<p>Istio can route traffic based off headers and such.  There are <a href="https://istio.io/latest/docs/reference/config/networking/virtual-service/" rel="nofollow noreferrer">great examples</a> of how to do this in the Istio docs.</p>
<p>Istio can also validate your JWT.  The Istio docs also <a href="https://istio.io/latest/docs/tasks/security/authorization/authz-jwt/" rel="nofollow noreferrer">cover that</a>.</p>
<p>But I can't seem to find a way to get my JWT Validated, then use the user claim found in the JWT Json to route traffic.  The example I linked to just expects the user to be plain text in a header.</p>
<p>How can an Istio Virtual Service be setup to route based on a claim in a JWT (preferably one it validated).</p>

<p>You can implement this using the <strong>Istio authorization policy</strong>. I did something similar with Keycloak and Kong to restrict user traffic at API gateway level if claim or roles were not there.</p>
<p><a href="https://github.com/binc75/istio-jwt#inspect-jtw-token" rel="nofollow noreferrer">Here</a> is one nice example of JWT auth with istio:</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
 name: backend
 namespace: default
spec:
  selector:
    matchLabels:
      app: backend
  jwtRules:
  - issuer: &quot;${KEYCLOAK_URL}/auth/realms/istio&quot;
    jwksUri: &quot;${KEYCLOAK_URL}/auth/realms/istio/protocol/openid-connect/certs&quot;
---
# To allow only requests with a valid token, create an authorization policy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: backend
 namespace: default
spec:
 selector:
   matchLabels:
     app: backend
 action: ALLOW
 rules:
 - from:
   when:  
    - key: request.auth.claims[preferred_username]
      values: [&quot;testuser&quot;]
</code></pre>
<p>Example link : <a href="https://istio.io/latest/docs/tasks/security/authorization/authz-jwt/" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/security/authorization/authz-jwt/</a></p>
<p>Another nice example with OIDC : <a href="https://www.jetstack.io/blog/istio-oidc" rel="nofollow noreferrer">https://www.jetstack.io/blog/istio-oidc</a></p>
<p>RBAC and group list checks : <a href="https://istio.io/v1.4/docs/tasks/security/authorization/rbac-groups/" rel="nofollow noreferrer">https://istio.io/v1.4/docs/tasks/security/authorization/rbac-groups/</a></p>
