08-jwt-wrong-issuer

Credentials from an untrusted source

Wrong JWT issuer

JWT iss claim doesn't match the issuer the gateway's credential check expects.

jwtdenyissuer

FIXTURE

tenant_id"acme-turkiye"

home_region"tst"

scopes

ai.chat.write

iss"http://attacker.example.com/issuer"

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME

HTTP STATUS401

POLICY ENGINE NOT CONSULTEDREJECTED AT THE GATEWAY BEFORE POLICY EVALUATION

What this demonstrates

The request's identity was issued by an authority the organization doesn't trust. Only pre-agreed identity providers are accepted.

Identity & access management

RUNNER

Mints a JWT, sends the request through the live gateway, and compares the response against the expected outcome.

Requires the PolicyGate stack reachable on host ports 10000 / 8181.

WHY THIS MATTERS

Proves issuer binding — a JWT signed by an unauthorized IdP is rejected.