Short example to use JWT with Kong

KongJwt.md

JWT Kong Example

• Get and Start Kong and Co

git clone git@github.com:Mashape/docker-kong.git
cd docker-kong/compose
docker-compose up

• Create Kong API Route

curl -X POST http://localhost:8001/apis/ \
   --data "request_path=/skywalkerDemo" \
   --data "upstream_url=https://www.finleap.com" \
   --data "strip_request_path=true"

• Enable JWT Plugin For Route

curl -X POST http://localhost:8001/apis/skywalkerDemo/plugins \
    --data "name=jwt" \ 
    --data "config.secret_is_base64=true"

• Create a Kong Consumer

curl -X POST http://localhost:8001/consumers \
   --data "username=bill"

• Create JWT Credentials for User and Note key and secret from response

curl -H "Content-Type: application/json" -X POST -d '{}' http://localhost:8001/consumers/bill/jwt

Response: {"secret":"b9f813fb8753440eabb1b44f9ba4da2f",
  "id":"33dacbca-ce7d-4305-a213-1ce7b8f7af71",
  "algorithm":"HS256",
  "created_at":1473085487000,
  "key":"cef1fe6937e444a6b18a26965d619718",
  "consumer_id":"67c90d83-636b-4c36-85ac-a14eac54ebe2"}

• Craft JWT using e.g. http://jwtbuilder.jamiekurtz.com/

  • Issuer (key from above): cef1fe6937e444a6b18a26965d619718
  • Key (secret from above): b9f813fb8753440eabb1b44f9ba4da2f

  Results in JWT: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJjZWYxZmU2OTM3ZTQ0NGE2YjE4YTI2OTY1ZDYxOTcxOCIsImlhdCI6bnVsbCwiZXhwIjpudWxsLCJhdWQiOiIiLCJzdWIiOiIifQ.50bnA9d3wjIYIx6m-fzxIHQHfXF6zuJRPMUdk8-4LTU

• Issue request to API endpoint with JWT im header

curl http://localhost:8000/skywalkerDemo \
    -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJjZWYxZmU2OTM3ZTQ0NGE2YjE4YTI2OTY1ZDYxOTcxOCIsImlhdCI6bnVsbCwiZXhwIjpudWxsLCJhdWQiOiIiLCJzdWIiOiIifQ.50bnA9d3wjIYIx6m-fzxIHQHfXF6zuJRPMUdk8-4LTU'

Hi,

I'm getting the following issue while trying to setup
{"message":"No credentials found for given 'iss'"}

Could you please help me with any solution.

Fixed this issue. Solution:
Copied the keycloak.json client in the webapp and as well copied the client_secret while generating the token.

I am facing same issue for services and routes. I am not able to solve this issue.Will you help me ?

@aliabbas-2012 what is the issue your facing? Can you put more details?

{"message":"No credentials found for given 'iss'"}

@aliabbas-2012 Make sure that the value that is set in the iss claim is the same name you have given to the jwt credential for it's key you setup for the consumer.

With this, we can very easy cheating browser session.

For example:
I will logged-in with my Browser, take the JWT Bearer token from there, and put in the CURL/Postman to get access.

How can we avoid it, actually?

How do kong JWT plugins get to know which consumer to use?

As there is no refers of no plugin ID/routeID/ServiceID in consumer configuration.

is not dinamic