For example, you might have use cases similar to the following:

  • For a single virtual gateway, you have many routes. For each route, you want to enforce that only a specific JWT provider is valid.
  • You want different teams to be able to add their own policies, for more self-service capabilities.

For more information about JWTs, see the JWT overview and API docs.

Before you begin

  1. Set up Gloo Mesh Gateway in a single cluster.
  2. Install Bookinfo and other sample apps.
  3. Configure an HTTP listener on your gateway and set up basic routing for the sample apps.

Configure JWT policies

Create a JWT policy for each route that requires JWT authentication.

Review the following table to understand this configuration. For more information, see the API docs.

SettingDescription
applyToRoutesUse labels to configure which routes to apply the policy to. This example label matches the app and route from the example route table that you apply separately. If omitted and you do not have another selector such as applyToDestinations, the policy applies to all routes in the workspace.
phaseThis example sets no priority, so the default value of zero is used.
providersEnter a name for the provider to help you map the provider when viewing logs to debug. The provider name does not affect the policy’s behavior and cannot be used by other resources to select the policy.
claimsToHeadersOptionally set the claims from the JWT payload that you want to extract and add as headers to the request before the request is forwarded to the upstream destination. This example extracts the same two org and email claims and adds them as headers for both providers. The login-example also has an additional scope claim.
claimsToHeaders.appendEnter a boolean value to add a claim’s value if the header exists in the request. Use true to append the claim’s value to the header, and false to overwrite any existing value in the header.
claimsToHeaders.claimEnter the name of the claim in the JWT payload to get the value for the header.
claimsToHeaders.headerEnter the request header that the value of the claim is copied to.
issuerOptionally, set the JWT issuer, usually as a subdomain of a URL or email address. If set, the iss field in the JWT token must match this field, or else the request is denied. If unset, the iss field in the JWT token is not checked. In this example, the issuer is set to a unique URL per provider, https://dev.example.com or https://login.example.com.
keepTokenThis value is set to true so that the JWT is kept in the request after verification. This way, other policies can use the JWT information as needed.
localProvide the PEM-formatted public key to verify the JWT token. In this example, the public key is written inline to the policy for testing purposes. For production scenarios, you can set a remote reference to your JSON Web Key Set (JWKS) server instead of this local setting.

Try out multiple JWT policies

For quick testing, you can use sample keys with dev-example and login-example JWTs. For more details about the sample JWT, see the GitHub readme.

  1. Apply the JWT policy with the dev-example provider for the httpbin app. For more information about this policy, see the configuration example.

      kubectl apply -f https://gist.githubusercontent.com/artberger/674bab05350c9a048303cc7daaffe730/raw/daf7d9b64e5e9ecf309f17123e01f5a6cbb6c7eb/jwt-policy-basic.yaml
      
  2. Create another JWT policy with the login-example provider for the ratings app. For more information about this policy, see the configuration example.

      kubectl apply -f https://gist.githubusercontent.com/artberger/a69e3d405457ae9a3ac2ad1838937b86/raw/04de8f1042ab8d63b63e6781d1508e61163f4133/jwt-policy-basic-login.yaml
      
  3. Send a request to the httpbin app without any authentication. Notice that your request is denied with a 401 error.

    Example output:

      HTTP/1.1 401 Unauthorized
    www-authenticate: Bearer realm="http://www.example.com/get"
    ...
    Jwt is missing
      
  4. Get a sample JWT that is preconfigured to meet the validation requirements that you set in the JWT policy for the dev-example provider.

      TOKEN=$(curl https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/jwt/dev-example.jwt -s) && echo "$TOKEN" | cut -d '.' -f2 - | base64 --decode -
      

    Example output:

      {"iss":"https://dev.example.com","exp":4804324736,"iat":1648651136,"org":"internal","email":"dev1@solo.io","group":"engineering","scope":"is:developer%  
      
  5. Try the request to the httpbin app again, this time with your dev-example token. Notice that your request is now accepted!

    In the example output you get back a 200 response. You also can see the X-Email and X-Org headers that you appended in the claimsToHeaders section of the policy.

       HTTP/1.1 200 OK 
       ...
       {
         "args": {}, 
         "headers": {
           "Accept": "*/*", 
           "Host": "www.example.com", 
           "X-Email": "dev1@solo.io", 
           "X-Envoy-Attempt-Count": "1", 
           "X-Envoy-Decorator-Operation": "httpbin.default.svc.cluster.local:8000/*", 
           "X-Envoy-Internal": "true", 
           "X-Httpbin": "true", 
           "X-Org": "internal"
         },
       
  6. Send a request to the ratings app without authentication. Notice that your request is denied with a 401 error.

    Example output:

      HTTP/1.1 401 Unauthorized
    www-authenticate: Bearer realm="http://www.example.com/get"
    ...
    Jwt is missing
      
  7. Get another sample JWT that is preconfigured to meet the validation requirements that you set in the JWT policy for the login-example provider.

      TOKEN_LOGIN=$(curl https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-gateway/jwt/login-example.jwt -s) && echo "$TOKEN_LOGIN" | cut -d '.' -f2 - | base64 --decode -
      

    Example output:

      {"iss":"https://login.example.com","exp":4804324736,"iat":1648651136,"org":"external","email":"user2@example.com","group":"user","scope":"is:reader%  
      
  8. Try the request to the ratings app again, this time with your login-example token. Notice that your request is now accepted!

    In the example output you get back a 200 response.

      HTTP/1.1 200 OK 
    ...
    * Connection #0 to host www.example.com left intact
    {"id":1,"ratings":{"Reviewer1":5,"Reviewer2":4}}%   
      

Cleanup

You can optionally remove the resources that you set up as part of this guide.
  kubectl -n bookinfo delete jwtpolicy jwt-policy-ratings
kubectl -n httpbin delete jwtpolicy jwt-policy