istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add instruction to download gen-jwt.py script (#3378) 

* Add instruction to download gen-jwt.py script

* Correct code block sequence

* Correct bash syntax

* Fix comment

* Use  {{< github_file >}} markdown
This commit is contained in:
Diem Vu 2019-02-26 11:24:30 -08:00 committed by istio-bot
parent 54fa8681d5
commit edcedada30
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
content/docs/tasks/security/authn-policy/index.md
View File

@ -564,11 +564,24 @@ $ curl --header "Authorization: Bearer $TOKEN" $INGRESS_HOST/headers -s -o /dev/
{{< /text >}}
To observe other aspects of JWT validation, use the script [`gen-jwt.py`]({{< github_tree >}}/security/tools/jwt/samples/gen-jwt.py) to
generate new tokens to test with different issuer, audiences, expiry date, etc. For example, the command below creates a token that
generate new tokens to test with different issuer, audiences, expiry date, etc. The script can be downloaded from the Istio repository:
{{< text bash >}}
$ wget {{< github_file >}}/security/tools/jwt/samples/gen-jwt.py
$ chmod +x gen-jwt.py
{{< /text >}}
You also need the `key.pem` file:
{{< text bash >}}
$ wget {{< github_file >}}/security/tools/jwt/samples/key.pem
{{< /text >}}
For example, the command below creates a token that
expires in 5 seconds. As you see, Istio authenticates requests using that token successfully at first but rejects them after 5 seconds:
{{< text bash >}}
$ TOKEN=$(@security/tools/jwt/samples/gen-jwt.py@ @security/tools/jwt/samples/key.pem@ --expire 5)
$ TOKEN=$(./gen-jwt.py ./key.pem --expire 5)
$ for i in `seq 1 10`; do curl --header "Authorization: Bearer $TOKEN" $INGRESS_HOST/headers -s -o /dev/null -w "%{http_code}\n"; sleep 1; done
200
200