# Need to have anonymous routing through jwt global plugin urgently
**URL:** https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398
**Category:** Questions
**Tags:** kubernetes
**Created:** [January 24, 2020, 11:55pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398 "2020-01-24T23:55:02Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@Hamed\_Hatami](https://discuss.konghq.com/u/Hamed_Hatami)
#### Post date: [January 24, 2020, 11:55pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/1 "2020-01-24T23:55:02Z")
Hi there,
I have been using Kong db-less 1.4.1, runing on Kubernetes (OpenShift)
I have configured (enabled) JWT plugin as global to be used for all rest APIs behind the Kong but I also need to have anonymous in the same plugin as exceptions, I created the jwt plugin by below yaml
* * *
apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)
config:
anonymous: “this is an example of consumer\_id”
kind: KongPlugin
metadata:
labels:
[app.kubernetes.io/instance:](http://app.kubernetes.io/instance:) kong
[app.kubernetes.io/name:](http://app.kubernetes.io/name:) kong
global: ‘true’
name: global-jwt
namespace: iot-kong
plugin: jwt
Moreover I have also created “KongConsumer” and “KongCredential” , this plugin works perfectly but when I add anonymous in this configuration, it doesn’t work anymore
Please do me a favor and send me an practical example to solve my problem
It’s too urgent
BR,
//Hamed
---
### Author:  [@hbagdi](https://discuss.konghq.com/u/hbagdi)
#### Post date: [January 27, 2020, 4:22pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/2 "2020-01-27T16:22:58Z")
Please use username instead of ID of the consumer for the anonymous property.
---
### Author:  [@Hamed\_Hatami](https://discuss.konghq.com/u/Hamed_Hatami)
#### Post date: [January 28, 2020, 9:10am UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/3 "2020-01-28T09:10:56Z")
Thanks a lot for quick reply.
I have changed it like what you said but I got {“message”:“An unexpected error occurred”} from kong
But below has happened inside the container
2020/01/28 09:10:13 [error] 24#0: \*9190992 [kong] handler.lua:261 [jwt] failed to get from node cache: [off] invalid primary key: ‘{id=“expected a valid UUID”}’,
---
### Author:  [@hbagdi](https://discuss.konghq.com/u/hbagdi)
#### Post date: [January 28, 2020, 5:31pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/4 "2020-01-28T17:31:57Z")
Make sure you are using Kong 1.4+, you already mentioned that.
Can you share the KongPlugin, KongConsumer resources that you are using?
---
### Author:  [@Hamed\_Hatami](https://discuss.konghq.com/u/Hamed_Hatami)
#### Post date: [January 29, 2020, 12:06pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/5 "2020-01-29T12:06:21Z")
I’m pretty sure about Kong version 1.4.1
I have two different consumers
1. anonymous-consumer as below :
apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)
credentials:
- anonymous-apikey
kind: KongConsumer
metadata:
clusterName: ‘’
labels:
[app.kubernetes.io/instance:](http://app.kubernetes.io/instance:) kong
[app.kubernetes.io/managed-by:](http://app.kubernetes.io/managed-by:) Tiller
[app.kubernetes.io/name:](http://app.kubernetes.io/name:) kong
name: anonymous-consumer
namespace: iot-kong
selfLink: \>-
/apis/configuration.konghq.com/v1/namespaces/iot-kong/kongconsumers/anonymous-consumer
uid: a47df977-3f4a-11ea-a579-0050568cabd9
username: anonymous-consumer
1. Kong consumer as below :
apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)
kind: KongConsumer
metadata:
clusterName: ‘’
labels:
[app.kubernetes.io/instance:](http://app.kubernetes.io/instance:) kong
[app.kubernetes.io/managed-by:](http://app.kubernetes.io/managed-by:) Tiller
[app.kubernetes.io/name:](http://app.kubernetes.io/name:) kong
name: kong
namespace: iot-kong
selfLink: \>-
/apis/configuration.konghq.com/v1/namespaces/iot-kong/kongconsumers/kong
uid: 24d323c2-12c0-11ea-a579-0050568cabd9
username: kong
The (1) has been used for make an anonymous way inside the global Kong JWT plugin and the (2) has been used for Kong JWT plugin itself
We didn’t use to have anonymous consumer before desiring
global kong jwt plugin has to have anonymous way of insecure routing
You can find Kong JWT plugin as follows :
apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)
config:
anonymous: 24e151a9-14c0-11ea-a539-2050568cabd6
claims\_to\_verify:
- exp
kind: KongPlugin
metadata:
clusterName: ‘’
labels:
[app.kubernetes.io/instance:](http://app.kubernetes.io/instance:) kong
[app.kubernetes.io/managed-by:](http://app.kubernetes.io/managed-by:) Tiller
[app.kubernetes.io/name:](http://app.kubernetes.io/name:) kong
global: ‘true’
name: global-jwt
namespace: iot-kong
selfLink: \>-
/apis/configuration.konghq.com/v1/namespaces/iot-kong/kongplugins/global-jwt
uid: 24e151a9-12c0-11ea-a579-0050568cabd9
plugin: jwt
Please give me a hand if it can be used
Thanks in advance
//Hamed
---
### Author:  [@hbagdi](https://discuss.konghq.com/u/hbagdi)
#### Post date: [January 29, 2020, 4:03pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/6 "2020-01-29T16:03:44Z")
> [@Hamed\_Hatami](#):
>
> anonymous: 24e151a9-14c0-11ea-a539-2050568cabd6
You should use the `username` of the consumer in this field. This should be `anonymous-consumer` based on your KongConsumer definitions above.
---
### Author:  [@Hamed\_Hatami](https://discuss.konghq.com/u/Hamed_Hatami)
#### Post date: [January 29, 2020, 4:50pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/7 "2020-01-29T16:50:50Z")
I have changed it like what you said but I got {“message”:“An unexpected error occurred”} from kong
But below has happened inside the container
2020/01/28 09:10:13 [error] 24#0: \*9190992 [kong] handler.lua:261 [jwt] failed to get from node cache: [off] invalid primary key: ‘{id=“expected a valid UUID”}’,
---
### Author:  [@hbagdi](https://discuss.konghq.com/u/hbagdi)
#### Post date: [January 30, 2020, 4:13pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/8 "2020-01-30T16:13:21Z")
This probably is a bug. Can you open a Github issue?
---
### Author:  [@Hamed\_Hatami](https://discuss.konghq.com/u/Hamed_Hatami)
#### Post date: [February 20, 2020, 12:30pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/9 "2020-02-20T12:30:34Z")
To be honest, I’m really busy, if it’s possible do it by yourself
---
### Author:  [@hbagdi](https://discuss.konghq.com/u/hbagdi)
#### Post date: [February 20, 2020, 11:20pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/10 "2020-02-20T23:20:20Z")
This is already fixed [https://github.com/Kong/kong/issues/5551](https://github.com/Kong/kong/issues/5551).
Please wait for 2.0.2 to be released, which will contain this fix. We plan on having the release in next couple of weeks.
---
### Author:  [@Hamed\_Hatami](https://discuss.konghq.com/u/Hamed_Hatami)
#### Post date: [February 21, 2020, 6:56am UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/11 "2020-02-21T06:56:06Z")
Thank you for quick reply
Sounds great
---
### Author:  [@Hamed\_Hatami](https://discuss.konghq.com/u/Hamed_Hatami)
#### Post date: [March 2, 2020, 3:28pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/12 "2020-03-02T15:28:27Z")
Applying username as value of anonymous has no problem in 2.0.2 but the actual functionality of this global doesn’t work properly
when I turn the jwt plugin global and add anonymous : username then all api can be invoked with no security, I expected to give --header “apiKey = something as key” to the request to let this specific request come in with no token otherwise other requests should have token as a must
We’re still stuck in this plugin usage
---
### Author:  [@hbagdi](https://discuss.konghq.com/u/hbagdi)
#### Post date: [March 6, 2020, 6:27pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/13 "2020-03-06T18:27:56Z")
If you always want the API calls to be authenticated then please don’t use anonymous field.
Anonymous field makes it possible to have authenticated and unauthenticated calls to a service.
---
### Author:  [@Hamed\_Hatami](https://discuss.konghq.com/u/Hamed_Hatami)
#### Post date: [March 6, 2020, 11:28pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/14 "2020-03-06T23:28:08Z")
I want to have authenticated requests by default but also have some exceptions for example if you are exposing the token provider API behind the Kong , it has to be Unauthenticated request because you will ask for getting token but all the other APIs behind the Kong have to be Authenticated requests by token
/iot/api/token (Unauthenticated)
/iot/api/billing (Authenticate)
/iot/api/invoice (Authenticate)
What’s the practical solution ? could you please give me an applicable jwt global plugin configuration with anonymous in it and a client request example to show how the anonymous request has to look like ?
---
### Author:  [@hbagdi](https://discuss.konghq.com/u/hbagdi)
#### Post date: [March 9, 2020, 3:30pm UTC](https://discuss.konghq.com/t/need-to-have-anonymous-routing-through-jwt-global-plugin-urgently/5398/15 "2020-03-09T15:30:33Z")
You don’t need anonymous consumer in this case.
Create a `/iot/api` route in Kong with the JWT plugin enabled on it.
Create a more specific `/iot/api/token` route in Kong and don’t enable the JWT plugin on it.
That should be it.