How to verify a JWT token with Envoy - jwt

Question

I'm using Envoy as the gateway of my backend and I'm trying to use its JWT mechanism.
Here is what I've done:
Generate a pair of prv & pub keys with the command openssl:
openssl genrsa -out keyprv.pem 512
openssl rsa -in keyprv.pem -pubout -out keypub.crt
Let's say that the private key is PRVKEY and the public key is PUBKEY.
Generate a token with Python3. Here is my code:
#!/usr/bin/env python3
import jwt
from datetime import datetime
from datetime import timedelta
due_date = datetime.now() + timedelta(minutes=30)
expiry = int(due_date.timestamp())
payload = {"iss": "ImIss", "sub": "ImSub", "user_id": 12345, "exp": expiry}
private_key=b"-----BEGIN RSA PRIVATE KEY-----\nPRVKEY\n-----END RSA PRIVATE KEY-----"
jwt_token = jwt.encode(payload, private_key, algorithm="RS256", headers={"alg": "RS256", "typ": "JWT"})
print(jwt_token)
After executing the Python3 script, I get a JWT token aaa.bbb.ccc.
Configure my Envoy to verify the JWT token above. Here is the config file of Envoy:
static_resources:
listeners:
- name: listener_0
address:
socket_address:
address: 0.0.0.0
port_value: 9989
filter_chains:
- filters:
- name: envoy.filters.network.http_connection_manager
typed_config:
"#type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
stat_prefix: ingress_http
http_filters:
- name: envoy.filters.http.jwt_authn
typed_config:
"#type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
providers:
remote_jwt_provider:
issuer: "ImIss"
local_jwks:
inline_string: |
{
"keys": [
{
"kty": "RSA",
"kid": "my-key-id",
"use": "sig",
"n": "PUBKEY", # is this correct?
"e": "AQAB",
}
]
}
forward: true
from_params:
- jwt_token
rules:
- match:
prefix: "/"
requires:
provider_name: remote_jwt_provider
- name: envoy.filters.http.router
typed_config:
"#type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
route_config:
name: local_route
virtual_hosts:
- name: local_service
domains: ["*"]
routes:
- match: { prefix: "/" }
route:
cluster: cluster_example
clusters:
- name: auth_service
connect_timeout: 30s
type: STATIC
dns_lookup_family: V4_ONLY
load_assignment:
cluster_name: auth_service
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: 172.16.0.44
port_value: 8081
- name: cluster_example
connect_timeout: 30s
type: STATIC
dns_lookup_family: V4_ONLY
load_assignment:
cluster_name: cluster_example
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: 172.16.0.226
port_value: 11111
But the config file would generate an Envoy error: Jwks RSA [n] or [e] field is missing or has a parse error. It seems that the characters / and = in the PUBKEY cause this error. So I'm thinking I may need to encode the public key with base64. So I use the output of base64.b64encode(PUBKEY) in the config file of Envoy. Now Envoy won't generate any error but it can't verify the token: Jwt verification fails.