validate claims inside JWT using envoy

Question

{
  "aud": "123123-1232-123123-2323-123",
  "iss": "https://url",
  "iat": 2112,
  "nbf": 1212,
  "exp": 1212,
  "aio": "ewq32ee23e2e=",
  "azp": "123123-1232-123123-2323-123",
  "azpacr": "1",
  "oid": "123123-1232-123123-2323-123",
  "rh": "1.qqfn4wanflwf3aldAAA.",
  "roles": [
    "default"
  ],
  "sub": "123123-1232-123123-2323-123"
}

My JWT contains the above claims. i have to validate 3 things

audience : aud
issuer : iss
roles : 'roles' should be present in JWT. Its value array should contain 'default'. How can this be achieved with envoy?

I researched a bit and found a way to validate audience 'aud' and issuer 'iss'.

  http_filters:
    - name: envoy.filters.http.jwt_authn
      typed_config: 
        "@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
        providers:
          "auth-iam":
            issuer: https://url
            forward: true,
            audiences:
            - 123123-1232-123123-2323-123  # [audience]
            remote_jwks:
              http_uri:  # [3]
                uri: https://url/keys # [simple]
                cluster: auth-iam
                timeout: 5s
              cache_duration:
                seconds: 900                        
        rules:  
          - match:
              prefix: /actuator/health
          - match:
              prefix: /
            requires:
              provider_name: auth-iam

score 1 · Answer 1 · answered Feb 15 '23 at 07:56

i was able to acheive the above by adddding a lua filter and writing a lua script to validate token claims. it works in these 2 steps :

add the payload from JWT to a variable jwt_payload.

- name: envoy.filters.http.jwt_authn
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
    providers:
      "auth-iam":
        issuer: https://url,
        forward: true
        audiences:
        - 123123-1232-123123-2323-123
        remote_jwks:
          http_uri:
            uri: https://login.microsoftonline.com/common/discovery/v2.0/keys
            cluster: auth-iam
            timeout: 5s
          cache_duration:
            seconds: 900
        payload_in_metadata: jwt_payload
        rules: 
          - match:
              prefix: /health
          - match:
              prefix: /
            requires:
              provider_name: auth-iam

retreive the payload and write custom logic to validate the token claims. the filter would be added just above - name: envoy.filters.http.router

- name: envoy.filters.http.lua
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
    inline_code: |
      function envoy_on_request(request_handle)
        local meta = request_handle:streamInfo():dynamicMetadata()
        for key, value in pairs(meta) do
          -- request_handle:logInfo("extract dynamicMetadata key: "..key)
          -- request_handle:logInfo("extract dynamicMetadata value: "..value.jwt_payload.roles[1])
          if(value.jwt_payload.roles == nil or value.jwt_payload.roles[1] ~= "default")
          then
            request_handle:respond({[":status"] = "403",},"JWT validation failed.") 
          end
        end
      end

validate claims inside JWT using envoy

1 Answers1