JWT Authentication with support for JWKS

[garypen]

In the context of #912

[ntkoopman]

I'm getting an error:

apollo_router::plugins::authentication: could not activate commercial features e=Apollo graph reference is missing

If this is intended to be for Cloud/Enterprise users only it should probably be mentioned in the documentation.

[tbrockmeyer-a]

Yes, the docs here mention nothing about requiring these "commercial features". Are they supposed to be required for this usage, or is it a bug?

[Arrivegrsmith]

Same issue. Using -s supergraph.graphql opt on Router with https Okta keys URL on experimental JWKS router config setting. Haven't found a solution yet. Any idea @garypen ?

[abernix]

Hey! Thanks for flagging this. We are still exploring what the final state of this experimental feature will look like, though some of our designs for it do involve a tight integration with Apollo Studio.

That said, the current implementation of the feature does not actually require such a tight integration with Apollo Studio. With that in mind, if you want to experiment with the feature today, you can just set the APOLLO_GRAPH_REF environment variable to any non-blank value and try the feature.

I'll also make sure that we get the documentation updated to reflect this because that's certainly not clear enough right now. It is worth noting that the feature may change anytime between now and when it’s finally released and it may very well require a Studio account in the future.

[killjoy2013]

I hope it won't require apollo studio account 😄

[shashankkr]

Hi,
I am testing out the plugin with OKTA idp. It works as expected, however:

• print(claims: ${claims}) is not printing any logs
• keep getting these warnings: 2023-02-14T12:44:04.660630Z /usr/local/cargo/registry/src/github.com-1ecc6299db9ec823/apollo-router-1.10.3/src/plugins/telemetry/mod.rs:1452 ERROR apollo_router::plugins::telemetry: OpenTelemetry trace error occurred: Exporter ApolloExporter encountered the following error(s): Apollo exporter client error: Tokens must have 3 parts separated by a colon.

Script I used:

fn process_request(service,subgraph) {
    try {
        let f = |request| {
        // Note: APOLLO_AUTHENTICATION_JWT_CLAIMS is a Rhai-scope constant with
        // value `apollo_authentication::JWT::claims`
        let claims = request.context[APOLLO_AUTHENTICATION_JWT_CLAIMS];
        if claims == () {
            throw #{
                status: 401,
                message: "No claims presented in this request"
            };
        }
        if !claims.contains("aud") {
            throw #{
                status: 401,
                message: "No audience presented in this request"
            };
        }
        if claims["aud"] != "api://appapi" {
            throw #{
                status: 401,
                message: `Issuer ${claims.aud} is not accepted here`
            };
        }
        if !claims.contains("len_graph_reader") {
            throw #{
                status: 401,
                message: "No default len_graph_reader claim presented in this request"
            };
        }
        if claims["graph_reader"] != "reader" {
            throw #{
                status: 401,
                message: `Claim value of ${claims.len_graph_reader} is not accepted here`
            };
        }
        // Happy path: We have valid claims from the correct idP.
        // Proceed accordingly (in this case, we just log the claims).
            // Add each claim key-value pair as a separate HTTP header
        for key in claims.keys() {
            request.subgraph.headers[key] = claims[key];
        }
        print(`all claims:`);
        print(`claims: ${claims}`);
     };
     service.map_request(f);
    }
    catch(err)
    {
        // log any errors
        log_error(`Error during claims processing: ${err}`);
        throw err;
    }
}

[shashankkr]

Hi @garypen ,
I worked with Lucas to fix the rhai script and its working as expected. However, I am still getting the same errors. Attaching the screenshot

`
2023-02-17T17:52:24.921273Z apollo-router/src/plugins/telemetry/apollo_exporter.rs:240 ERROR apollo_router::plugins::telemetry::apollo_exporter: client error reported at ingress: Tokens must have 3 parts separated by a colon.

2023-02-17T17:52:24.921351Z apollo-router/src/plugins/telemetry/apollo_exporter.rs:152 ERROR apollo_router::plugins::telemetry::apollo_exporter: failed to submit Apollo report: Apollo exporter client error: Tokens must have 3 parts separated by a colon.
`

[Arrivegrsmith]

Does the debugger at https://jwt.io/ show any issues with your JWT?

[shashankkr]

Hi @Arrivegrsmith yes the token is correct.

[shashankkr]

The error is interesting Tokens must have 3 parts separated by a colon. The raw token is separated by '.' and not a colon.

[garypen]

Just to be clear about the exact problem here. The JWT authentication stuff is working, but you are seeing error logs about apollo exporter complaining about Tokens.

If so, that looks like a telemetry issue with apollo exporter. Could you report an issue with the relevant details?

[InsidersByte]

Hello,

I was looking at this feature and was wondering if it would be possible to add support for the token being in a cookie instead of a header?

[abernix]

This was released as a GraphOS Enterprise feature in https://github.com/apollographql/router/releases/tag/v1.12.0.