1_2tL-A3QisghiBvwjVPtyelvMvFDDwAyIJtFSE7lCacn9Hsr7-8XgQvvHGYKidP6dFtFnpE9yvDxw_OTfHg7AGiWghd1PkNnZleajw

JWKS:
{ “keys”:[ {“e”:“AQAB”,“kid”:“InVi6qA9dwmzaoedoVEiOo2vqjz-Hljut2i-mzUIYWs”,“kty”:“RSA”,“n”:“uIHVKpNOgsYwrvb37iQgRdLvMGp0wcqpBc1SsSE-tmFx99VASfiURc8l2ibh4rLa3yDsqpK5dVsz6j__HBEo7_NftnifIV3LmVMpfbv0_4-i3pt29f0DDa59MJQ8wcuI2OIJufHXaMQnFx_6qJXKbl1tAysix3pu5BAwK7RIaq5IZv7jeHIIZcs0f4Gf7aUtKtRH0-P4bnaEId9T9TRJHA6NyufjLgJeHaJZPzDIZuv1nR5GmMQg5RfoWO5Bnwf63W3X6LLczeybG3MRQsMGhlQLZF3kTIxC3Csw41gXTHVzVoI7mOMxFOdX7QPgH0MPDVRbuPYooTFXTI_Z_GQggQ”}]}

2

Could you share your authentication policy? Please make sure Pilot is able to fetch the public key specified by the jwksUri field in the policy, otherwise the request will just be denied because the envoy doesn’t have the public key to verify the JWT token.

3

Just re-build the whole thing, and now it works. @YangminZhu thanks for your reply. And one more question, does Istio only supports JWT verification via JWKS? I don’t see any references using public key set in the policy. If not, will Istio support it in the future?