08-jwt-wrong-issuer

Credentials from an untrusted source

Wrong JWT issuer

JWT iss claim doesn't match the issuer Envoy's jwt_authn expects.

jwtdenyissuer

FIXTURE

tenant_id"acme-turkiye"

home_region"tst"

scopes

ai.chat.write

iss"http://attacker.example.com/issuer"

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME

HTTP STATUS401

BYPASSES OPAREJECTED BEFORE EXT_AUTHZ — OPA NOT CONSULTED

What this demonstrates

The request's identity was issued by an authority the organization doesn't trust. Only pre-agreed identity providers are accepted.

Identity & access management

RUNNER

Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.

Requires the PolicyGate stack reachable on host ports 10000 / 8181.

WHY THIS MATTERS

Proves issuer binding — a JWT signed by an unauthorized IdP is rejected.