-
Notifications
You must be signed in to change notification settings - Fork 128
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
deck enforces a secret for RS256 JWT auth details #181
Comments
We're unfortunately kinda stuck here: the validation requirements for jwt-auth are a bit odd in that some fields are required, but only sometimes, and technically no fields are required, though some essentially are in that the fill in default values. That complicates declarative configuration because we want to know for sure that we have a both valid and complete representation of the plugin configuration, while also not wanting too complex of validation rules (since we don't want to replicate logic in Kong that may change as much as possible). The upshot here is that unfortunately there's not much we can do that satisfies both goals well, and the unnecessary requirement has a workaround: filling out the field with a dummy value bypasses the check, but doesn't change the plugin behavior (the setting is just ignored in the the other mode). I'll update documentation to reflect the issue and instruct readers to configure it regardless of whether it's truly required. |
Add warning for decK and KIC users to jwt-auth/JWT credential docs. Please see Kong/deck#181 and Kong/kubernetes-ingress-controller#750 for background.
Add warning for decK and KIC users to jwt-auth/JWT credential docs. Please see Kong/deck#181 and Kong/kubernetes-ingress-controller#750 for background. Co-authored-by: lena-larionova <54370747+lena-larionova@users.noreply.github.com>
Trying to create a consumer with JWT credentials using the RS256 algorithm. For the RS256 Algorithm, the secret field is non-mandatory. But, deck sync command mandates to provide the field, as given below
# deck sync --headers kong-admin-token:my-token Error: reading file: validating file content: 1 errors occurred: consumers.0.jwt_secrets.0: secret is required
The admin API does allow a null secret to be used with the RS256 algorithm. I tried editing the kong.yaml file and setting the secret to nothing, null and an empty string and all gave the same error i.e. secret is required
The text was updated successfully, but these errors were encountered: