07-jwt-wrong-audience

Credential used in the wrong place

Wrong JWT audience

JWT signed for a different audience than the edge expects. The credential check returns HTTP 403 (RFC 6750 insufficient_scope) since the token authenticates valid but lacks the right audience claim for this resource. Distinct from 401 returned for expired or missing tokens.

jwtdenyaudience

FIXTURE

tenant_id"acme-turkiye"

home_region"tst"

scopes

ai.chat.write

aud"internal-admin"

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME

HTTP STATUS403

POLICY ENGINE NOT CONSULTEDREJECTED AT THE GATEWAY BEFORE POLICY EVALUATION

What this demonstrates

Valid credentials for one system are replayed against another. Catching audience mismatch stops cross-service token reuse.

Identity & access management

RUNNER

Execute scenario

Mints a JWT, sends the request through the live gateway, and compares the response against the expected outcome.

Requires the PolicyGate stack reachable on host ports 10000 / 8181.

WHY THIS MATTERS

Proves audience binding is enforced — a token issued for a different service can't be replayed against this edge.