JWTAuth

JWTAuth validates Bearer JSON Web Tokens using JWKS, an OIDC issuer, or a static public key, and produces a principal on success.

JWTAuth is defined in the policy schema but is not executed by the policy engine yet.

Fields

jwks_uri

string

URL of the JWKS endpoint for token verification.

oidc_issuer

string

OIDC issuer URL. Frontline discovers the JWKS URI from the issuer’s .well-known/openid-configuration.

public_key_pem

bytes

PEM-encoded public key for token verification. Use this for static key pairs.

issuer

string

Required iss claim value.

audiences

string[]

Allowed aud claim values.

algorithms

string[]

Allowed signing algorithms.

subject_claim

string

Claim used as the principal subject. Defaults to sub.

allow_anonymous

bool

When true, requests without a token are allowed through without setting a principal.

clock_skew_ms

int64

Tolerance for time-based claim validation (exp, nbf, iat), in milliseconds.

jwks_cache_ms

int64

How long to cache the JWKS response, in milliseconds.

Examples

OIDC issuer
JWKS URI
Optional auth

{
  "policies": [
    {
      "id": "jwt-auth",
      "name": "Validate JWTs via OIDC",
      "enabled": true,
      "match": [],
      "jwtauth": {
        "oidc_issuer": "https://auth.example.com",
        "audiences": ["api.example.com"],
        "algorithms": ["RS256"]
      }
    }
  ]
}

{
  "policies": [
    {
      "id": "jwt-auth",
      "name": "Validate JWTs via JWKS",
      "enabled": true,
      "match": [],
      "jwtauth": {
        "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
        "issuer": "https://auth.example.com",
        "audiences": ["api.example.com"],
        "algorithms": ["RS256"],
        "jwks_cache_ms": 3600000
      }
    }
  ]
}

{
  "policies": [
    {
      "id": "jwt-auth-optional",
      "name": "Optional JWT auth",
      "enabled": true,
      "match": [],
      "jwtauth": {
        "oidc_issuer": "https://auth.example.com",
        "audiences": ["api.example.com"],
        "allow_anonymous": true
      }
    }
  ]
}

Requests without a token pass through without a Principal. Requests with an invalid token are rejected.

Overview

Services

RFCs

Fields

Examples

​Fields

​Examples

Fields

Examples