RBAC: access denied using JWT with multiple audiences

Security
1

Hi,

I have a JWT with two audiences:

  "aud": [
    "workspace-test1",
    "workspace-test2",
  ],

This token allows me access to a service with an authorization policy configured for the first audience in the list:

action: ALLOW
rules:
- from:
  - source:
      requestPrincipals:
      - '*'
  when:
  - key: request.auth.audiences
    values:
    - workspace-test1

But returns 403: rbac: access denied with the second audience in the list.

action: ALLOW
rules:
- from:
  - source:
      requestPrincipals:
      - '*'
  when:
  - key: request.auth.audiences
    values:
    - workspace-test2

Does istio 1.6.8 support multiple audiences in the JWT? (We recently upgraded from Istio 1.1, where this configuration was working.)

2

Hi Mark,

Thanks for your post. Could you try look into rbac debug log following this guide.
I will also try to reproduce the issue in my side. Thanks.