How to use NGinx parameter inside URL

[gid-fieldcode]

In our SecurityPolicy, we need to define a parametric JWKS URI (utilizing %REQ(Host)% ) like this:

remoteJWKS:
        uri: https://%REQ(Host)%/auth/certs

However this gives us an error:

"error": "invalid remote JWKS URI: parse \"https://%REQ(Host)%/auth/certs\": invalid URL escape \"%RE\"\n invalid remote JWKS URI: parse \"https://%REQ(Host)%/auth/certs\": invalid URL escape \"%RE\""}

Please suggest the proper syntax.

[gid-fieldcode]

Kind reminder....

[gid-fieldcode]

@zhaohuabing Thanks for your suggestion.

We have implemented such a controller and just tested it. The autogenerated SP YAML manifest has one provider entry for each tenant. It starts like this:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: new-sync-policy
  namespace: test
spec:
  targetRefs:
  - group: gateway.networking.k8s.io  
    kind: HTTPRoute
    name: time-zone-gsl      
  jwt:
    providers:
    - name: thistenant-provider
      remoteJWKS:        
        uri: http://thistenant.acme.wtf/auth/realms/thistenant/protocol/openid-connect/certs        
      claimToHeaders:
      - claim: iss
        header: x-acme-envoy-tenant
    - name: acme-provider
      remoteJWKS:        
        uri: http://acme.acme.wtf/auth/realms/acme/protocol/openid-connect/certs        
      claimToHeaders:
      - claim: iss
        header: x-acme-envoy-tenant

However when we apply it, we get this error:

The SecurityPolicy "new-sync-policy" is invalid:
* spec.jwt.providers: Too many: 51: must have at most 4 items

Is there a way around this?

[zhaohuabing]

spec.jwt.providers: Too many: 51: must have at most 4 items

This limit is set by the EG to avoid excessive providers, which could negatively impact the performance. We could consider increasing this limit slightly - to 8 or 16 providers - but it shouldn't be too hight, as it introduces latency to the request. How many tenants are you managing? If you have a large number of tenants, a better approach might be creating a separate route and SP for each tenant.

[gid-fieldcode]

@zhaohuabing We have 60+ routes and 70+ tenants, so we cannot proceed as you suggest. We would like to implement the SP using a single remoteJWKS URI, that would have the intelligence to figure out how to handle multiple tenants, assuming that it receives, with each request, a header that would carry the tenant information. Is it, perhaps, possible to configure the Gateway resource to include such a header in the request it makes to the remoteJWKS URI?

So, for example, the original request would come to some-tenant.acme.com/some/service, and the central remoteJWKS URI would be set up as validator.acme.com/validate, and the Gateway would submit its request along with a HTTP header x-forwarded-validate=some-tenant.acme.com. This way the validator service would know how to handle the request and send the appropriate response back to the Gateway.

We have experimented by using a header-echo service as the remoteJWKS URI and saw that such a header is not included in the request it receives from the Gateway.

[arkodg]

can you add it as a query param to the URI ?
Also if you have control over the JWT validator service, you may want to consider using ext Authz
https://gateway.envoyproxy.io/docs/tasks/security/ext-auth/

[zhaohuabing]

I believe the header/query param approach won't work because the envoy JWT authn filter doesn't differentiate between tenants.
While it might be possible to implement, it would require significant modification to the JWT authn filter to support "different jwks for different tenants".

The ext Authz approach is an easier path.