How to set up Istio RBAC based on groups from JWT claims? - istio

Question

I have a service with AuthenticationPolicy and Istio RBAC enabled (authorization context is set to use groups from JWT claim) However, it seems istio does not take into account the groups attribute from JWT claim when a call is being made.
As an IDP I use dex and I have set corresponding AuthnPolicy for it.
I have set Authorization context as following :
apiVersion: "config.istio.io/v1alpha2"
kind: authorization
metadata:
name: requestcontext
namespace: istio-system
spec:
subject:
user: source.user | request.auth.claims["email"] | ""
groups: request.auth.claims["groups"] | ""
properties:
namespace: source.namespace | ""
service: source.service | ""
iss: request.auth.claims["iss"] | ""
sub: request.auth.claims["sub"] | ""
action:
namespace: destination.namespace | ""
service: destination.service | ""
method: request.method | ""
path: request.path | ""
properties:
version: request.headers["version"] | ""
I have enabled RBAC and created ServiceRole. I've added ServiceRoleBinding with subject set to a specific group called "admins" :
apiVersion: "config.istio.io/v1alpha2"
kind: ServiceRoleBinding
metadata:
name: service-admin-binding
spec:
subjects:
- group: "admins"
roleRef:
kind: ServiceRole
name: "service-admin"
When a call is made without a token AuthnPolicy works, 401 with proper message is returned. Call with valid JWT results in 403 permission denied as the group was not matched. It works fine when I change subject to "all" users instead of a group( - user: "*")
Groups claim in fetched JWT after decoding is just an array of strings :
"groups": [
"admins"
]
If I add in the authorization context a first non empty operator with hardcoded value "admins" - groups: request.auth.claims["groups"] | "admins") it works ofc, but indicates groups are empty on mixer adapter resolving phase?
If I set in the authorization context groups to be taken from request.auth.token["groups"] like it's mentioned in the docu
mixer fails with an error :
(...)'requestcontext.authorization.istio-system': failed to evaluate expression for field 'Subject'; failed to evaluate expression for field 'Subject.Groups': unknown attribute request.auth.token'.
When I took a look at attribute vocabulary docu it does not mention token attribute on request.auth and I could find it in the code neither. However, there is request.auth.claims which I'm trying to use.
How can I setup authentication policy together with RBAC to let it be working with groups from JWT? Additionally, is it possible to log/debug mixer while resolving the authorization phase, to see what's exactly evaluated?

Answer 1

Answered by Piotr Mścichowski in comments:
I got a response on google groups mentioning that groups as an array of strings are not supported yet as well as groups in the subject of role binding (could be workaround by properties):
Yangmin Zhu
We're currently working adding more documents in Istio 1.0, if you're
using the most recent daily release, you could try it with the
following steps:
1) We introduced a new global custom resource to control the RBAC
behavior in the mesh: RbacConfig. You could apply one like
this to enable RBAC for the "default" namespace,
2) We made some changes to the ServiceRole.Constraints and
ServiceRoleBinding.Properties about what keys are supported. See
this PR for an overview of the supported keys. Regarding your
ServiceRoleBinding, you could use the following config to check
against the claim from the JWT (Note: the group field is not used and
not supported, instead you could specify it in properties):
apiVersion: "config.istio.io/v1alpha2"
kind: ServiceRoleBinding
metadata:
name: service-admin-binding
spec:
subjects:
- properties:
request.auth.claims[groups]: "admins"
roleRef:
kind: ServiceRole
name: "service-admin"
I think you don't need special setting to make the authentication
policy work with RBAC, if you could successfully finish this
task, it should work with RBAC automatically.
You could turn on the debug logging of the envoy proxy of your
service. For rbac, there is a specific logging group named "rbac" in
envoy, you could access the enovy admin page locally (by default it's
http://127.0.0.1:15000/logging).
Limin Wang:
We currently haven't supported JWT claims that are non-strings. If your JWT group claim is set to a single string
(instead of an array), it will just work.
"group": "admin"
Also "group" under "subject" is not supported at the moment. But as
Yangmin suggested, you can use custom "properties" instead.
subjects:
- properties:
request.auth.claims[groups]: "admins"
Thanks for bring this issue to our attention, we plan to make
improvement to support such use case in future releases.