Is it possible to validate Auth0 JWTs with Kong without assigning to users

userJVvw 0
Viewed 38

I have an authentication flow with auth0 that exists outside of a declaratively configured Kong Gateway setup but still want to validate tokens at the edge. It's expected that calling users will always pass an authorization header with a bearer token that they've received from a login endpoint that calls an internal auth service.

After reading the Kong docs it seems like you need to assign the pubkey/JWK to a consumer which I don't quite understand. I don't want to manage users through Kong. I have seen mention of consumer being able to be an "anonymous" user which may be a blanket way to apply this, but I'm unsure of how to configure this declaratively.

Is this possible without writing custom middleware?

kong auth0 jwt
2 Answers

I believe you can use the Kong JWT Signer plugin to validate your bearer token with the JWK server, even without a consumer, by leaving access_token_consumer blank in the configuration and using other claims to verify the JWT token.

By following this instruction, you should be able to understand the inner working of the plugin and figure it out from there.

Ponsakorn302140

The cleanest way to do this is with Plus/Enterprise Kong and using their OpenID Connect plugin. I want to keep this limited to their open source Kong deployed in a single container with declarative configuration, however. I've managed to figure out how to accomplish this as such.

You can create a consumer with any username and the jwt_secrets field are applied to the plugin somehow. I have no idea how or why. Here is an example kong.yaml:

_format_version: "2.1"
services:
 - name: mock-grpc-service-foo
   host: host.docker.internal
   port: 4770
   protocol: grpc
   routes:
   - name: foo-routes
     protocols:
     - http
     paths:
     - /hello
     plugins:
     - name: grpc-gateway
       config:
        proto: proto/foo.proto

consumers:
- username: anonymous # this can be anything
  jwt_secrets:
  - algorithm: RS256
    key: https://company_name_here.auth0.com/
    rsa_public_key: |
      -----BEGIN PUBLIC KEY-----
      ... pub key here ...
      -----END PUBLIC KEY-----
    secret: this-does-not-seem-to-matter

plugins:
- name: jwt
  service: mock-grpc-service-foo

You can derive your public key from your Auth0 JWK like so:

curl https://COMPANYNAME.auth0.com/pem > COMPANYNAME.pem

then

openssl x509 -pubkey -noout -in COMPANYNAME.pem > pubkey.pem

I'm doing this with REST->gRPC mappings, but you can do the same with regular regular routing. You can apply this plugin globally, to services or routes.

Declaratively configuring this opens up a whole new can of worms as you need to do templating with an entry script in order to inject the correct pub key for each environment this is deployed in provided you have different Auth0 tenants, but this gets you a lot of the way there.

userJVvw0
Related