API GatewayでのOIDCトークン検証 — Istio、Envoy、Gateway API実践

            [エッジ: 一次検証 - 署名/iss/exp/aud]
  Client ──> API Gateway (Envoy jwt_authn) ──┐
                                             │ mTLS (サービスの身元)
                                             v
                              [サービス: 二次検証 + 細粒度の認可]
                              Service A (sidecar RequestAuthentication)
                                             │ トークンrelay or exchange
                                             v
                              Service B (sidecar + AuthorizationPolicy)

http_filters:
  - name: envoy.filters.http.jwt_authn
    typed_config:
      '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
      providers:
        keycloak_provider:
          issuer: https://keycloak.example.com/realms/prod
          audiences:
            - orders-api
          remote_jwks:
            http_uri:
              uri: https://keycloak.example.com/realms/prod/protocol/openid-connect/certs
              cluster: keycloak_jwks_cluster
              timeout: 3s
            cache_duration: 600s
            async_fetch:
              fast_listener: false
            retry_policy:
              num_retries: 3
          # Authorization: Bearer ヘッダーから抽出(デフォルト)
          from_headers:
            - name: Authorization
              value_prefix: 'Bearer '
          # 検証済みペイロードをメタデータに格納し後続フィルター(RBACなど)が利用
          payload_in_metadata: jwt_payload
          # 検証後、アップストリームへ平文クレームヘッダーとして転送
          claim_to_headers:
            - header_name: x-jwt-sub
              claim_name: sub
            - header_name: x-jwt-scope
              claim_name: scope
          # 元のトークンをアップストリームへ残すか除去するか
          forward: true
          # exp検証のクロックスキュー許容
          clock_skew_seconds: 30
      rules:
        # ヘルスチェックはトークン不要
        - match:
            prefix: /healthz
        # 公開ドキュメントはトークンがあれば検証、なくても通過
        - match:
            prefix: /docs
          requires:
            requires_any:
              requirements:
                - provider_name: keycloak_provider
                - allow_missing: {}
        # それ以外はすべて必須
        - match:
            prefix: /
          requires:
            provider_name: keycloak_provider

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: ingress-jwt
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
    - issuer: https://keycloak.example.com/realms/prod
      jwksUri: https://keycloak.example.com/realms/prod/protocol/openid-connect/certs
      audiences:
        - api-gateway
      forwardOriginalToken: true
      outputClaimToHeaders:
        - header: x-jwt-sub
          claim: sub
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: ingress-require-jwt
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  action: DENY
  rules:
    - from:
        - source:
            notRequestPrincipals: ['*']
      to:
        - operation:
            notPaths: ['/healthz', '/metrics']

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: orders-jwt
  namespace: orders
spec:
  selector:
    matchLabels:
      app: orders
  jwtRules:
    - issuer: https://keycloak.example.com/realms/prod
      jwksUri: https://keycloak.example.com/realms/prod/protocol/openid-connect/certs
      audiences:
        - orders-api
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: orders-authz
  namespace: orders
spec:
  selector:
    matchLabels:
      app: orders
  action: ALLOW
  rules:
    # 読み取り: 認証済み主体なら許可
    - from:
        - source:
            requestPrincipals: ['https://keycloak.example.com/realms/prod/*']
      to:
        - operation:
            methods: ['GET']
            paths: ['/orders', '/orders/*']
    # 書き込み: orders:writeスコープを要求
    - from:
        - source:
            requestPrincipals: ['https://keycloak.example.com/realms/prod/*']
      to:
        - operation:
            methods: ['POST', 'PUT', 'DELETE']
            paths: ['/orders', '/orders/*']
      when:
        - key: request.auth.claims[scope]
          values: ['*orders:write*']

Client --(JWT aud=api)--> Gateway --(同じJWT)--> Service A --(同じJWT)--> Service B

curl -s -X POST https://keycloak.example.com/realms/prod/protocol/openid-connect/token \
  -d grant_type=urn:ietf:params:oauth:grant-type:token-exchange \
  -d client_id=service-a \
  -d client_secret=SERVICE_A_SECRET \
  -d subject_token=ORIGINAL_USER_ACCESS_TOKEN \
  -d subject_token_type=urn:ietf:params:oauth:token-type:access_token \
  -d audience=service-b

{
  "iss": "https://keycloak.example.com/realms/prod",
  "sub": "user-1234",
  "aud": "service-b",
  "scope": "orders:read",
  "act": {
    "sub": "service-account-service-a"
  },
  "exp": 1781234567
}

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: orders-route
  namespace: apps
spec:
  http:
    - name: orders
      match:
        hosts:
          - api.example.com
        paths:
          - /orders/*
      backends:
        - serviceName: orders
          servicePort: 8080
      plugins:
        - name: openid-connect
          enable: true
          config:
            discovery: https://keycloak.example.com/realms/prod/.well-known/openid-configuration
            client_id: apisix-gateway
            client_secret: GATEWAY_CLIENT_SECRET
            bearer_only: true
            use_jwks: true
            token_signing_alg_values_expected: RS256
            audience: orders-api

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: orders-jwt
  namespace: apps
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: orders-route
  jwt:
    providers:
      - name: keycloak
        issuer: https://keycloak.example.com/realms/prod
        audiences:
          - orders-api
        remoteJWKS:
          uri: https://keycloak.example.com/realms/prod/protocol/openid-connect/certs
        claimToHeaders:
          - claim: sub
            header: x-jwt-sub

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: orders
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: orders-payment-call
  namespace: payments
spec:
  selector:
    matchLabels:
      app: payments
  action: ALLOW
  rules:
    - from:
        - source:
            # 呼び出し元ワークロードを制限(mTLSベースのサービス身元)
            principals: ['cluster.local/ns/orders/sa/orders-sa']
            # 最終ユーザーのトークンも併せて要求
            requestPrincipals: ['https://keycloak.example.com/realms/prod/*']
      to:
        - operation:
            methods: ['POST']
            paths: ['/payments']
      when:
        - key: request.auth.claims[scope]
          values: ['*payments:write*']

                         +--------------------------+
                         | 401が発生                 |
                         +-----------+--------------+
                                     |
                  トークンはリクエストに載っているか?(ヘッダー確認)
                                     |
              +----------- いいえ ---+--- はい ----------+
              |                                          |
   クライアント/プロキシがAuthorization      トークンをデコードして観察(検証ではない)
   ヘッダーを欠落/除去?(プロキシチェーン点検)            |
                                     +------------------+------------------+
                                     |                  |                  |
                               issは設定と         expは過ぎているか?  audは設定と
                               完全一致?           (クロックスキュー含む) 一致するか?
                                     |                  |                  |
                              不一致: trailing      期限切れ: 更新     不一致: audience
                              slash、http/https、   ロジック点検、     マッピングの再設計
                              realmパスを確認       NTP確認
                                     |
                         すべて正常なら → 鍵検証の段階を疑う
                                     |
                  +------------------+-------------------+
                  |                                      |
        トークンヘッダーのkidはJWKSに          ゲートウェイはJWKSを
        存在するか?(curlでJWKS確認)            取得できているか?
                  |                                      |
        ない: 鍵ローテーション直後の          fetch失敗: クラスター定義、
        キャッシュ問題 → キャッシュTTL/       DNS、egressポリシー、TLS
        ローテーション猶予ポリシー点検        信頼チェーンを点検
                  |
        すべて正常なのに401 → RequestAuthenticationは通過し
        AuthorizationPolicyで拒否(403の可能性も)されていないか、
        ルールマッチング(パス/メソッド/スコープ)を点検

# 1) トークンのペイロード確認(署名検証なしのデコード)
TOKEN=eyJhbGciOi...
echo "$TOKEN" | cut -d. -f2 | tr '_-' '/+' | base64 -d 2>/dev/null | jq .

# 2) JWKSを直接照会 — kid一覧を確認
curl -s https://keycloak.example.com/realms/prod/protocol/openid-connect/certs | jq '.keys[].kid'

# 3) Istioの設定がEnvoyに反映されたか確認
istioctl proxy-config listener deploy/istio-ingressgateway -n istio-system -o json \
  | jq '.. | select(.name? == "envoy.filters.http.jwt_authn")'

# 4) Envoyのアクセスログで拒否理由フラグを確認
kubectl logs deploy/istio-ingressgateway -n istio-system | grep -E '401|403' | tail -5

# 5) jwt_authn統計でどの段階で弾かれているか確認
kubectl exec deploy/istio-ingressgateway -n istio-system -- \
  pilot-agent request GET stats | grep -E 'jwt_authn|jwks'