Valid JWT rejected with BAD_FORMAT about esp

[qiwzhang]

Thanks. @tazjin We will use this to update our doc. Hi @liminw Could you help to fix this?

[tazjin]

I've tried some more debugging by changing values in the JWT manually (hoping to proceed to a time or signature error).

This is in fact caused by nbf = 0, which should be a valid value (epoch 0 is most definitely in the past!)

[qiwzhang]

@liminw @lizan Since ESP is using gRPC library for JWT checking. This could be an issue in the gRPC code. Could you confirm it?

[liminw]

The check is indeed in gRPC. @tazjin has done a great job debugging to find out the cause.

This is expected behavior. That is, the claims, "exp", "iat", "nbf", if provided, must contain valid values, which is the number of seconds since Epoch.

[qiwzhang]

nbf = 0 is not supported. @tazjin should I close the issue?

[tazjin]

@qiwzhang That is up to you. We will be able to find an alternative to using Endpoints, but you may want to consider documenting this.

It's unclear from @liminw's response what the chosen "cutoff time" for nbf values is - can they not be in the past at all? Can they be 1 hour, 1 week ago? 10 years ago?

Whatever you chose, this discrepancy from the spec (which does not constrain the set of valid values) should be documented on this page.

[lizan]

I feel the nbf = 0 should pass the check. @tazjin is the JWT signed by services yourself or some common 3rd party issuer?

…

On Fri, Nov 10, 2017 at 2:17 PM, Wayne Zhang ***@***.***> wrote: Thanks. @tazjin <https://github.com/tazjin> We will use this to update our doc. Hi @liminw <https://github.com/liminw> Could you help to fix this? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#308 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA-A75FOWAglJ-Hysk4VcX346oPGN8ADks5s1MuPgaJpZM4QZs0F> .

[tazjin]

@lizan The JWT is signed by our Keycloak instance.

[liminw]

If I read it correctly, from grpc code, it seems that 0 is considered the error code returned from validate_time_field().

[liminw]

We will document it on this page that the values for "iat", "nbf", "exp" must be numbers that are greater than 0.

[lizan]

Thanks @tazjin , how easy to configure Keycloak to omit nbf or have certain nbf != 0?

@liminw yes the code reading is correct, but I don't think it is intentional, is it?

[liminw]

The documentation here is fixed to say that "iat", "nbf", "exp" must be numbers greater than 0.

[naturalbeau]

I also experienced the same issue when try to use keycloak as third party authentication server. So what is the solution to fix this problem? @tazjin

[tazjin]

@naturalbeau We ended up writing our own authentication service, which has been humming along fine for over a year now - Keycloak is nice if your use-case falls exactly into what it supports, otherwise bending it to do what you want is a task in itself :)