Hello,
I am trying to configure JWT authentication on an istio-ingress gateway.
Here is how my config looks like:
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
name: my-authentication
namespace: istio-system
spec:
selector:
matchLabels:
istio: ingressgateway
jwtRules:
- issuer: "https://auth.dev.my.com"
jwks: "{\"keys\":[{\"kty\":\"EC\",\"crv\":\"P-521\",\"kid\":\"d73c9314db8467a44a47c8492832e4eecfe1f05a\",\"x\":\"AHjB1n3AJ28NTI_sd-d2WS3HqY62tyyf2WQdmxJ25cQ_FjSuoi3OZ2iUFnIb_Io0iLpfdzK1pWXOG3wFIy8PCxE8\",\"y\":\"Aa9sQ-fElPyNdYWxszkUFIs0s5Cr-E2nDAb-I0UCM8Iw7vocN5tWSqZggiSN_Gjw5kykdjpHCjlZwvQRToU2Sl_z\"},{\"kty\":\"EC\",\"crv\":\"P-521\",\"kid\":\"a442711b9e2c722ed0c3d7daf0a04fd36961ef5f\",\"x\":\"ADptQRR6Bq0yWh3jxskEGRzY6-gBde0PbXwlN74zDpxX5EcX1gIKYUfpvacI05pEaazujh7WNU_XyGvwbJ_7XwSa\",\"y\":\"AQLhtYL_rnOjoVlxRq4H-lPFR8HokJsJ5q9iYTwD8HL4Dm25S52MyNE694yj_RmOPi59vH6aYjaPD-UTWMWRp0Z8\"}]}"
outputPayloadToHeader: X-My-Auth-Payload
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: my-authentication-default
namespace: istio-system
spec:
selector:
matchLabels:
istio: ingressgateway
action: ALLOW
rules:
- when:
- key: request.auth.claims[iss]
values:
- https://auth.dev.my.com
I am making a request with a valid JWT in access_token http-only cookie which is transformed into an Authorization header by the following EnvoyFilter:
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: my-auth-token
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: HTTP_FILTER
match:
context: GATEWAY
listener:
filterChain:
filter:
name: envoy.filters.network.http_connection_manager
portNumber: 8443
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.lua
typed_config:
'@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
inlineCode: |
function stringSplit(inputstr, sep)
if sep == nil then
sep = "%s"
end
local t={}
for str in string.gmatch(inputstr, "([^"..sep.."]+)") do
table.insert(t, str)
end
return t
end
function envoy_on_request(handle)
headers = handle:headers()
path = headers:get(":path")
if path == "/health" or path == "/metrics" then
return
end
cookieString = headers:get("cookie")
if cookieString ~= nil then
splitCookieString = stringSplit(cookieString, ";")
jwt = nil
for i, cookieItem in ipairs(splitCookieString) do
if string.find(cookieItem, "access_token") ~= nil then
jwt = string.gsub(cookieItem, "access_token=", "")
end
end
if jwt ~= nil then
token = string.gsub(jwt, "^ ", "")
headers:replace("Authorization", "Bearer: "..token)
end
end
end
However, for every request, I keep getting 403 Forbidden with the following in the body:
RBAC: access denied
I am not able to find any logs why this is happening.
Only potential clue I did find is this error message in the discovery container of istiod:
error authorization skipped rule ns[istio-system]-policy[my-authentication-default]-rule[0]: request.auth.claims[iss] must not be used in TCP
I have spent quite a few hours on this. Would really appreciate any help I can get here.
Thanks!
