feat(jwt-auth): support configuring key_claim_name

apisix/plugins/jwt-auth.lua

@@ -50,6 +50,10 @@ local schema = {
         hide_credentials = {
             type = "boolean",
             default = false
+        },
+        key_claim_name = {
+            type = "string",
+            default = "key"
         }
     },
 }
@@ -247,9 +251,9 @@ local function get_rsa_or_ecdsa_keypair(conf)
 end
 
 
-local function get_real_payload(key, auth_conf, payload)
+local function get_real_payload(key, auth_conf, payload, key_claim_name)
     local real_payload = {
-        key = key,
+        [key_claim_name] = key,
         exp = ngx_time() + auth_conf.exp
     }
     if payload then
@@ -261,7 +265,7 @@ local function get_real_payload(key, auth_conf, payload)
 end
 
 
-local function sign_jwt_with_HS(key, consumer, payload)
+local function sign_jwt_with_HS(key, consumer, payload, key_claim_name)
     local auth_secret, err = get_secret(consumer.auth_conf)
     if not auth_secret then
         core.log.error("failed to sign jwt, err: ", err)
@@ -274,7 +278,7 @@ local function sign_jwt_with_HS(key, consumer, payload)
                 typ = "JWT",
                 alg = consumer.auth_conf.algorithm
             },
-            payload = get_real_payload(key, consumer.auth_conf, payload)
+            payload = get_real_payload(key, consumer.auth_conf, payload, key_claim_name)
         }
     )
     if not ok then
@@ -285,7 +289,7 @@ local function sign_jwt_with_HS(key, consumer, payload)
 end
 
 
-local function sign_jwt_with_RS256_ES256(key, consumer, payload)
+local function sign_jwt_with_RS256_ES256(key, consumer, payload, key_claim_name)
     local public_key, private_key, err = get_rsa_or_ecdsa_keypair(
         consumer.auth_conf
     )
@@ -304,7 +308,7 @@ local function sign_jwt_with_RS256_ES256(key, consumer, payload)
                     public_key,
                 }
             },
-            payload = get_real_payload(key, consumer.auth_conf, payload)
+            payload = get_real_payload(key, consumer.auth_conf, payload, key_claim_name)
         }
     )
     if not ok then
@@ -348,9 +352,10 @@ function _M.rewrite(conf, ctx)
         return 401, {message = "JWT token invalid"}
     end
 
-    local user_key = jwt_obj.payload and jwt_obj.payload.key
+    local key_claim_name = conf.key_claim_name
+    local user_key = jwt_obj.payload and jwt_obj.payload[key_claim_name]
     if not user_key then
-        return 401, {message = "missing user key in JWT token"}
+        return 401, {message = "missing " .. key_claim_name .. " claim in JWT token"}
     end
 
     local consumer_conf = consumer_mod.plugin(plugin_name)
@@ -395,6 +400,8 @@ local function gen_token()
 
     local key = args.key
     local payload = args.payload
+    local key_claim_name = args.key_claim_name or "key"
+
     if payload then
         payload = ngx.unescape_uri(payload)
     end
@@ -415,7 +422,7 @@ local function gen_token()
     core.log.info("consumer: ", core.json.delay_encode(consumer))
 
     local sign_handler = algorithm_handler(consumer, true)
-    local jwt_token = sign_handler(key, consumer, payload)
+    local jwt_token = sign_handler(key, consumer, payload, key_claim_name)
     if jwt_token then
         return core.response.exit(200, jwt_token)
     end

docs/en/latest/plugins/jwt-auth.md

@@ -58,7 +58,8 @@ For Route:
 | header | string | False    | authorization | The header to get the token from.                                   |
 | query  | string | False    | jwt           | The query string to get the token from. Lower priority than header. |
 | cookie | string | False    | jwt           | The cookie to get the token from. Lower priority than query.        |
-| hide_credentials | boolean | False     | false  | Set to true will not pass the authorization request of header\query\cookie to the Upstream.|
+| hide_credentials | boolean | False     | false  | Set to true will not pass the authorization request of header\query\cookie to the Upstream. |
+| key_claim_name | string | False     | key  | The name of the JWT claim that contains the user key (corresponds to Consumer's key attribute). |
 
 You can implement `jwt-auth` with [HashiCorp Vault](https://www.vaultproject.io/) to store and fetch secrets and RSA keys pairs from its [encrypted KV engine](https://developer.hashicorp.com/vault/docs/secrets/kv) using the [APISIX Secret](../terminology/secret.md) resource.
 

t/plugin/jwt-auth4.t

@@ -120,3 +120,100 @@ __DATA__
     }
 --- response_body
 safe-jws
+
+
+
+=== TEST 2: enable jwt auth plugin (with custom key_claim_name) using admin api
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/4',
+                ngx.HTTP_PUT,
+                [[{
+                    "plugins": {
+                        "jwt-auth": {
+                            "key": "custom-user-key",
+                            "secret": "custom-secret-key",
+                            "key_claim_name": "iss"
+                        }
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/hello"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+                ngx.say(body)
+                return
+            end
+
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 3: verify that key_claim_name can be used to validate the Consumer JWT
+with a different claim than 'key'
+--- config
+    location /t {
+        content_by_lua_block {
+            local core = require("apisix.core")
+            local t = require("lib.test_admin").test
+
+            -- prepare consumer with a custom key claim name
+            local csm_code, csm_body = t('/apisix/admin/consumers',
+                ngx.HTTP_PUT,
+                [[{
+                    "username": "mike",
+                    "plugins": {
+                        "jwt-auth": {
+                            "key": "custom-user-key",
+                            "secret": "custom-secret-key"
+                        }
+                    }
+                }]]
+            )
+
+            if csm_code >= 300 then
+                ngx.status = csm_code
+                ngx.say(csm_body)
+                return
+            end
+
+            -- generate JWT with custom key ("key_claim_name" = "iss")
+            local sign_code, sign_body, token = t('/apisix/plugin/jwt/sign?key=custom-user-key&key_claim_name=iss',
+                ngx.HTTP_GET
+            )
+
+            if sign_code > 200 then
+                ngx.status = sign_code
+                ngx.say(sign_body)
+                return
+            end
+
+            -- verify JWT using the custom key_claim_name
+            local ver_code, ver_body = t('/hello?jwt=' .. token,
+                ngx.HTTP_GET
+            )
+
+            if ver_code > 200 then
+                ngx.status = ver_code
+                ngx.say(ver_body)
+                return
+            end
+
+            ngx.say("verified-jwt")
+        }
+    }
+--- response_body
+verified-jwt