Alibaba Cloud Service Mesh:Configure JWT authentication on an ASM gateway

Background

JSON Web Token (JWT) is a common mechanism for authentication and authorization. A JWT contains user information and a field that stores encrypted information. You can decrypt the encrypted field and compare it with the original user information to verify the user's identity. For more information, see JWT.

Procedure

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.

3. On the Ingress Gateway page, click the name of the target gateway.

4. In the navigation pane of the gateway overview page, choose Gateway Security > JWT Authentication.

5. In the JWT Authentication Configuration wizard, turn on the Enable Gateway JWT Authentication switch, configure the parameters, and then click Next.

   Parameter	Description
   Issuer	The issuer of the JWT. In this example, this parameter is set to testing@secure.istio.io.
   JWKS Source	Select jwks.
   Key	Example: { "keys":[ {"e":"AQAB","kid":"DHFbpoIUqrY8t2zpA2qXfCmr5VO5ZEr4RzHU_-envvQ","kty":"RSA","n":"xAE7eB6qugXyCAG3yhh7pkDkT65pHymX-P7KfIupjf59vsdo91bSP9C8H07pSAGQO1MV_xFj9VswgsCg4R6otmg5PV2He95lZdHtOcU5DXIg_pbhLdKXbi66GlVeK6ABZOUW3WYtnNHD-91gVuoeJT_DwtGGcp4ignkgXfkiEm4sw-4sfb4qdt5oLbyVpmW6x9cfa7vs2WTfURiCrBoUqgBo_-4WTiULmmHSGZHOjzwa8WtrtOQGsAFjIbno85jp6MnGGGZPYZbDAa_b3y5u-YpW7ypZrvD8BgtKVjgtQgZhLAGezMt0ua3DRrWnKqTZ0BJ_EyxOGuHJrLsn00fnMQ"}]}
   Advanced options	Click Advanced options. In the Advanced JWT Rule Options dialog box, you can customize the token location, specify whether to forward the JWT, and specify whether to forward the payload of the JWT in the request header. When you are finished, click OK.

6. In the Matching Rules wizard, configure the parameters and click Submit.

   Parameter	Description
   Match Mode	In this example, Selected requests must be authenticated is selected. Valid values: Selected requests must be authenticated: The selected requests must pass JWT authentication. Selected requests can skip authentication: Skips JWT authentication for selected requests.
   Matching Rules	Select Custom Matching Rules, turn on the HTTP Path switch, and set Path to /productpage. This configuration requires that requests to the /productpage path pass JWT authentication. Requests for other paths can skip this authentication. Note For other requests, requests without a JWT are successful, but requests with an invalid JWT fail.

   After the authentication rule is created, the Finish step of the wizard displays the message Gateway JWT authentication is created and lists the native security resources of Service Mesh. You can click View YAML to view the detailed configuration of the resources.

7. Verify that JWT authentication is working.

   1. Set the environment variable by running the following command.

      TOKEN=eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjQ2ODU5ODk3MDAsImZvbyI6ImJhciIsImlhdCI6MTUzMjM4OTcwMCwiaXNzIjoidGVzdGluZ0BzZWN1cmUuaXN0aW8uaW8iLCJzdWIiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyJ9.CfNnxWP2tcnR9q0vxyxweaF3ovQYHYZl82hAUsn21bwQd9zP7c-LS9qd_vpdLG4Tn1A15NxfCjp5f7QNBUo-KC9PJqYpgGbaXhaGx7bEdFWjcwv3nZzvc7M__ZpaCERdwU7igUmJqYGBYQ51vr2njU9ZimyKkfDe3axcyiBZde7G6dabliUosJvvKOPcKIWPccCgefSj_GNfwIip3-SsFdlR7BtbVUcqR-yv-XOxJ3UcMI0tz3uMiiZcyPV7sNCU4KRnemRIMHVOfuvHsU60_GhGbiSFzgPTAa9WTltbnarTbxudb_YEOx12JiwYToeX0DCPb43W1tzIBxgm8NxUg

   2. Test access by running the following commands.

      • Test 1: Access the /productpage path with a valid JWT.

        curl -I http://${ASM_GATEWAY_IP}/productpage -H "Authorization: Bearer $TOKEN"

        Sample output:

        HTTP/1.1 200 OK
        content-type: text/html; charset=utf-8
        content-length: 4294
        server: istio-envoy
        date: Tue, 17 Jan 2023 08:47:34 GMT
        x-envoy-upstream-service-time: 17

      • Test 2: Access the /productpage path without a JWT.

        curl -I http://${ASM_GATEWAY_IP}/productpage

        Sample output:

        HTTP/1.1 403 Forbidden
        content-length: 19
        content-type: text/plain
        date: Tue, 17 Jan 2023 08:50:31 GMT
        server: istio-envoy

      • Test 3: Access the /productpage path with an invalid JWT.

        curl -I http://${ASM_GATEWAY_IP}/productpage -H "Authorization: Bearer invalid token"

        Sample output:

        HTTP/1.1 401 Unauthorized
        www-authenticate: Bearer realm="http://114.55.XXX.XXX/productpage", error="invalid_token"
        content-length: 79
        content-type: text/plain
        date: Tue, 17 Jan 2023 08:51:47 GMT
        server: istio-envoy

      • Test 4: Access another path without a JWT.

        curl -I http://${ASM_GATEWAY_IP}/api/v1/products/1   

        HTTP/1.1 200 OK
        content-type: application/json
        content-length: 195
        server: istio-envoy
        date: Tue, 17 Jan 2023 08:55:10 GMT
        x-envoy-upstream-service-time: 16

      The outputs confirm that JWT authentication is working as expected.

      Type	Result
      Accessing the /productpage path with a valid JWT	Yes
      Accessing the /productpage path without a JWT	No
      Accessing the /productpage path with an invalid JWT	No
      Accessing another path without a JWT	Yes

Related topics

• You can customize the content of ASM gateway access logs to promptly detect potential security issues. For more information, see Generate and collect ASM gateway access logs.

• You can use the mesh audit feature to record and trace daily user operations. You can also configure audit alerts to notify specified contacts when important resources are modified. For more information, see Use KubeAPI operation audit and Configure audit alerts for mesh resource operations.

• You can configure JWT request authorization on an ingress gateway to require requests to carry a JWT for service access. For more information, see Perform JWT request authorization for an ingress gateway in ASM.