Inbound JWT authentication practices - Server Load Balancer

ALB Extensible Edition validates inbound JSON Web Token (JWT) before forwarding requests to backend AI services, rejecting unauthorized access.

Solution architecture

The ALB Extensible Edition instance receives client requests and matches them to forwarding rules based on HTTP headers. A JWT authentication component, associated with a forwarding rule through a service extension, extracts the JWT from the request header and validates it against a public key from a remote JSON Web Key Set (JWKS) server. Valid requests are forwarded to the backend AI service; invalid or missing tokens trigger a 401 response.

ALB Extensible Edition instance: Provides load balancing and traffic forwarding.
AI Service-type server group: Connects to backend LLM services.
HTTPS listener: Receives client requests.
Forwarding rule: Matches and forwards requests based on HTTP header conditions.
Service extension: Implements inbound authentication and forwarding control through the JWT authentication component.
JWKS server: In this example, an Nginx server is used to simulate a JWKS server and provide public key information.

Prerequisites

You have access to ALB Extensible Edition public preview.
You have created a virtual private cloud (VPC) in the China (Ulanqab) region with vSwitch VSW1 in Zone A and vSwitch VSW2 in Zone B. Both vSwitches must have Internet SNAT enabled so the AI Service-type server group can call public LLM APIs.
You have created an Elastic Compute Service (ECS) instance running Alibaba Cloud Linux 3.2104 in VSW1 or VSW2. The security group must allow traffic from the CIDR blocks of both vSwitches.
You have activated Alibaba Cloud Model Studio, obtained an API key, and added the API key as an identity credential in Identity Management.
You have registered a custom domain name. This topic deploys the ALB instance in the China (Ulanqab) region. Therefore, an ICP filing is required for the domain name.
You have a server certificate matching your custom domain name. Non-Alibaba Cloud certificates must be uploaded to Alibaba Cloud Certificate Management Service.

Procedure

1. Create an ALB Extensible Edition instance

Log on to the ALB console, select the China (Ulanqab) region, and click Create ALB.
On the buy page, configure the following settings and click Create Now.
- For Region, select China (Ulanqab).
- For Network Type, select Internet.
- VPC and Zone: Select the target VPC, check Ulanqab Zone A and Ulanqab Zone B, select the corresponding vSwitches, and select Automatically assign EIP.
- IP Version: Select IPv4.
- Edition: Select Extensible.
On the Confirm Order page, review your configuration and click Activate Now.

2. Create an AI Service-type server group

Create an AI Service-type server group to connect to Alibaba Cloud Model Studio.

On the Server Groups page, click Create Server Group, set Server Group Type to AI Service, enter a name such as sgp-ai-qwen, then click Create.
Click Add Backend Server in the The server group is created dialog box.
In the Add AI Service panel, configure the following and click OK.
- For Model provider, select Alibaba Cloud Model Studio.
- Endpoint: This field is automatically populated after you select a Model provider.
- Identity Credential: Select the identity credential that you created for the Alibaba Cloud Model Studio API key.

3. Create a listener

In the ALB console, click the target instance ID to open the Instance Details page. On the Listener tab, click Create Listener.
In the Configure Listener step, set Listener Protocol to HTTPS and Listener Port to 443. Then, click Next.
In the Configure SSL Certificate step, select the server certificate that matches your custom domain name and click Next.
In the Select Server Group step, select the AI Service type and the sgp-ai-qwen server group, then click Next.

The selected server group serves as the listener's default, handling requests that don't match other forwarding rules. You can modify it as needed.
In the Configuration Review step, confirm your settings and click Submit.

4. Deploy the JWKS server

Deploy Nginx on your ECS instance to simulate a JWKS server. Ensure the ALB instance can reach the JWKS server over the VPC network.

4.1 Generate a JWT key pair and token

Use a Python script to generate a compliant public key JSON file and a test JWT.

Log on to your ECS instance. Alibaba Cloud Linux includes Python 3 by default. Install the jwcrypto library:
```
sudo pip3 install --upgrade pip
sudo pip3 install jwcrypto
```

Create the generation script generate_jwt_jwks.py.

sudo vim generate_jwt_jwks.py

Copy the following code into the file:

import json
import time
import sys

# Check dependencies
try:
    from jwcrypto import jwk, jwt
except ImportError:
    print("Error: Library 'jwcrypto' is not installed.")
    print("Please run: pip3 install jwcrypto")
    sys.exit(1)

def main():
    print(">>> Start generating JWKS and JWT...\n")

    # --- Configuration ---
    KEY_ID = "aliyun-test-kid"            # Key ID
    ISSUER = "http://your-nginx-server-ip" # Replace with actual Nginx IP or domain, or keep default
    SUBJECT = "test-user-001"             # Test user identifier
    
    # --- 1. Generate RSA key pair (2048-bit) ---
    # Use RS256 algorithm
    key = jwk.JWK.generate(kty='RSA', size=2048, alg='RS256', use='sig', kid=KEY_ID)
    
    # --- 2. Export public key and save as jwks.json ---
    # Nginx reads this file to verify tokens
    public_key = key.export_public(as_dict=True)
    jwks_data = {
        "keys": [public_key]
    }

    jwks_filename = "jwks.json"
    with open(jwks_filename, "w") as f:
        json.dump(jwks_data, f, indent=4)
        
    print(f"[Success] JWKS file created: ./{jwks_filename}")
    print(f"       Next step: Move this file to the Nginx directory.")

    # --- 3. Generate signed JWT (using private key) ---
    claims = {
        "sub": SUBJECT,
        "iss": ISSUER,
        "name": "Aliyun Doc User",
        "role": "admin",
        "iat": int(time.time()),            
        # Set expiration to 100 years to avoid token expiry during testing
        "exp": int(time.time()) + 3600 * 24 * 365 * 100 
    }

    # Create and sign token
    token = jwt.JWT(
        header={"alg": "RS256", "kid": KEY_ID, "typ": "JWT"},
        claims=claims
    )
    token.make_signed_token(key)
    
    print("\n[Success] Test JWT generated (valid for 100 years):")
    print("-" * 60)
    print(token.serialize())
    print("-" * 60)
    print("Action: Use this token for API request testing.")

if __name__ == "__main__":
    main()

Run the script to generate the files:
```
sudo python3 generate_jwt_jwks.py
```
Record the generated token (the string starting with eyJ…). You will use it in the verification steps.

4.2 Install and configure Nginx

Install Nginx on your ECS instance and configure it to serve the jwks.json file generated in the previous step.

Install Nginx:

sudo yum install -y nginx
sudo systemctl start nginx
sudo systemctl enable nginx

Prepare the directory and move the JWKS file:

# Create directory
sudo mkdir -p /usr/share/nginx/html/auth

# Move jwks.json
sudo cp jwks.json /usr/share/nginx/html/auth/jwks.json

# Set read permissions
sudo chmod 644 /usr/share/nginx/html/auth/jwks.json

Create the jwks.conf file in /etc/nginx/default.d/:

sudo vim /etc/nginx/default.d/jwks.conf

Add the following configuration:

location /auth/v1 {
    # Disable caching to ensure clients always get the latest public key
    add_header Cache-Control "no-store, no-cache, must-revalidate";
    
    # Set appropriate response type
    default_type application/json;
    
    # Use alias to point directly to the file
    alias /usr/share/nginx/html/auth/jwks.json;
}

Verify and reload the Nginx configuration:
```
sudo nginx -t
sudo systemctl reload nginx
```
Test the JWKS server:
```
curl http://localhost:port/auth/v1
```
The response should contain RSA public key data (alg: RS256), confirming the JWKS service is deployed.
Record the private IP address of the ECS instance for use in the service extension configuration.

5. Create a service extension

Create a service extension with a JWT authentication component. Configure the remote JWKS server address and JWT extraction method.

In the Service Extensions page, click Create Service Extension. In the Service Extension Configuration section, enter an Extension name, such as jwt-auth-extension.
The Extension Type is set to Plug-in by default. Select JWT Authentication from the Component name drop-down list, configure the required parameters, then click Create.
- Remote Service: Enter the JWKS server URL in the http://<ECS private IP>:<port>/auth/v1 format. For example: http://172.16.11.132:80/auth/v1.
- Cache Time: Duration the JWKS public key is cached. Keep the default of 300 seconds.
- JWKS Token Configuration:
  - For Type, select By HTTP Header.
  - Key: The default value is Authorization.
  - Value Prefix: You can keep the default value Bearer.
- Timeout and Processing policy: Use the defaults (1000 and Terminate). Adjust as needed.

6. Configure forwarding rules

Create a forwarding rule for the listener with an HTTP header condition and associate the service extension.

In the ALB console, click the target instance ID to go to the Instance Details page. Click the Listener tab, click the target listener ID to go to the Listener Details page, then click the Forwarding Rules tab.
Click Add New Rule, configure the following settings, and click OK.
- Add Condition: Select HTTP Header, set Key to k, and Value to v.
  
  k: v is used as an example. In a production environment, you can configure your own HTTP header key-value pairs or use other forwarding conditions as needed.
- Service Extension (Optional): The default option is Use Existing Service Extension. From the drop-down list, select jwt-auth-extension.
- Action: Forward to the AI Service-type server group sgp-ai-qwen.

After the rule is created, requests containing header k: v trigger the service extension. It extracts the JWT from the Authorization header, validates it against the JWKS server public key, and forwards valid requests to the sgp-ai-qwen server group.

7. Configure DNS resolution

Add a CNAME record to map your custom domain name to the ALB instance's DNS name, enabling client access through your domain.

This example uses Alibaba Cloud DNS. If your domain is not registered with Alibaba Cloud, first add the domain name to Alibaba Cloud DNS.

In the ALB console, copy the target instance's Domain Name.
Log on to the Alibaba Cloud DNS console. Find the domain that you want to manage and click Settings in the Actions column. On the Settings page, click Add Record.
Add a CNAME record with the following information and click OK.
- For Record Type, select CNAME.
- Hostname: Enter a prefix such as ai. If your root domain is example.com, the ALB access domain becomes ai.example.com.
- Keep the default values for Query Source and TTL.
- Record Value: Enter the DNS name of the ALB instance.
In the Change Resource Record Confirmation dialog box, confirm the settings and click OK.

8. Verify the configuration

Send requests with curl to verify JWT authentication. Requests must meet these conditions:

Include the header k: v to match the forwarding rule associated with the service extension.
Follow the OpenAI-compatible protocol: use paths /v1/completions, /v1/chat/completions, or /v1/embeddings, with a compliant request body.

In the following commands, ai.example.com is a placeholder. Replace it with your domain from Step 7. Ensure domain name resolution is active.

Request with a valid JWT token

The request includes the Authorization: Bearer <token> header, where <token> is the JWT generated in Step 4.1.

# Replace <Token string> below with the actual token from Step 4.1 script output
token="<Token string>"

curl -v \
    -H "k: v" \
    -H "Authorization: Bearer $token" \
    -H "Content-Type: application/json" \
    -d '{
        "model": "qwen-turbo",
        "messages": [
            {
                "role": "user", 
                "content": "Who are you"
            }
        ]
    }' \
    https://ai.example.com/v1/chat/completions

A successful request returns HTTP 200 and the AI service response:

{
    "choices": [
        {
            "finish_reason": "stop",
            "index": 0,
            "message": {
                "content": "I am Qwen, a large language model independently developed by Tongyi Lab under Alibaba Group. I can answer questions, create text, perform logical reasoning, programming, and more. Feel free to ask me anything, and I will do my best to help.",
                "role": "assistant"
            }
        }
    ],
    "created": 1767613123,
    "id": "chatcmpl-01fb9300-df1d-98d1-9f5d-874fddebf13f",
    "model": "qwen-turbo",
    "object": "chat.completion",
    "usage": {
        "completion_tokens": 47,
        "prompt_tokens": 14,
        "prompt_tokens_details": {
            "cached_tokens": 0
        },
        "total_tokens": 61
    }
}

Request with an invalid JWT token or without a JWT token

Request with an invalid JWT token

The request includes the Authorization: Bearer <token> header, but <token> is not a valid JWT.

token="wrong-jwt-token"

curl -v \
    -H "k: v" \
    -H "Authorization: Bearer $token" \
    -H "Content-Type: application/json" \
    -d '{
        "model": "qwen-turbo",
        "messages": [
            {
                "role": "user", 
                "content": "Who are you"
            }
        ]
    }' \
    https://ai.example.com/v1/chat/completions

A failed request returns HTTP 401 with an authentication failure response:

HTTP response headers:

HTTP/2 401 
www-authenticate: Bearer realm="https://ai.example.com/v1/chat/completions", error="invalid_token"
content-length: 79
content-type: text/plain
vary: Accept-Encoding
date: Wed, 21 Jan 2026 06:57:46 GMT

HTTP response body (example):

Jwt verification fails

Request without a JWT token

The request does not include the Authorization: Bearer <token> header.

curl -v \
    -H "k: v" \
    -H "Content-Type: application/json" \
    -d '{
        "model": "qwen-turbo",
        "messages": [
            {
                "role": "user", 
                "content": "Who are you"
            }
        ]
    }' \
    https://ai.example.com/v1/chat/completions

A failed request returns HTTP 401 indicating the JWT is missing: