A silenced error for JWT Stateless Authentication during token validation

[InterStella0]

Context

I'm using Keycloak to implement SSO with Django, and I found this library. I used JWTStatelessUserAuthentication for my default authentication class as stated in the docs. However, i was having trouble with the validation process when the frontend passed in the JWT token to django on a protected endpoint. It keeps giving me 401 Unauthorized with the message "Token is invalid or expired". The message was quite vague as i couldn't debug the code as there is no logging output other than the Unauthorized response.

Issue

With Keycloak, you would get the JWK via https://xxx/realms/xxx/protocol/openid-connect/certs endpoint. What I found was that it was raising a Forbidden error from PyJWKClient when it does PyJWKClient.fetch_data(), I couldn't see this error due to the generic error raised by this try-except.

For more detail, Keycloak rejects (gives Forbidden) on GET requests that does not have a user-agent header, which PyJWKClient does not by default.

Current solution

To solve my issue i had to override Token and patch the token_backend

Code

from rest_framework_simplejwt.tokens import AccessToken
class KeycloakAccessToken(AccessToken):
    token_type = "Bearer"  # token_type is not stated within payload, but `typ` exist
    def get_token_backend(self) -> "TokenBackend":
        backend = super().get_token_backend()
        backend.jwks_client.headers = {"User-Agent": "Keycloak-python-urllib"}
        return backend

settings.py

SIMPLE_JWT = {
    "ALGORITHM": "RS256",
    "ISSUER": KEYCLOAK_ISSUER,
    "JWK_URL": JWKS_URL,
    "SIGNING_KEY": None,
    "VERIFYING_KEY": None,
    "USER_ID_CLAIM": "sub",
    "TOKEN_TYPE_CLAIM": "typ",
    "LEEWAY": 5,
    "AUTH_HEADER_TYPES": ("Bearer",),
    "AUTH_TOKEN_CLASSES": ("search.token.KeycloakAccessToken",),
}

Discussion

It would be helpful if there is a way to debug these, have verbose output with logging DEBUG level. It would also be good to be able to override PyJWKClient args for TokenBackend init.

[Andrew-Chen-Wang]

yup, we should probably raise Exc from e to get you that full traceback. Thanks

[InterStella0]

Chained error is good as well. I was thinking something for verbose logs such as fetching JWKS, etc.

[vgrozdanic]

I wouldn't introduce more logs at it can easily lead to a lot of noise, but i definitely agree that it is a good practice to have full tracebacks, i believe that will help a lot during debugging.

Did this change here: #870

[InterStella0]

I disagree with that sentiment, creating noise in logging level DEBUG shouldn't be an issue, people have to set them to DEBUG to see it and that's the point for debugging purposes. If they dont want it, they would put verbosity level at INFO.

[vgrozdanic]

I disagree with that sentiment, creating noise in logging level DEBUG shouldn't be an issue, people have to set them to DEBUG to see it and that's the point for debugging purposes. If they dont want it, they would put verbosity level at INFO.

@InterStella0 true, that is a very good point, and i agree with you.

I wanted to say that for the library that had 0 logs so far, introducing a lot of logs all of the sudden could lead to more noise in the logs of the devs that use this library, but after reading your comment and giving it a second thought - it would make sense to add more debug logs all over the library, i guess it is never too late to do it :)