Pomerium: Identity verification failed. No attestation JWT!

[karlbateman]

What happened?

First let me start by saying, this is a great project. Kudos for making such a feature rich IAP!

I've been using the [NGINX] recipe which I've configured with [Google] and [Auth0] IdP's. I have everything running fine locally without issue but I'm not seeing the signed identity token information. Because this is not included, I'm unable to assert a users identity details programmatically.

I'm guessing this is because the signing_key isn't set in the Pomerium configuration YAML file. It's not clear from the documentation how to explicitly set this value, or what should be Base64 encoded.

This isn't really a bug, more a request for clarity on the process of getting/asserting user details.

What did you expect to happen?

After signing in, the users identity details should be displayed.

How'd it happen?

Follow the [NGINX] recipe adding [Google] and [Auth0] IdP configuration details.

What's your environment like?

Using the master branch within the examples/nginx with the configuration below and docker-compose up.

What's your config.yaml?

This configuration was updated to include settings for [Auth0] IdP.

```config.yaml

Main configuration flags : https://www.pomerium.io/docs/reference/reference/

pomerium_debug: true
address: :80
cookie_secret: YVFTMIfW8yBJw+a6sYwdW8rHbU+IAAV/SUkCTg9Jtpo=
shared_secret: 80ldlrU2d7w+wVpKNfevk6fmb8otEx6CqOfshj2LwhQ=

idp_provider: auth0
idp_provider_url: "REDACTED"
idp_client_id: "REDACTED"
idp_client_secret: "REDACTED"
idp_service_account: "REDACTED"

insecure_server: true
forward_auth_url: http://fwdauth.localhost.pomerium.io
authenticate_service_url: https://authenticate.localhost.pomerium.io

policy:

• from: https://verify.localhost.pomerium.io
  to: https://httpbin
  allowed_domains:
  
  
  
  • krb.dev
    
    pass_identity_headers: true
    
    ```
  
  

[desimone]

Thanks for your kind words @karlbateman !

I'm guessing this is because the signing_key isn't set in the Pomerium configuration YAML file. It's not clear from the documentation how to explicitly set this value, or what should be Base64 encoded.

If you are running in all in one mode, a signing_key will be automatically generated on each restart.

It is a base64 encoded string. See the reference docs and the getting a user identity guide.

How'd it happen?

Follow the NGINX recipe adding Google and Auth0 IdP configuration details.

What's your environment like?

Using the master branch within the examples/nginx with the configuration below and docker-compose up.

The assertion header is not being sent to the upstream because Pomerium is being used as an external authorization provider for nginx (e.g. sometimes called forward-auth). That is to say, the request is coming to nginx. nginx is asking pomerium if the request is valid, but the assertion header which is typically added in flight as a _request_ header is not then being added by nginx to the upstream request.

This should be possible via the ngx_http_auth_request_module module using auth_request_set but it's been a while since I modified the nginx configurations directly.

Hope that helps!

[karlbateman]

Thanks for getting back to me @desimone, I've got the X-Pomerium-Jwt-Assertion coming through now. I've modified the verify.conf location / {} block to include the following:

location / {
    proxy_pass http://verify;

    include /etc/nginx/proxy.conf;

    # If we get a 401, respond with a named location
    error_page 401 = @authredirect;

    # this location requires authentication
    auth_request /ext_authz;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # pass JWT assertion upstream
    auth_request_set $auth_resp_x_pomerium_jwt_assertion $upstream_http_x_pomerium_jwt_assertion;
    proxy_set_header x-pomerium-jwt-assertion $auth_resp_x_pomerium_jwt_assertion;
}

Now the error has changed I'm seeing the following on https://verify.localhost.pomerium.io/.

We tried to verify the incoming user, but failed with the following error:
  couldn't get json web key: 
    Get "https://authenticate.localhost.pomerium.io/.well-known/pomerium/jwks.json":
      dial tcp 0.0.0.0:443: connect: connection refused

When I hit that URL to retrieve the jwks.json, I see the following:

~ ➜ curl --silent https://authenticate.localhost.pomerium.io/.well-known/pomerium/jwks.json | jq
{
  "keys": null
}

Is the point in which I need to provide the base64 encoded signing certificate from Auth0? If so, what is the suggested process?

As this may be pivoting toward another issue, let me know if you'd like me to close this and open another 😄

[pingssgp]

@karlbateman this may be relevant. I'm trying to set up a simple local development environment with a local OIDC IDP, following the instructions here : https://www.pomerium.io/guides/local-oidc.html

I am facing the same issue as in your last post. The user is able to authenticate with the IDP. However, the next step fails as you describe. The verify service says it's unable to connect:

couldn't get json web key: Get 
"https://authenticate.localhost.pomerium.io/.well-known/pomerium/jwks.json":
 dial tcp 127.0.0.1:443: connect: connection refused

Manually downloading the jwks.json file from the authenticate service gives me this:

$ wget https://authenticate.localhost.pomerium.io:443/.well-known/pomerium/jwks.json --no-check-certificate
--2021-04-14 10:18:09--  https://authenticate.localhost.pomerium.io/.well-known/pomerium/jwks.json
Resolving authenticate.localhost.pomerium.io (authenticate.localhost.pomerium.io)... 127.0.0.1
Connecting to authenticate.localhost.pomerium.io (authenticate.localhost.pomerium.io)|127.0.0.1|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 14 [application/json]
Saving to: ‘jwks.json’

jwks.json 100%[======>]      14  --.-KB/s    in 0s      

2021-04-14 10:18:09 (9.63 MB/s) - ‘jwks.json’ saved [14/14]

$ cat jwks.json 
{"keys":null}

However, I can follow the example in this ticket (https://github.com/pomerium/pomerium/issues/1042) and get the JWT in the X-Pomerium-Jwt-Assertion header every time. The pomerium service itself is unchanged. All I did was run the httpbin service instead of the verify service. This makes me think that the AuthZ service itself is working, but there's something wrong with the plumbing with the Pomerium verify service from the pomerium/verify docker image.