Access token invalid when we have JWT and Oauth2 plugins within an API

[stephennyu]

Summary

Well, I have just got a problem when I have an API and installed 2 plugins into it which are JWT and Oauth2 plugins. Then, when I try to access API using JWT credential I got an error message like this.

{"error_description":"The access token is invalid or has expired","error":"invalid_token"}

But when I remove the Oauth2 plugin from my API, everything works well.

Steps To Reproduce

1. Add an API
2. Install JWT plugin
3. Install Oauth2 plugin
4. Access API via localhost:8000/{api} -H 'Authorization: Bearer {jwt-token}', and I got this error message
   {"error_description":"The access token is invalid or has expired","error":"invalid_token"}

Additional Details & Logs

• Kong version 0.9.1

[stephennyu]

Note: Previously, I used Kong Version 0.8.3 and got no issue

[subnetmarco]

Access API via localhost:8000/{api} -H 'Authorization: Bearer {jwt-token}', and I got this error message {"error_description":"The access token is invalid or has expired","error":"invalid_token"}

Are you passing the OAuth2 access token too?

[stephennyu]

@thefosk nope. I pass in only the token generated from JWT secret and key to the API

[subnetmarco]

@stephennyu if you also have OAuth 2.0 installed on the API, the plugin should also expect an access token in the request. What kind of use-case are you trying to implement?

[stephennyu]

I'm implementing a use case in which an API can be accessed through several methods such as JWT and Oauth2. I will use JWT for the internal app access such as front end or mobile app and Oauth2 for the third party / partner apps.

Note that I got no problem when I was using Kong version 0.8.3. This problem arises only when I have upgraded it into version 0.9.1

[subnetmarco]

@stephennyu as far as I know multiple authentications are not supported, so may very well be a bug that has been fixed in 0.9.x (related to #590) - I would expect the OAuth 2.0 plugin to always validate an access token and make sure it's being sent.

Just to double-check, can you also append a valid access token to the request and see if it works?

[stephennyu]

@thefosk tested and yes we should append an access token.I think I have been pretty clear with how it works here.
Thanks

[SyedSulaimanM]

@stephennyu i am facing the same issue now. Can you please let me know how you appended access_token with JWT token

[stephennyu]

@SyedSulaimanM you can't do so. You need to have another API to handle that.