hasura / hasura/graphql-engine
Claims key not found error, even though it's there and listed in the JWT decoder
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: Docker image hasura/graphql-engine:v2.25.1.cli-migrations-v3
CLI Version (for CLI related issue):
### Environment
OSS
### What is the current behaviour?
When using JWT authentication I get a token validity error:
`claims key: 'https://hasura.io/jwt/claims' not found`
I'm using Ory Oathkeeper to generate JWTs.
Here is oathkeeper configuration for the claims:
```
claims: |
{
{{- $identity := .Extra.identity -}}
{{ if $identity -}}
"https://hasura.io/jwt/claims": {
"x-hasura-default-role": "user",
"x-hasura-allowed-roles": ["user"],
"x-hasura-user-id": "{{ $identity.id }}"
}
{{- end }}
}
```
Here is the decoded payload (directly from Hasura's own JWT decoder):
```
{
"exp": 1686229889,
"https://hasura.io/jwt/claims": {
"x-hasura-allowed-roles": [
"user"
],
"x-hasura-default-role": "user",
"x-hasura-user-id": "be65518b-aebd-46e7-803a-9ccfdc12f573"
},
"iat": 1686228989,
"iss": "http://localhost:5000/.ory/kratos/public",
"jti": "68ba3c37-f8f1-447f-94a2-583b613750a7",
"nbf": 1686228989,
"sub": "be65518b-aebd-46e7-803a-9ccfdc12f573"
}
```
Here is the thing that I'm finding the most frustrating... Hasura keeps saying it can't find the claims, but in the built-in JWT decoder, it actually lists the correct claims in the `HASURA CLAIMS:HASURA HEADERS` section!
Here is a sample JWT:
```
eyJhbGciOiJSUzI1NiIsImtpZCI6ImUzOTNkZDliLTZjNTQtNGViNy04NTM2LTFhNWY4NDQyZTg5NyIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2ODYyMjk4ODksImh0dHBzOi8vaGFzdXJhLmlvL2p3dC9jbGFpbXMiOnsieC1oYXN1cmEtYWxsb3dlZC1yb2xlcyI6WyJ1c2VyIl0sIngtaGFzdXJhLWRlZmF1bHQtcm9sZSI6InVzZXIiLCJ4LWhhc3VyYS11c2VyLWlkIjoiYmU2NTUxOGItYWViZC00NmU3LTgwM2EtOWNjZmRjMTJmNTczIn0sImlhdCI6MTY4NjIyODk4OSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwLy5vcnkva3JhdG9zL3B1YmxpYyIsImp0aSI6IjY4YmEzYzM3LWY4ZjEtNDQ3Zi05NGEyLTU4M2I2MTM3NTBhNyIsIm5iZiI6MTY4NjIyODk4OSwic3ViIjoiYmU2NTUxOGItYWViZC00NmU3LTgwM2EtOWNjZmRjMTJmNTczIn0.F24HZ-Afa1Nn_9mZ9xAvYFTGxR_NBIUx72cznrKO6QYtngTLkuj8dLRK2O6-3V7BhLhyeAvrlQlB_1txf02sW-vQmVHP5I6GKPcv8ZNpAa4KIEwuXa_5s4gaNsHXiJPjJ3J1243SxUhLdvFp9kBOdrStLy0A5wXl6b6NhxoqR_NUv9FEirP9diNfkpCmE_6mXiL7eQA90ig1AEYoWqEh2kq5t3Mp43SeC7ZoQGDu5GSAysQNe4pvQ10Z6wl_5akOL8nq84vDoCXzkteiHKxF6q7zFEC9UCNnxTU385PRa6ItV5N4NQjLW5KidUMNLGa1PWYJFABPwaoZUsIx2lMZYA
```
### What is the expected behaviour?
The JWT should go through and be marked as valid.
### How to reproduce the issue?
1. Setup Ory Oathkeeper to generate a JWT with the configuration above.
2. Paste Bearer + the JWT in the Authorization header in the Hasura console.
3. Click on the JWT debugger at the end of the header.
### Screenshots or Screencast
*only relevant screenshot above*
### Please provide any traces or logs that could help here.
### Any possible solutions/workarounds you're aware of?
I tried a few different combinations of:
1. setting the `claims_namespace` to something else (and updating the JWT accordingly)
2. setting up the `claims_namespace_path` to something else (and updating the JWT accordingly)
3. using the `claims_map` (including with hard-coded values). This works if the values are all hard-coded, which obviously defeats the purpose. (i.e. just hardcode the allowed roles, the role, and the user id). If any one of those uses a path, it breaks
### Keywords
claims, claims_map, jwt, claims key not found, ory, kratos, oathkeeper
Contributor guide
Research direction
Start by reproducing the JWT authentication flow with the Ory Oathkeeper configuration, the supplied token, and the Authorization header in the Hasura console. Compare the JWT debugger output with the claims_namespace, claims_namespace_path, and claims_map handling; done means the token is accepted as valid without hard-coded claim values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100