Yes, this is something that we needed. Here's an example:

http_filters:
  - name: envoy.filters.http.jwt_authn
    config:
      providers:
        default_provider:
          payload_in_metadata: "payload"
          issuer: https://example.com
          local_jwks:
            # JWKS goes here (truncated for readability)
            inline_string: |
              { "keys": [ … ] }
      rules:
        - match:
            prefix: "/"
          requires:
            provider_name: "default_provider"

  - name: envoy.filters.http.rbac
    config:
      rules:
        action: ALLOW
        policies:
          "any":
            principals:
              - any: true
            permissions:
              - not_rule:
                  header: { name: ":path", regex_match: "/admin(/.*)?" }
          "admin":
            principals:
              - metadata:
                  filter: envoy.filters.http.jwt_authn
                  path:
                    - key: payload
                    - key: role
                  value:
                    string_match:
                      exact: admin
            permissions:
              - any: true

  - name: envoy.router
    config: {}

These are the docs you'll want to review:

This comment describes how payload_in_metadata works:

envoy/api/envoy/config/filter/http/jwt_authn/v2alpha/config.proto

Lines 170 to 186 in cb15cc3

    
           // If non empty, successfully verified JWT payloads will be written to StreamInfo DynamicMetadata 
        
           // in the format as: *namespace* is the jwt_authn filter name as **envoy.filters.http.jwt_authn** 
        
           // The value is the *protobuf::Struct*. The value of this field will be the key for its *fields* 
        
           // and the value is the *protobuf::Struct* converted from JWT JSON payload. 
        
           // 
        
           // For example, if payload_in_metadata is *my_payload*: 
        
           // 
        
           // .. code-block:: yaml 
        
           // 
        
           //   envoy.filters.http.jwt_authn: 
        
           //     my_payload: 
        
           //       iss: https://example.com 
        
           //       sub: test@example.com 
        
           //       aud: https://example.com 
        
           //       exp: 1501281058 
        
           // 
        
           string payload_in_metadata = 9;

FWIW, this is the PR that introduced the metadata for the jwt_authn filter: #4707

Lemme know if you have any trouble.

	// If non empty, successfully verified JWT payloads will be written to StreamInfo DynamicMetadata
	// in the format as: namespace is the jwt_authn filter name as envoy.filters.http.jwt_authn
	// The value is the protobuf::Struct. The value of this field will be the key for its fields
	// and the value is the protobuf::Struct converted from JWT JSON payload.
	//
	// For example, if payload_in_metadata is my_payload:
	//
	// .. code-block:: yaml
	//
	// envoy.filters.http.jwt_authn:
	// my_payload:
	// iss: https://example.com
	// sub: test@example.com
	// aud: https://example.com
	// exp: 1501281058
	//
	string payload_in_metadata = 9;

Question. RBAC on jwt token #7913

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions