07-jwt-wrong-audience

Credential used in the wrong place

Wrong JWT audience

JWT signed for a different audience than the edge expects. jwt_authn returns HTTP 403 (RFC 6750 insufficient_scope) since the token authenticates valid but lacks the right audience claim for this resource. Distinct from 401 returned for expired or missing tokens.

jwtdenyaudience

FIXTURE

tenant_id"acme-turkiye"

home_region"tst"

scopes

ai.chat.write

aud"internal-admin"

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME

HTTP STATUS403

BYPASSES OPAREJECTED BEFORE EXT_AUTHZ — OPA NOT CONSULTED

What this demonstrates

Valid credentials for one system are replayed against another. Catching audience mismatch stops cross-service token reuse.

Identity & access management

RUNNER

Execute scenario

Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.

Requires the PolicyGate stack reachable on host ports 10000 / 8181.

WHY THIS MATTERS

Proves audience binding is enforced — a token issued for a different service can't be replayed against this edge.