Konga: JWT konga not working

[amanasmuei]

Is there any example to run through with JWT konga? I have used the JWT plugin but failed to authenticate using postman.

Result from postman
{
"message": "Unauthorized"
}

[mikeurbanski1]

Have you tried setting values in the plugin config for the URI param or header names? It seems either Kong or Konga is not properly setting default values for plugins.

Try adding "Authorization" to the "header names" config for the plugin (or, add "jwt" to the "uri params" field).

(I had this same issue going through the Kong tutorial with the key-auth plugin, while making Kong changes using Konga, which is why I say it may be a Konga issue).

[pantsel]

@amanasmuei , what exactly are you trying to do?

Are you trying to make Konga connect to Kong with JWT authentication?

Have you tried creating a Kong admin API loopback service/route?

https://docs.konghq.com/1.3.x/secure-admin-api/#kong-api-loopback

After you do that:
1) add the JWT plugin to that service
2) Create a consumer and give him a JWT credential
3) Create a new connection to Kong (from the connections page) selecting the JWT tab. Use the url of your loopback service (localhost:8000/admin-api/apis) and type in the key and secret you got from assigning a JWT cred to your consumer
4) Save the connection
5) Activate it

[tiagojsag]

I just found an issue while configuring Kong + JWT using Konga, and this issue may or may not be relate (the author is not clear). Anyway, here are my steps to reproduce:

• setup kong 2.0.4
• setup konga 0.14.7
• open konga
• go to "plugin" on the left side menu
• Under "authentication", look for JWT and click "add plugin"
• On the popup window change nothing, scroll to the bottom and click "Add plugin"
• Follow the rest of the official kong docs on adding a service, a route, a consumer and generating a JWT token for it
• On Postman (or anything else really) craft a request that uses the "Authorization: Bearer XXX" header with the token you generated
• Send that request to kong and see it fail with 403 code and a body message saying "Unauthorized".

The underlying issue here is that, when saving the JWT plugin config, Konga sets a value for "config.header_names" - specifically, it sets an empty array, which overrides the default "['Authorization']" value that is set by Kong when no explicit value is passed to it by a client app. So, by no explicit action of the user, Konga is effectively modifying the default value of a field, leading to this issue.

The solution here may be tricky, as the UI needs to give the user the possibility to specify an empty array, as disabling support for the default header is a legitimate use case. I honestly don't have a proposed solution for this, as I think this is a design issue at its root, and I'm not a designer.

Last but not least: I've only been using konga for a few hours (most of them debugging this issue) but so far I'm really enjoying it, so kudos to the maintainers of the project!! you're doing great stuff here.