config.proto

Package: solo.io.envoy.extensions.filters.http.jwt_authn.v3

Types:

• JwtProvider
• RemoteJwks
• JwksAsyncFetch
• JwtHeader
• ProviderWithAudiences
• JwtRequirement
• JwtRequirementOrList
• JwtRequirementAndList
• RequirementRule
• FilterStateRule
• JwtAuthentication
• PerRouteConfig

Source File: github.com/solo-io/gloo/projects/gloo/api/external/envoy/extensions/filters/http/jwt_authn/v3/config.proto

JwtProvider

Please see following for JWT authentication flow:

• JSON Web Token (JWT) <https://tools.ietf.org/html/rfc7519>_
• The OAuth 2.0 Authorization Framework <https://tools.ietf.org/html/rfc6749>_
• OpenID Connect <http://openid.net/connect>_

A JwtProvider message specifies how a JSON Web Token (JWT) can be verified. It specifies:

• issuer: the principal that issues the JWT. If specified, it has to match the iss field in JWT.
• allowed audiences: the ones in the token have to be listed here.
• how to fetch public key JWKS to verify the token signature.
• how to extract JWT token in the request.
• how to pass successfully verified token payload.

Example:

.. code-block:: yaml

issuer: https://example.com
audiences:
- bookstore_android.apps.googleusercontent.com
- bookstore_web.apps.googleusercontent.com
remote_jwks:
  http_uri:
    uri: https://example.com/.well-known/jwks.json
    cluster: example_jwks_cluster
    timeout: 1s
  cache_duration:
    seconds: 300

[#next-free-field: 11]

"issuer": string
"audiences": []string
"remoteJwks": .solo.io.envoy.extensions.filters.http.jwt_authn.v3.RemoteJwks
"localJwks": .solo.io.envoy.config.core.v3.DataSource
"forward": bool
"fromHeaders": []solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwtHeader
"fromParams": []string
"forwardPayloadHeader": string
"payloadInMetadata": string
"clockSkewSeconds": int

RemoteJwks

This message specifies how to fetch JWKS from remote and how to cache it.

"httpUri": .solo.io.envoy.config.core.v3.HttpUri
"cacheDuration": .google.protobuf.Duration
"asyncFetch": .solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwksAsyncFetch

JwksAsyncFetch

Fetch Jwks asynchronously in the main thread when the filter config is parsed. The listener is activated only after the Jwks is fetched. When the Jwks is expired in the cache, it is fetched again in the main thread. The fetched Jwks from the main thread can be used by all worker threads.

"fastListener": bool

JwtHeader

This message specifies a header location to extract JWT token.

"name": string
"valuePrefix": string

ProviderWithAudiences

Specify a required provider with audiences.

"providerName": string
"audiences": []string

JwtRequirement

This message specifies a Jwt requirement. An empty message means JWT verification is not required. Here are some config examples:

.. code-block:: yaml

Example 1: not required with an empty message

Example 2: require A

provider_name: provider-A

Example 3: require A or B

requires_any: requirements: - provider_name: provider-A - provider_name: provider-B

Example 4: require A and B

requires_all: requirements: - provider_name: provider-A - provider_name: provider-B

Example 5: require A and (B or C)

requires_all: requirements: - provider_name: provider-A - requires_any: requirements: - provider_name: provider-B - provider_name: provider-C

Example 6: require A or (B and C)

requires_any: requirements: - provider_name: provider-A - requires_all: requirements: - provider_name: provider-B - provider_name: provider-C

Example 7: A is optional (if token from A is provided, it must be valid, but also allows

missing token.) requires_any: requirements:

• provider_name: provider-A
• allow_missing: {}

Example 8: A is optional and B is required.

requires_all: requirements:

• requires_any: requirements:
  • provider_name: provider-A
  • allow_missing: {}
• provider_name: provider-B

[#next-free-field: 7]

"providerName": string
"providerAndAudiences": .solo.io.envoy.extensions.filters.http.jwt_authn.v3.ProviderWithAudiences
"requiresAny": .solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwtRequirementOrList
"requiresAll": .solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwtRequirementAndList
"allowMissingOrFailed": .google.protobuf.Empty
"allowMissing": .google.protobuf.Empty

JwtRequirementOrList

This message specifies a list of RequiredProvider. Their results are OR-ed; if any one of them passes, the result is passed

"requirements": []solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement

JwtRequirementAndList

This message specifies a list of RequiredProvider. Their results are AND-ed; all of them must pass, if one of them fails or missing, it fails.

"requirements": []solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement

RequirementRule

This message specifies a Jwt requirement for a specific Route condition. Example 1:

.. code-block:: yaml

• match: prefix: /healthz

In above example, “requires” field is empty for /healthz prefix match, it means that requests matching the path prefix don’t require JWT authentication.

Example 2:

.. code-block:: yaml

• match: prefix: / requires: { provider_name: provider-A }

In above example, all requests matched the path prefix require jwt authentication from “provider-A”.

"match": .solo.io.envoy.config.route.v3.RouteMatch
"requires": .solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement
"requirementName": string

FilterStateRule

This message specifies Jwt requirements based on stream_info.filterState. This FilterState should use Router::StringAccessor object to set a string value. Other HTTP filters can use it to specify Jwt requirements dynamically.

Example:

.. code-block:: yaml

name: jwt_selector requires: issuer_1: provider_name: issuer1 issuer_2: provider_name: issuer2

If a filter set “jwt_selector” with “issuer_1” to FilterState for a request, jwt_authn filter will use JwtRequirement{“provider_name”: “issuer1”} to verify.

"name": string
"requires": map<string, .solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement>

JwtAuthentication

This is the Envoy HTTP filter config for JWT authentication.

For example:

.. code-block:: yaml

providers: provider1: issuer: issuer1 audiences: - audience1 - audience2 remote_jwks: http_uri: uri: https://example.com/.well-known/jwks.json cluster: example_jwks_cluster timeout: 1s provider2: issuer: issuer2 local_jwks: inline_string: jwks_string

rules: # Not jwt verification is required for /health path - match: prefix: /health

 # Jwt verification for provider1 is required for path prefixed with "prefix"
 - match:
     prefix: /prefix
   requires:
     provider_name: provider1

 # Jwt verification for either provider1 or provider2 is required for all other requests.
 - match:
     prefix: /
   requires:
     requires_any:
       requirements:
         - provider_name: provider1
         - provider_name: provider2

[#next-free-field: 6]

"providers": map<string, .solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwtProvider>
"rules": []solo.io.envoy.extensions.filters.http.jwt_authn.v3.RequirementRule
"filterStateRules": .solo.io.envoy.extensions.filters.http.jwt_authn.v3.FilterStateRule
"bypassCorsPreflight": bool
"requirementMap": map<string, .solo.io.envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement>

PerRouteConfig

Specify per-route config.

"disabled": bool
"requirementName": string