OPA is not working if I read jkws from AWS JWKS token signing keys

[surikalyani]

This policy will be available at /v1/data/api/allow

package api

import rego.v1

jwks_request(url) := http.send({
	"url": url,
	"method": "GET",
	"force_cache": true,
	"force_cache_duration_seconds": 3600, # seconds
	"timeout": 10 # seconds
})



token := {"valid": valid, "payload": payload} if {
	[_, encoded] := split(input.identitySource[0], " ")

  #get AWS JWKS token signing keys
  jwks_url := input.keys_url 
  jwks := jwks_request(jwks_url).body 

	[valid, _, payload] := io.jwt.decode_verify(
		encoded,
		{"cert": json.marshal(jwks)},
	)
}

default allow := false

allow if {
	token.valid
  not token_is_expired
}

token_is_expired if {    
    now := time.now_ns() / 1000000000  # current time in seconds
    token.payload.exp < now
}

This code does not work but if I hardcode jkws value it works

[charlieegan3]

Hi surikalyani and welcome to the community! I think what you're experiencing here is the http.send does not work in the playground. I think you'll find this should work locally.