Alibaba Cloud Service Mesh:Configure JWT authentication in an ASMSecurityPolicy

Background information

A JWT contains claims, such as user information, that are digitally signed. A system can verify the signature to confirm the token's authenticity and integrity, thereby verifying the user's identity.

Procedure

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > ASMSecurityPolicy.

3. On the ASMSecurityPolicy page, click Create.

4. In the Create ASMSecurityPolicy dialog box, select JWT and click OK.

   1. In the JWT Config wizard, configure the parameters and click Next.

      Parameter		Example
      ASMSecurityPolicyName		test-jwt
      Certification Rules	Issuer	testing@secure.istio.io
      	JWKS Source	jwks
      	Key	{ "keys":[ {"e":"AQAB","kid":"DHFbpoIUqrY8t2zpA2qXfCmr5VO5ZEr4RzHU_-envvQ","kty":"RSA","n":"xAE7eB6qugXyCAG3yhh7pkDkT65pHymX-P7KfIupjf59vsdo91bSP9C8H07pSAGQO1MV_xFj9VswgsCg4R6otmg5PV2He95lZdHtOcU5DXIg_pbhLdKXbi66GlVeK6ABZOUW3WYtnNHD-91gVuoeJT_DwtGGcp4ignkgXfkiEm4sw-4sfb4qdt5oLbyVpmW6x9cfa7vs2WTfURiCrBoUqgBo_-4WTiULmmHSGZHOjzwa8WtrtOQGsAFjIbno85jp6MnGGGZPYZbDAa_b3y5u-YpW7ypZrvD8BgtKVjgtQgZhLAGezMt0ua3DRrWnKqTZ0BJ_EyxOGuHJrLsn00fnMQ"}]}

   2. On the Workload and Match Rules page, click Add Workload Group. In the New Workload Group dialog box, configure the parameters and click OK. Finally, click Submit.

      The following table describes the example configurations.

      Parameter	Description
      Workload Group Name	Set the value to test-policy.
      Workload List	Click Add Workload. In the Add Workload dialog box, select Gateway Scope. In the Select workloads section, select the target workload and click the icon to move it to the selected section. Then, click OK.
      Match Rule List	The following Match Mode options are available: Auth If Matched: Requests that match the rules must carry a valid JWT to succeed. Bypass Auth If Matched: Requests that match the rules can succeed without a JWT or with a valid JWT. Requests with an invalid JWT will fail. In this example, set Match Mode to Auth If Matched, set Matching Rules to Custom Matching Rules, and click Add Match Rule to configure the following rules. Rule 1: Enable the Path switch and set its value to /static/*. Rule 2: Enable the Path switch and set its value to /api/*.

      On the Complete page, the success message ASMSecurityPolicy created successfully is displayed. You can click View YAML to review the resource's configuration or click Complete to return to the ASMSecurityPolicy page.

5. Verify that the JWT authentication configuration is effective.

   1. Run the following commands to test access.

      curl -I http://${GATEWAY_ADDRESS}/productpage  # Returns 200.
      curl -I http://${GATEWAY_ADDRESS}/api/v1/products/1  # Returns 403.
      curl -I http://${GATEWAY_ADDRESS}/static/jquery.min.js  # Returns 403.
      
      # Set the JWT.
      TOKEN=eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjQ2ODU5ODk3MDAsImZvbyI6ImJhciIsImlhdCI6MTUzMjM4OTcwMCwiaXNzIjoidGVzdGluZ0BzZWN1cmUuaXN0aW8iLCJzdWIiOiJ0ZXN0aW5nQHNlYcyVyZS5pc3Rpby5pbyJ9.CfNnxWP2tcnR9q0vxyxweaF3ovQYHYZl82hAUsn21bwQd9zP7c-LS9qd_vpdLG4Tn1A15NxfCjp5f7QNBUo-KC9PJqYpgGbaXhaGx7bEdFWjcwv3nZzvc7M__ZpaCERdwU7igUmJqYGBYQ51vr2njU9ZimyKkfDe3axcyiBZde7G6dabliUosJvvKOPcKIWPccCgefSj_GNfwIip3-SsFdlR7BtbVUcqR-yv-XOxJ3UcMI0tz3uMiiZcyPV7sNCU4KRnemRIMHVOfuvHsU60_GhGbiSFzgPTAa9WTltbnarTbxudb_YEOx12JiwYToeX0DCPb43W1tzIBxgm8NxUg
      
      # The following requests all return 200.
      curl -I http://${GATEWAY_ADDRESS}/productpage -H "Authorization: Bearer $TOKEN"
      curl -I http://${GATEWAY_ADDRESS}/api/v1/products/1 -H "Authorization: Bearer $TOKEN"
      curl -I http://${GATEWAY_ADDRESS}/static/jquery.min.js -H "Authorization: Bearer $TOKEN"

      According to the configuration rules, requests for paths starting with /api or /static must carry a valid JWT to succeed. Requests for the /productpage path do not require a JWT. The results are consistent with the comments in the code and confirm that the JWT authentication configuration is effective.

   2. Modify the JWT authentication configuration rules.

      1. On the ASMSecurityPolicy page, find the target JWT authentication security policy and click edit in the Operator column.

      2. In the JWT Config wizard, click Next.

      3. On the Workload and Match Rules page, find the target workload group and click edit in the Operator column.

      4. In the New Workload Group dialog box, modify the parameters, click OK, and then click Submit.

         The following table describes the example configurations.

         Parameter	Description
         Match Mode	Select Bypass Auth If Matched.
         Matching Rules	Remove the /api/* matching rule and keep only the /static/* matching rule.

   3. Run the following commands to verify that the modified JWT authentication configuration is effective.

      curl -I http://${GATEWAY_ADDRESS}/productpage  # Returns 403.
      curl -I http://${GATEWAY_ADDRESS}/api/v1/products/1  # Returns 403.
      curl -I http://${GATEWAY_ADDRESS}/static/jquery.min.js   # Returns 200.
      
      # Set the JWT.
      TOKEN=eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjQ2ODU5ODk3MDAsImZvbyI6ImJhciIsImlhdCI6MTUzMjM4OTcwMCwiaXNzIjoidGVzdGluZ0BzZWN1cmUuaXN0aW8uaW8iLCJzdWIiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyJ9.CfNnxWP2tcnR9q0vxyxweaF3ovQYHYZl82hAUsn21bwQd9zP7c-LS9qd_vpdLG4Tn1A15NxfCjp5f7QNBUo-KC9PJqYpgGbaXhaGx7bEdFWjcwv3nZzvc7M__ZpaCERdwU7igUmJqYGBYQ51vr2njU9ZimyKkfDe3axcyiBZde7G6dabliUosJvvKOPcKIWPccCgefSj_GNfwIip3-SsFdlR7BtbVUcqR-yv-XOxJ3UcMI0tz3uMiiZcyPV7sNCU4KRnemRIMHVOfuvHsU60_GhGbiSFzgPTAa9WTltbnarTbxudb_YEOx12JiwYToeX0DCPb43W1tzIBxgm8NxUg
      
      # The following requests all return 200.
      curl -I http://${GATEWAY_ADDRESS}/productpage -H "Authorization: Bearer $TOKEN"
      curl -I http://${GATEWAY_ADDRESS}/api/v1/products/1 -H "Authorization: Bearer $TOKEN"
      curl -I http://${GATEWAY_ADDRESS}/static/jquery.min.js -H "Authorization: Bearer $TOKEN"

      According to the modified configuration rules, requests for paths starting with /static can succeed without a JWT or with a valid one. All other requests must carry a valid JWT to succeed. The results are consistent with the comments in the code and confirm that the modified JWT authentication configuration is effective.

Related documents

• For more information about the concepts and features of ASMSecurityPolicy, see Overview of ASMSecurityPolicy.

• You can enable the mesh audit feature to track user operations. You can also configure audit alerts for resource operations to promptly notify contacts about changes to important resources. For more information, see Use KubeAPI operation audit and Configure audit alerts for mesh resource operations.