Question. RBAC on jwt token

[weilip1803]

It is known that istio employs RBAC through ServiceRole and ServiceRoleBindings. Can the RBAC filter do something similar to that? Will love an example

[cstrahan]

Yes, this is something that we needed. Here's an example:

http_filters:
  - name: envoy.filters.http.jwt_authn
    config:
      providers:
        default_provider:
          payload_in_metadata: "payload"
          issuer: https://example.com
          local_jwks:
            # JWKS goes here (truncated for readability)
            inline_string: |
              { "keys": [ … ] }
      rules:
        - match:
            prefix: "/"
          requires:
            provider_name: "default_provider"

  - name: envoy.filters.http.rbac
    config:
      rules:
        action: ALLOW
        policies:
          "any":
            principals:
              - any: true
            permissions:
              - not_rule:
                  header: { name: ":path", regex_match: "/admin(/.*)?" }
          "admin":
            principals:
              - metadata:
                  filter: envoy.filters.http.jwt_authn
                  path:
                    - key: payload
                    - key: role
                  value:
                    string_match:
                      exact: admin
            permissions:
              - any: true

  - name: envoy.router
    config: {}

These are the docs you'll want to review:

• https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/rbac_filter
• https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/jwt_authn_filter
• https://www.envoyproxy.io/docs/envoy/latest/configuration/well_known_dynamic_metadata

This comment describes how payload_in_metadata works:

envoy/api/envoy/config/filter/http/jwt_authn/v2alpha/config.proto

Lines 170 to 186 in cb15cc3

	// If non empty, successfully verified JWT payloads will be written to StreamInfo DynamicMetadata
	// in the format as: *namespace* is the jwt_authn filter name as **envoy.filters.http.jwt_authn**
	// The value is the *protobuf::Struct*. The value of this field will be the key for its *fields*
	// and the value is the *protobuf::Struct* converted from JWT JSON payload.
	//
	// For example, if payload_in_metadata is *my_payload*:
	//
	// .. code-block:: yaml
	//
	// envoy.filters.http.jwt_authn:
	// my_payload:
	// iss: https://example.com
	// sub: test@example.com
	// aud: https://example.com
	// exp: 1501281058
	//
	string payload_in_metadata = 9;

FWIW, this is the PR that introduced the metadata for the jwt_authn filter: #4707

Lemme know if you have any trouble.

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically closed because it has not had activity in the last 37 days. If this issue is still valid, please ping a maintainer and ask them to label it as "help wanted". Thank you for your contributions.