JWT authentication component-Server Load Balancer(SLB)-阿里云帮助中心

The JWT authentication component implements authentication and authorization based on JSON Web Tokens (JWT). It supports parsing JWTs from HTTP request URL parameters, request headers, or cookies, and validates the token's permission to access the resource.

Feature type

Authentication and authorization

Field description

ComponentConfig

Parameter	Type	Required	Default value	Description
Config	JwtSpec	Yes	-	JWT authentication configuration.

JwtSpec

Parameter	Type	Required	Default value	Description
JwkConfig	JwkConfigSpec	Yes	-	Specifies how to configure JWK.
JwtSources	JwtSourcesSpec	Yes	-	Specifies how to extract the JWT. Only one extraction source is supported.

JwkConfigSpec

Parameter	Type	Required	Default value	Description
Type	JwkConfigType	No	-	JWK configuration type.
RemoteJwks	RemoteJwksSpec	No	-	Remote JWKS configuration.

JwkConfigType

Value	Description
Remote	Fetch JWK remotely.

RemoteJwksSpec

Parameter	Type	Required	Default value	Description
Url	URI	No	-	Remote JWK address.

URI

A complete FQDN that includes the protocol, hostname, and path. The ALB instance accesses this address using the IP of its vSwitch. Ensure the target address is reachable over the network. If the target address is on the public network, configure SNAT for the vSwitch where the ALB instance resides.

Example

http://example.com/jwt/pubkeys

The remote JWK response complies with RFC 7518. The following is an example of a return value:

{
    "keys": [
        {
            "e": "Exponent of the public key, such as AQAB",
            "kid": "Key ID",
            "kty": "Family of the encryption algorithm, such as RSA. Required and case-sensitive",
            "alg": "Specific encryption algorithm used, such as RS256. Required and case-sensitive",
            "use": "Intended use of the key, such as sig for signing",
            "n": "Modulus of the public key"
        },
        {
            "kty": "oct",
            "k": "yMsZ3vkBL4fEwJrNOPW6RztnYpdQ0UlVTum7H1qAehD",
            "alg": "HS256"
        }
    ]
}

JwtSourcesSpec

Parameter	Type	Required	Default value	Description
Headers	JwtHeaderSpec[]	No	-	Extract JWT from HTTP request headers.
Params	String[]	No	-	Extract JWT from URL parameters.
Cookies	String[]	No	-	Extract JWT from cookies.

JwtHeaderSpec

Parameter	Type	Required	Default value	Description
Name	String	Yes	Authorization	Field name in the request header.
ValuePrefix	String	No	Bearer	Prefix of the header value. This prefix is removed before extracting the token.

Error codes

HTTP status code	Error message	Reason
401	Jwt is missing	No JWT was provided in the request.
401	Jwks remote fetch is failed	Timeout occurred while accessing the remote JWKS endpoint.
401	Jwt verification fails	JWT payload validation failed.
401	Jwt is expired	The provided token has expired.
401	Jwt signature is an invalid Base64url encoded	The provided token cannot be decoded from Base64.