Title
j
Jesum Yip
01/16/2023, 5:11 AMi have the following in my cerbos config map. this means JWT verification is disabled.
doesn't seem to work because when i call the cerbos api, i get this
{"code":3, "message":"failed to extract auxData"}in the pod's logs i can see:
cannot determine keyset to use for validating the JWTi don't need jwt validation because that's already handled by my API gateway
btw i'm on cerbos
v0.24d
Dennis (Cerbos)
01/16/2023, 5:16 AMIf verification is disabled, the signature isn’t cryptographically verified, but Cerbos always checks if the token is not expired.
j
Jesum Yip
01/16/2023, 5:17 AMimage.png
the token is definitely not expired
d
Dennis (Cerbos)
01/16/2023, 5:19 AMSorry, I missed the error message “cannot determine keyset to use for validating the JWT”
j
Jesum Yip
01/16/2023, 5:20 AMi expect cerbos to completely ignore verification, which means the issue of keysets do not even come up.
expis my
configMaplike this instead
d
Dennis (Cerbos)
01/16/2023, 5:24 AMLooks good to me. Let me think for a minute.
j
Jesum Yip
01/16/2023, 5:25 AMalso, changing configmap doesn't cause cerbos deployment to restart. i have to restart it manually.
yes that did the trick @Dennis (Cerbos). my
configMapone last thing
how do i disable the generation of this?
d
Dennis (Cerbos)
01/16/2023, 5:32 AMDo you mean the schema? I think it is embedded in the Cerbos binary.
j
Jesum Yip
01/16/2023, 5:32 AMyes the schema web page
does it redirect to some url path ? i have istio in place and i can block that
d
Dennis (Cerbos)
01/16/2023, 5:36 AMI don’t think we have a setting to turn this off.
Let me look for a way to work around this.
May I ask why do you want to disable this page?
j
Jesum Yip
01/16/2023, 5:36 AMfor security purposes
cerbos is exposed on the internet
i do not want people guessing and knowing that it's cerbos running behind that IP address
it's a minor issue, really, but would be nice if i could disable it.
not a very high priority ask.
d
Dennis (Cerbos)
01/16/2023, 5:39 AMI see. Thanks for taking the time to explain it.
j
Jesum Yip
01/16/2023, 5:42 AMi know how to block it with istio.
that schema page is generated when you visit cerbos at the
/