What is a JWT Issuer?

user_299180 0
Viewed 4139

From this page: https://www.pingidentity.com/en/company/blog/posts/2019/jwt-security-nobody-talks-about.html:

The fourth security-relevant reserved claim is "iss." This claim indicates the identity > of the party that issued the JWT. The claim holds a simple string, of which the value is > at the discretion of the issuer. The consumer of a JWT should always check that the > "iss" claim matches the expected issuer (e.g., sso.example.com).

As an example, in Kubernetes when I configure the kubernetes auth like this for using a JWT for a vault service account (from helm), I no longer get an ISS error when accessing the vault:

vault write auth/kubernetes/config \
      token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
      kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
      kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
      issuer="https://kubernetes.default.svc.cluster.local"

But what does this URL mean? Is it a somewhat arbitrary string that was set when the JWT was generated?

hashicorp-vault jwt kubernetes
1 Answers

JWT token issuer - is the party that "created" the token and signed it with its private key.

Anyone can create tokens, make sure that the tokens you receive is created by a party that you trust.

user_2132690
Related