Keycloak provides invalid signature with Istio and JWT

问题

I'm using Keycloak (latest) for Auth 2.0, to validate authentication, provide a token (JWT) and with the token provided, allows the access to the application URLs, based in the permissions. Keycloak is currently running in Kubernates, with Istio as Gateway. For Keycloak, this is the policy being used:

apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: application-auth-policy
spec:
  targets:
  - name: notification
  origins:
  - jwt:
      issuer: http://<service_name>http.<namespace>.svc.cluster.local:8080/auth/realms/istio
      jwksUri: http://<service_name>http.<namespace>.svc.cluster.local:8080/auth/realms/istio/protocol/openid-connect/certs
  principalBinding: USE_ORIGIN

An client was registered in this Keycloak and a RSA created for it. The issuer can generates a token normally and the policy was applied successfully.

Problem:

1. Even with everything set, the token provided by Keycloak has the signature invalid according to JWT Validator.

2. This token doesn't allow any access for the URLs, as it should be, with 401 code.

Anyone else had a similar issue?

回答1:

The problem was resolved with two options: 1. Replace Service Name and port by external server ip and external port (for issuer and jwksUri) 2. Disable the usage of mTLS and its policy (Known issue: https://github.com/istio/istio/issues/10062).

来源：https://stackoverflow.com/questions/54988412/keycloak-provides-invalid-signature-with-istio-and-jwt