i have the following in my cerbos config map. this...
# helpj
Jesum Yip
01/16/2023, 5:11 AMi have the following in my cerbos config map. this means JWT verification is disabled.
Jesum Yip
01/16/2023, 5:12 AMdoesn't seem to work because when i call the cerbos api, i get this
{"code":3, "message":"failed to extract auxData"}Jesum Yip
01/16/2023, 5:12 AMin the pod's logs i can see:
Jesum Yip
01/16/2023, 5:12 AMcannot determine keyset to use for validating the JWTJesum Yip
01/16/2023, 5:13 AMi don't need jwt validation because that's already handled by my API gateway
Jesum Yip
01/16/2023, 5:13 AMbtw i'm on cerbos
v0.24d
Dennis (Cerbos)
01/16/2023, 5:16 AM
If verification is disabled, the signature isn’t cryptographically verified, but Cerbos always checks if the token is not expired.
j
Jesum Yip
01/16/2023, 5:17 AMmessage has been deleted
Jesum Yip
01/16/2023, 5:17 AMthe token is definitely not expired
d
Dennis (Cerbos)
01/16/2023, 5:19 AM
Sorry, I missed the error message “cannot determine keyset to use for validating the JWT”
j
Jesum Yip
01/16/2023, 5:20 AMi expect cerbos to completely ignore verification, which means the issue of keysets do not even come up.
Jesum Yip
01/16/2023, 5:20 AMexpJesum Yip
01/16/2023, 5:22 AMis my
configMapJesum Yip
01/16/2023, 5:23 AMlike this instead
d
Dennis (Cerbos)
01/16/2023, 5:24 AM
Looks good to me. Let me think for a minute.
j
Jesum Yip
01/16/2023, 5:25 AMalso, changing configmap doesn't cause cerbos deployment to restart. i have to restart it manually.
Jesum Yip
01/16/2023, 5:26 AMyes that did the trick @Dennis (Cerbos). my
configMap👍 1
Jesum Yip
01/16/2023, 5:28 AMone last thing
Jesum Yip
01/16/2023, 5:28 AMhow do i disable the generation of this?
d
Dennis (Cerbos)
01/16/2023, 5:32 AM
Do you mean the schema? I think it is embedded in the Cerbos binary.
j
Jesum Yip
01/16/2023, 5:32 AMyes the schema web page
Jesum Yip
01/16/2023, 5:33 AMdoes it redirect to some url path ? i have istio in place and i can block that
d
Dennis (Cerbos)
01/16/2023, 5:36 AM
I don’t think we have a setting to turn this off.
Let me look for a way to work around this.
May I ask why do you want to disable this page?
j
Jesum Yip
01/16/2023, 5:36 AMfor security purposes
Jesum Yip
01/16/2023, 5:36 AMcerbos is exposed on the internet
Jesum Yip
01/16/2023, 5:36 AMi do not want people guessing and knowing that it's cerbos running behind that IP address
Jesum Yip
01/16/2023, 5:37 AMit's a minor issue, really, but would be nice if i could disable it.
Jesum Yip
01/16/2023, 5:37 AMnot a very high priority ask.
d
Dennis (Cerbos)
01/16/2023, 5:39 AM
I see. Thanks for taking the time to explain it.
j
Jesum Yip
01/16/2023, 5:42 AMi know how to block it with istio.
Jesum Yip
01/16/2023, 5:42 AMthat schema page is generated when you visit cerbos at the
/👍 1
8 Views