JWT Plugin: Invalid Signature

1

Hi Folks,
First question from a a first time user of Kong.
Setup:

  • Kong deployed using Helm running as Ingress Controller in Kubernetes
  • JWT KongPlugin resource used to validate Okta Authorisation code per namespace
  • KongConsumer deployed per namespace
  • KongCredential deployed per namespace mapped to KongConsumer and configured to use RS256, Key and RSA Public Key supplied.

Problem

  • OKTA authentication is successful
  • JWT validation fails as “Invalid Signature”

I have tried using HS256 as the algorithm without success.
I have also tried using Kubernetes Secret instead of KongCredential which is deprecated.
As I am using community version JWKS is not an option, no supported Plugin but then I have the correct Public Key configured.

Help much appreciated.

2

Hey,

I’m in a similar situation I think. How did you set the algorithm of the credential to RS256 when creating the kubernetes secret? I’m trying to use this as KongCredential is deprecated.

Are you setting the plugin, consumer, etc through the declarative config file or through yaml manifests? Could you share your config?

Thanks!

3

What did you try? You generally need to set the keys using the following flags when creating the secret:

--from-literal=algorithm=foo --from-literal=another-key=another-value
4

My issue was with a validation of the rsa key with RS256. I could fixed it provided the correct key format. Thanks for the reply!

5

Hi, I have same issue using HS256

this is my secret

apiVersion: v1
kind: Secret
metadata:
name: app-jwt
type: Opaque
stringData:
kongCredType: jwt
key: auth
algorithm: HS256
secret: pleaseChangeThisSecretForANewOne