JWT extauth plugin with exp: true always returning access_denied, JWT is invalid

[kaywindcosta]

Apigee microgateway in cloud foundry always returning the invalid JWT message even for valid JWT with the JWT expire setting exp: true .

{

    "error": "access_denied",

    "error_description": "JWT is invalid"

}

This is my extauth plugin configuration in application.yml 

plugins:

    sequence:      

      - healthcheck

      - cloud-foundry-route-service

      - extauth

.....

.....

extauth:

  level: debug  

  publickey_url: 'https://publickeyurl.net/contextroot/allJwks.json' 

  client_id: 'client_id'

  iss: 'iss'

  sendErr: true

  keepAuthHeader: false

  exp: true

Any resolution for this?

[dchiesa1 · Accepted solution]

Can you explain what is in the token? The properties specifically? (obscure private values)

What specifically is the iss value you placed into configuration? Are you using 'iss' for that setting? This is not correct. It may be confusing, but the iss property accepts the value that the iss property in the token must carry. From this link:

It's a little confusing because it's inconsistent: while the client_id property in configuration defines the NAME of the property within the JWT that holds the client id, the iss property in configuration should hold the VALUE of the iss property in the JWT. If you use 'iss' it will (probably) always fail.

If this isn't the problem, can you perform some other experiments and report back the results? You said it happens only with exp:true. Can you confirm that? Are you saying the plugin does not reject the JWT if exp:false, or if exp is not present? what happens if you remove or alter the other properties in configuration of the extauth plugin? Can you try some combinations and report your results? What happens if you omit the client_id property? etc.

If THAT doesn't satisfy, you can run the microgateway with DEBUG=plugin:extauth to get some debug statements out of the plugin. That might help you diagnose.

[dchiesa1 · Accepted solution]

Can you explain what is in the token? The properties specifically? (obscure private values)

What specifically is the iss value you placed into configuration? Are you using 'iss' for that setting? This is not correct. It may be confusing, but the iss property accepts the value that the iss property in the token must carry. From this link:

It's a little confusing because it's inconsistent: while the client_id property in configuration defines the NAME of the property within the JWT that holds the client id, the iss property in configuration should hold the VALUE of the iss property in the JWT. If you use 'iss' it will (probably) always fail.

If this isn't the problem, can you perform some other experiments and report back the results? You said it happens only with exp:true. Can you confirm that? Are you saying the plugin does not reject the JWT if exp:false, or if exp is not present? what happens if you remove or alter the other properties in configuration of the extauth plugin? Can you try some combinations and report your results? What happens if you omit the client_id property? etc.

If THAT doesn't satisfy, you can run the microgateway with DEBUG=plugin:extauth to get some debug statements out of the plugin. That might help you diagnose.

[kaywindcosta · Accepted solution]

iss: "This should be the same issuer that is included in the JWT."

This resolved my issue