About

Requirements

Installation

composer require php-istio/jwt-authentication-bundle

Configuration

# config/packages/security.yamlsecurity:enable_authenticator_manager:true# ...

security:enable_authenticator_manager:trueaccess_control:     -path:^/roles:IS_AUTHENTICATED_FULLYfirewalls:#...main:stateless:trueistio_jwt_authenticator:rules:          -issuer:issuer_1# Requireduser_identifier_claim:sub#Default is `sub` claimorigin_token_headers:[authorization]#Required at least once of `origin_token_headers`, `origin_token_query_params` or `base64_headers`. Use this option when your Istio JWTRule CRD using `forwardOriginalToken`.origin_token_query_params:[token]#Use this option when your Istio JWTRule CRD using `forwardOriginalToken` and your JWT token in query param.base64_headers:[x-istio-jwt-payload]# Use this option when your Istio JWTRule CRD using `outputPayloadToHeader`.prefix:"Bearer"#Token prefix of origin token passthrough by default blank ("") if not set.

#....main:stateless:trueistio_jwt_authenticator:rules:          -issuer:issuer_1origin_token_headers:[authorization]prefix:"Bearer"          -issuer:issuer_2user_identifier_claim:audbase64_headers:[x-istio-jwt-payload]#....

Usage

#!/bin/bash#Generate mock JWT token forwarded by Istio sidecarpayload='{"issuer":"issuer_1", "sub": "test"}';base64_payload=$(echo -n$payload| base64 -);origin_token=$(echo"header.$base64_payload.signature");#You can test authenticate origin token with curl:curl -H"Authorization: Bearer$origin_token" http://localhost/#Or authenticate base64 payload header:curl -H"X-Istio-JWT-Payload:$base64_payload" http://localhost/

Further readings

Credits