Istio policy to deny expired JWT access tokens

user_5755313 0
Viewed 333

How can I define an Istio policy for my service to deny any request with a JWT access token that is expired?

For context, I have a Spring Boot KNative service with RequestAuthentication config that has checks for the token issuer.

istio
1 Answers

Istio does that by default. Any JWT token that is expired, or otherwise invalid is denied by default.

However, for JWT token authorization to work, authorization policy must be configured.
Source for the below examples

  1. Create AuthorizationPolicy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  action: ALLOW
  rules:
  - from:
    - source:
       requestPrincipals: ["testing@secure.istio.io/testing@secure.istio.io"]
  1. Get the valid JWT token
TOKEN=$(curl https://raw.githubusercontent.com/istio/istio/release-1.11/security/tools/jwt/samples/demo.jwt -s) && echo "$TOKEN" | cut -d '.' -f2 - | base64 --decode -
  1. Verify that the request with valid token is allowed
kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- curl "http://httpbin.foo:8000/headers" -sS -o /dev/null -H "Authorization: Bearer $TOKEN" -w "%{http_code}\n"

Adjust the above examples to your needs

If, for some reason, Istio does allow expired or otherwise invalid tokens, you should check your previously applied policies, to make sure nothing overrides default behaviour.

user_156593470
Related