istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Change for consistency with title (#12647)

This commit is contained in:
Michael 2023-02-13 23:41:48 +08:00 committed by GitHub
parent adfbceaf6e
commit 9ab1a8f9df
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
content/en/docs/tasks/security/authentication/claim-to-header/index.md
View File

@ -1,6 +1,6 @@
--- ---
title: Copy JWT Claims to HTTP Headers title: Copy JWT Claims to HTTP Headers
description: Shows how users can copy their jWT claims to http headers. description: Shows how users can copy their JWT claims to HTTP headers.
weight: 30 weight: 30
keywords: [security,authentication,JWT,claim] keywords: [security,authentication,JWT,claim]
aliases: aliases:
@ -10,7 +10,8 @@ owner: istio/wg-security-maintainers
test: yes test: yes
status: Experimental status: Experimental
--- ---
This task shows you how to copy valid JWT claims to http headers after JWT authentication is successfully completed via Istio request authentication policy.
This task shows you how to copy valid JWT claims to HTTP headers after JWT authentication is successfully completed via an Istio request authentication policy.
{{< warning >}} {{< warning >}}
Only claims of type string, boolean, and integer are supported. Array type claims are not supported at this time. Only claims of type string, boolean, and integer are supported. Array type claims are not supported at this time.
@ -27,7 +28,7 @@ Before you begin this task, do the following:
* Install Istio using [Istio installation guide](/docs/setup/install/istioctl/). * Install Istio using [Istio installation guide](/docs/setup/install/istioctl/).
* Deploy `httpbin` and `sleep` workloads in namespace `foo` with sidecar injection enabled. * Deploy `httpbin` and `sleep` workloads in namespace `foo` with sidecar injection enabled.
Deploy the example namespace and workloads using these commands: Deploy the example namespace and workloads using these commands:
{{< text bash >}} {{< text bash >}}
$ kubectl create ns foo $ kubectl create ns foo
@ -43,16 +44,16 @@ Deploy the example namespace and workloads using these commands:
200 200
{{< /text >}} {{< /text >}}
{{< warning >}} {{< warning >}}
If you don’t see the expected output, retry after a few seconds. If you don’t see the expected output, retry after a few seconds.
Caching and propagation can cause a delay. Caching and propagation can cause a delay.
{{< /warning >}} {{< /warning >}}
## Allow requests with valid JWT and list-typed claims ## Allow requests with valid JWT and list-typed claims
1. The following command creates the `jwt-example` request authentication policy 1. The following command creates the `jwt-example` request authentication policy
for the `httpbin` workload in the `foo` namespace. This policy for the `httpbin` workload in the `foo` namespace. This policy
accepts a JWT issued by `testing@secure.istio.io` and copies the value of claim `foo` to an http header `X-Jwt-Claim-Foo`: accepts a JWT issued by `testing@secure.istio.io` and copies the value of claim `foo` to an HTTP header `X-Jwt-Claim-Foo`:
{{< text bash >}} {{< text bash >}}
$ kubectl apply -f - <<EOF $ kubectl apply -f - <<EOF
@ -95,7 +96,7 @@ accepts a JWT issued by `testing@secure.istio.io` and copies the value of claim
200 200
{{< /text >}} {{< /text >}}
1. Verify that a request contains a valid http header with JWT claim value: 1. Verify that a request contains a valid HTTP header with JWT claim value:
{{< text bash >}} {{< text bash >}}
$ kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- curl "http://httpbin.foo:8000/headers" -sS -H "Authorization: Bearer $TOKEN" | grep "X-Jwt-Claim-Foo" | sed -e 's/^[ \t]*//' $ kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- curl "http://httpbin.foo:8000/headers" -sS -H "Authorization: Bearer $TOKEN" | grep "X-Jwt-Claim-Foo" | sed -e 's/^[ \t]*//'