Access token validation

For more information or other OAuth options, see the OAuth about page.

Before you begin link

1. Follow the Get started guide to install Gloo Gateway.

2. Follow the Sample app guide to create a gateway proxy with an HTTP listener and deploy the httpbin sample app.

3. Get the external address of the gateway and save it in an environment variable.

     export INGRESS_GW_ADDRESS=$(kubectl get svc -n gloo-system gloo-proxy-http -o jsonpath="{.status.loadBalancer.ingress[0]['hostname','ip']}")
   echo $INGRESS_GW_ADDRESS  
     

     kubectl port-forward deployment/gloo-proxy-http -n gloo-system 8080:8080
     

Step 1: Set up your Identity Provider link

Set up an OpenID Connect (OIDC) compatible identity provider (IdP).

For example, you can use Keycloak as an IdP.

Step 2: Enforce access token validation link

Use AuthConfig and GlooTrafficPolicy resources to apply the auth rules to the routes that you want to secure with access token validation.

1. Create an AuthConfig resource with your access token validation rules. The following example uses JWT validation and an inline JWKS server to provide the JWT.

   • For more access token validation options, see the Gloo Edge API docs.
   • For more information about JWTs, see the JWT guide.
   • Is your JWT in a custom header? By default, the JWT token is expected in the Authorization: Bearer <token> header format. If you use a different header, apply a transformation policy.
   • For more JWT options, such as to fetch the token from a remote JWKS instead of an inline JWKS, see the Gloo Edge API docs.

     kubectl apply -f- <<EOF
   apiVersion: extauth.solo.io/v1
   kind: AuthConfig
   metadata:
     name: oauth-jwt-validation
     namespace: httpbin
   spec:
     configs:
     - oauth2:
         accessTokenValidation:
           jwt:
             localJwks:
               inlineString: >-
                 $KEYCLOAK_CERT_KEYS
   EOF
     

   Review the following table to understand this configuration.

   Field	Description
   oauth2.accessTokenValidation.jwt	Set up the OAuth policy to validate access tokens that conform to the JSON Web Token (JWT) specification.
   localJwks.inlineString	Embed a local JWKS as a string, based on the value that you retrieved when you set up your IdP.

2. Create a GlooTrafficPolicy resource that refers to the AuthConfig that you earlier. The following policy applies external auth to all routes that the Gateway serves.

     kubectl apply -f - <<EOF
   apiVersion: gloo.solo.io/v1alpha1
   kind: GlooTrafficPolicy
   metadata:
     name: oauth-jwt-validation
     namespace: gloo-system
   spec:
     targetRefs:
       - name: http
         group: gateway.networking.k8s.io
         kind: Gateway
     glooExtAuth:
       authConfigRef:
         name: oauth-jwt-validation
         namespace: httpbin
   EOF
     

3. Verify that the AuthConfig is in an Accepted state.

     kubectl get authconfig oauth-jwt-validation -n httpbin -o yaml
     

   If you see a REJECTED error similar to invalid character 'k' looking for beginning of object key string, try copying the $KEYCLOAK_CERT_KEYS value manually again.

Step 3: Verify access token validation link

Send various requests to verify that API key auth is enforced for your routes.

1. Send a request to the httpbin app without an access token. Verify that your request is denied and that you get back a 403 HTTP response code.

     curl -i http://$INGRESS_GW_ADDRESS:8080/status/200 -H "host: www.example.com"
     

     curl -i localhost:8080/status/200 -H "host: www.example.com"
     

   Example output:

     HTTP/1.1 403 Forbidden
     

2. Generate an access token from your IdP, such as with the following command for Keycloak. If you get a 404 response, verify that the Keycloak URL and client credentials are correct. Common errors include using a different realm.

     export USER1_TOKEN=$(curl -Ssm 10 --fail-with-body \
   -d "client_id=${KEYCLOAK_CLIENT}" \
   -d "client_secret=${KEYCLOAK_SECRET}" \
   -d "username=user1" \
   -d "password=password" \
   -d "grant_type=password" \
   "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" |
   jq -r .access_token)
     

     echo $USER1_TOKEN
     

   Example output:

     eyJhbGc...
     

3. Send another request to the httpbin app. This time, you include the JWT in the authorization header. Verify that the request succeeds and that you get back a 200 HTTP response code.

     curl -i http://$INGRESS_GW_ADDRESS:8080/status/200 -H "host: www.example.com" \
   -H "Authorization: Bearer $USER1_TOKEN"
     

     curl -i localhost:8080/status/200 -H "host: www.example.com" -H "Authorization: Bearer $USER1_TOKEN"
     

   Example output:

     HTTP/1.1 200 OK
     

Cleanup link

  kubectl delete authconfig oauth-jwt-validation -n httpbin
kubectl delete gloo-traffic-policy oauth-jwt-validation -n gloo-system