<p>I have a sample application (web-app, backend-1, backend-2) deployed on minikube all under a JWT policy, and they all have proper destination rules, Istio sidecar and MTLS enabled in order to secure the east-west traffic.</p>

<pre><code>apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: oidc
spec:
  targets:
  - name: web-app
  - name: backend-1
  - name: backend-2
  peers:
  - mtls: {}
  origins:
  - jwt:
      issuer: "http://myurl/auth/realms/test"
      jwksUri: "http://myurl/auth/realms/test/protocol/openid-connect/certs"
  principalBinding: USE_ORIGIN
</code></pre>

<p>When I run the following command I receive a 401 unauthorized response when requesting the data from the backend, which is due to $TOKEN not being forwarded to backend-1 and backend-2 headers during the http request.</p>

<pre><code>$&gt; curl http://minikubeip/api "Authorization: Bearer $TOKEN"
</code></pre>

<p>Is there a way to forward http headers to backend-1 and backend-2 using native kubernetes/istio? Am I forced to make application code changes to accomplish this?</p>

<p><strong>Edit:</strong>
This is the error I get after applying my oidc policy. When I curl web-app with the auth token I get </p>

<blockquote>
  <p>{"errors":[{"code":"APP_ERROR_CODE","message":"401 Unauthorized"}</p>
</blockquote>

<p>Note that when I curl backend-1 or backend-2 with the same auth-token I get the appropriate data. Also, there is no other destination rule/policy applied to these services currently, policy enforcement is on, and my istio version is 1.1.15.
This is the policy I am applying:</p>

<pre><code>apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: default
  namespace: default
spec:
  # peers:
  # - mtls: {}
  origins:
  - jwt:
      issuer: "http://10.148.199.140:8080/auth/realms/test"
      jwksUri: "http://10.148.199.140:8080/auth/realms/test/protocol/openid-connect/certs"
  principalBinding: USE_ORIGIN
</code></pre>

<p>Istio supports header propagation. Probably didn't support when this thread was created.</p>
<p>You can allow the original header to be forwarded by using <code>forwardOriginalToken</code>: true in <code>JWTRules</code> or forward a valid JWT payload using <code>outputPayloadToHeader</code> in <code>JWTRules</code>.</p>
<p>Reference: <a href="https://istio.io/latest/docs/reference/config/security/jwt/" rel="nofollow noreferrer">ISTIO JWTRule documentation</a></p>
