JWT authentication component - Server Load Balancer - Alibaba Cloud Documentation Center

The JWT authentication component authenticates and authorizes requests based on JSON Web Tokens (JWT). It extracts JWTs from HTTP request URL parameters, headers, or cookies, and verifies whether the token is authorized to access the resource.

Feature category

Authentication and authorization

Field descriptions

ComponentConfig

Parameter	Type	Required	Default	Description
Config	JwtSpec	Yes	-	JWT authentication configuration.

JwtSpec

Parameter	Type	Required	Default	Description
JwkConfig	JwkConfigSpec	Yes	-	How to configure JWK.
JwtSources	JwtSourcesSpec	Yes	-	How to extract the JWT. Only a single extraction source is supported.

JwkConfigSpec

Parameter	Type	Required	Default	Description
Type	JwkConfigType	No	-	JWK configuration type.
RemoteJwks	RemoteJwksSpec	No	-	Remote JWKS configuration.

JwkConfigType

Value	Description
Remote	Retrieve JWK from a remote endpoint.

RemoteJwksSpec

Parameter	Type	Required	Default	Description
Url	URI	No	-	Remote JWK address.

URI

The fully qualified domain name (FQDN) that includes the protocol, hostname, and path. The Application Load Balancer (ALB) instance accesses this address through the IP address of its vSwitch. Ensure that the target address is reachable. If the target address is on the Internet, configure a public SNAT for the vSwitch where the ALB instance is located.

Example

http://example.com/jwt/pubkeys

The remote JWK response must comply with RFC 7518. Example response:

{
    "keys": [
        {
            "e": "Exponent of the public key, such as AQAB",
            "kid": "Key ID",
            "kty": "Family of the encryption algorithm, such as RSA. Required and case-sensitive",
            "alg": "Specific encryption algorithm used, such as RS256. Required and case-sensitive",
            "use": "Intended use of the key, such as sig for signing",
            "n": "Modulus of the public key"
        },
        {
            "kty": "oct",
            "k": "yMsZ3vkBL4fEwJrNOPW6RztnYpdQ0UlVTum7H1qAehD",
            "alg": "HS256"
        }
    ]
}

JwtSourcesSpec

Parameter	Type	Required	Default	Description
Headers	JwtHeaderSpec[]	No	-	Extract the JWT from the HTTP request header.
Params	String[]	No	-	Extract the JWT from the URL parameter.
Cookies	String[]	No	-	Extract the JWT from the cookie.

JwtHeaderSpec

Parameter	Type	Required	Default	Description
Name	String	Yes	Authorization	Field name in the request header.
ValuePrefix	String	No	Bearer	Prefix of the corresponding header value. The prefix is removed before the token is extracted.

Error codes

HTTP status code	Error message	Description
401	Jwt is missing	The request does not provide a JWT.
401	Jwks remote fetch is failed	The remote JWKS address request timed out.
401	Jwt verification fails	JWT payload verification failed.
401	Jwt is expired	The token provided in the request has expired.
401	Jwt signature is an invalid Base64url encoded	The token provided in the request cannot be Base64-decoded.