Skip to content

Commit a1a5d36

Browse files
day0opssam-heilbron
day0ops
and
sam-heilbron
authored
Attach jwt failure status to metadata (#10662)
Signed-off-by: day0ops <[email protected]> Co-authored-by: Sam Heilbron <[email protected]>
1 parent df34c9c commit a1a5d36

File tree

14 files changed

+386
-271
lines changed

14 files changed

+386
-271
lines changed

‎changelog/v1.19.0-beta13/attach-jwt-failure-status-to-metadata.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
changelog:
2+
- type: NON_USER_FACING
3+
issueLink: https://github.com/solo-io/solo-projects/issues/7837
4+
resolvesIssue: false
5+
description: >
6+
Added a new field `attachFailedStatusToMetadata` to attach JWT failure status to dynamic metadata so that the status code and message can be logged.

‎docs/content/reference/api/github.com/solo-io/gloo/projects/gloo/api/v1/enterprise/options/jwt/jwt.proto.sk.md

+2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎install/helm/gloo/crds/gateway.solo.io_v1_RouteOption.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -721,6 +721,8 @@ spec:
721721
providers:
722722
additionalProperties:
723723
properties:
724+
attachFailedStatusToMetadata:
725+
type: string
724726
audiences:
725727
items:
726728
type: string
@@ -801,6 +803,8 @@ spec:
801803
providers:
802804
additionalProperties:
803805
properties:
806+
attachFailedStatusToMetadata:
807+
type: string
804808
audiences:
805809
items:
806810
type: string

‎install/helm/gloo/crds/gateway.solo.io_v1_RouteTable.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -831,6 +831,8 @@ spec:
831831
providers:
832832
additionalProperties:
833833
properties:
834+
attachFailedStatusToMetadata:
835+
type: string
834836
audiences:
835837
items:
836838
type: string
@@ -911,6 +913,8 @@ spec:
911913
providers:
912914
additionalProperties:
913915
properties:
916+
attachFailedStatusToMetadata:
917+
type: string
914918
audiences:
915919
items:
916920
type: string

‎install/helm/gloo/crds/gateway.solo.io_v1_VirtualHostOption.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -377,6 +377,8 @@ spec:
377377
providers:
378378
additionalProperties:
379379
properties:
380+
attachFailedStatusToMetadata:
381+
type: string
380382
audiences:
381383
items:
382384
type: string
@@ -459,6 +461,8 @@ spec:
459461
providers:
460462
additionalProperties:
461463
properties:
464+
attachFailedStatusToMetadata:
465+
type: string
462466
audiences:
463467
items:
464468
type: string
@@ -539,6 +543,8 @@ spec:
539543
providers:
540544
additionalProperties:
541545
properties:
546+
attachFailedStatusToMetadata:
547+
type: string
542548
audiences:
543549
items:
544550
type: string

‎install/helm/gloo/crds/gateway.solo.io_v1_VirtualService.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -467,6 +467,8 @@ spec:
467467
providers:
468468
additionalProperties:
469469
properties:
470+
attachFailedStatusToMetadata:
471+
type: string
470472
audiences:
471473
items:
472474
type: string
@@ -549,6 +551,8 @@ spec:
549551
providers:
550552
additionalProperties:
551553
properties:
554+
attachFailedStatusToMetadata:
555+
type: string
552556
audiences:
553557
items:
554558
type: string
@@ -629,6 +633,8 @@ spec:
629633
providers:
630634
additionalProperties:
631635
properties:
636+
attachFailedStatusToMetadata:
637+
type: string
632638
audiences:
633639
items:
634640
type: string
@@ -3938,6 +3944,8 @@ spec:
39383944
providers:
39393945
additionalProperties:
39403946
properties:
3947+
attachFailedStatusToMetadata:
3948+
type: string
39413949
audiences:
39423950
items:
39433951
type: string
@@ -4018,6 +4026,8 @@ spec:
40184026
providers:
40194027
additionalProperties:
40204028
properties:
4029+
attachFailedStatusToMetadata:
4030+
type: string
40214031
audiences:
40224032
items:
40234033
type: string

‎projects/gloo/api/external/envoy/extensions/filters/http/jwt_authn/v3/config.proto

+15
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,21 @@ message JwtProvider {
212212
// Specify the clock skew in seconds when verifying JWT time constraint,
213213
// such as `exp`, and `nbf`. If not specified, default is 60 seconds.
214214
uint32 clock_skew_seconds = 10;
215+
216+
// If non empty, the failure status ``::google::jwt_verify::Status`` for a non verified JWT will be written to StreamInfo DynamicMetadata
217+
// in the format as: ``namespace`` is the jwt_authn filter name as ``envoy.filters.http.jwt_authn``
218+
// The value is the ``protobuf::Struct``. The values of this field will be ``code`` and ``message``
219+
// and they will contain the JWT authentication failure status code and a message describing the failure.
220+
//
221+
// For example, if failed_status_in_metadata is ``my_auth_failure_status``:
222+
//
223+
// .. code-block:: yaml
224+
//
225+
// envoy.filters.http.jwt_authn:
226+
// my_auth_failure_status:
227+
// code: 3
228+
// message: Jwt expired
229+
string failed_status_in_metadata = 11;
215230
}
216231

217232
// This message specifies how to fetch JWKS from remote and how to cache it.

‎projects/gloo/api/v1/enterprise/options/jwt/jwt.proto

+8
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,14 @@ message Provider {
100100

101101
// Optional: ClockSkewSeconds is used to verify time constraints, such as `exp` and `npf`. Default is 60s
102102
google.protobuf.UInt32Value clock_skew_seconds = 8;
103+
104+
// Optional: When this field is set, the specified value is used as the key in DynamicMetadata to store the JWT failure status code and message under that key. If the value is empty (i.e., ""), it is ignored.
105+
// This field is particularly useful when logging the failure status.
106+
//
107+
// For example, if the value of `attach_failed_status_to_metadata` is 'custom_auth_failure_status' then
108+
// the failure status can be accessed in the access log as '%DYNAMIC_METADATA(envoy.filters.http.jwt_authn:custom_auth_failure_status)'
109+
// Note: status code and message can be individually accessed as '%DYNAMIC_METADATA(envoy.filters.http.jwt_authn:custom_auth_failure_status.code)' and '%DYNAMIC_METADATA(envoy.filters.http.jwt_authn:custom_auth_failure_status.message)' respectively.
110+
string attach_failed_status_to_metadata = 9;
103111
}
104112

105113
message Jwks {

0 commit comments

Comments
 (0)