Apigee JWT Verification not working when using public JWKs

Google Cloud Apigee
1

I have simple VerifyJWT policy listed below, I am passing ID Token (obtain from google oauth2 playground after using google SSO flow for my user account) in the authorization header(i.e. Bearer ) and seeing below Error. Am I missing something?

Error:

{“fault”:{“faultstring”:“Invalid token: policy(JWT-Verify)”,“detail”:{“errorcode”:“steps.jwt.InvalidToken”}}}

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VerifyJWT async="false" continueOnError="false" enabled="true" name="JWT-Verify">
    <DisplayName>JWT-Verify</DisplayName>
    <Algorithm>RS256</Algorithm>
    <Source>request.header.Authorization</Source>
    <PublicKey>
        <JWKS uri='https://www.googleapis.com/oauth2/v3/certs'/>
    </PublicKey>
</VerifyJWT>
2 Likes
2

Try removing the Source element? The documentation states that the element is not “necessary” when the token is passed as a bearer token in the Authorization header. What the documentation does not say, is that if you specify a Source element, then , the policy does not look for or strip a Bearer prefix. Therefore when you specify

  <Source>request.header.Authorization</Source>

…the policy will try to parse the entire value in the Authorization header as a token. If you supply a Bearer prefix, that parse will fail.

I suspect that is the problem.

I’ll get the documentation updated to state this clearly.

3

Thanks for the answer @dchiesa1 . I can confirm your suggestion worked.