<p>I'm trying to verify a Firebase generated JWT token with an Ambassador Edge Stack (datawire/edge-stack version 3.3.0) Filter.</p>
<p>The Firebase token is generated using a login/password authent mechanism on firebase, something like (in Python):</p>
<pre class="lang-py prettyprint-override"><code>    email=input(&quot;Enter email: &quot;)
    password=input(&quot;Enter password: &quot;)
    user = authentication.sign_in_with_email_and_password(email, password)
    custom_token = auth.create_custom_token(user[&quot;localId&quot;], additional_claims)
    print(&quot;JWT Token :&quot;)
    print(custom_token)
</code></pre>
<p>After the token is generated, I use it with a curl command such as:</p>
<pre class="lang-bash prettyprint-override"><code>curl -H &quot;Authorization: Bearer $TOKEN&quot; https://ambassador-ip.nip.io/hello-world/
</code></pre>
<p>and the curl command returns the following error:</p>
<pre class="lang-bash prettyprint-override"><code>        },
        &quot;message&quot;: &quot;Token validation error: token is invalid: errorFlags=0x00000002=(ValidationErrorUnverifiable) wrappedError=(KeyID=\&quot;50***redacted***1\&quot;: JWK not found)&quot;,
        &quot;status_code&quot;: 401
}
</code></pre>
<p>Here is the ambassador Filter I've declared:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: getambassador.io/v2
kind: Filter
metadata:
  name: &quot;firebase-filter&quot;
  namespace: ${kubernetes_namespace.hello_world.metadata[0].name}
spec:
  JWT:
    jwksURI:  &quot;https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com&quot;
    audience: &quot;${local.project_id}&quot;
    issuer:   &quot;https://securetoken.google.com/${local.project_id}&quot;
</code></pre>
<p>And the policy filter applied to my backend:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: getambassador.io/v3alpha1
kind: FilterPolicy
metadata:
  name: &quot;firebase-filter-policy&quot;
  namespace: ${kubernetes_namespace.hello_world.metadata[0].name}
spec:
  rules:
  - host: &quot;*&quot;
    path: &quot;/hello-world/&quot;
    filters:                    
    - name: &quot;firebase-filter&quot;
      namespace: &quot;${kubernetes_namespace.hello_world.metadata[0].name}&quot;
</code></pre>
<p>For the record, the curl command with the same token works on a deployed hello-world Cloud Run with a GCP API gateway configured as follow:</p>
<pre class="lang-yaml prettyprint-override"><code>swagger: '2.0'
info:
  title: Example Firebase auth Gateway
  description: API Gateway with firebase auth
  version: 1.0.0
schemes:
  - https
produces:
  - application/json
securityDefinitions:
  firebase:
    authorizationUrl: ''
    flow: implicit
    type: oauth2
    x-google-issuer: &quot;https://securetoken.google.com/${project_id}&quot;
    x-google-jwks_uri: &quot;https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com&quot;
    x-google-audiences: &quot;${project_id}&quot;
paths:
  /v1/hello:
    get:
      security:
        - firebase: []
      description: Hello
      operationId: hello
      responses:
        '200':
          description: Success
      x-google-backend:
        address: 'https://hello-redacted-ew.a.run.app'
</code></pre>
<p>Any idea why the Ambassador filter is misconfigured ?</p>

ThomasVI
<p>Ambassador JWT Filter needs the jwksURI to point to the Firebase secure token service account public keys and not the X509 certificates, therefore the Filter should be:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: getambassador.io/v2
kind: Filter
metadata:
  name: &quot;firebase-filter&quot;
  namespace: ${kubernetes_namespace.hello_world.metadata[0].name}
spec:
  JWT:
    jwksURI:  &quot;https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com&quot;
    audience: &quot;${local.project_id}&quot;
    issuer:   &quot;https://securetoken.google.com/${local.project_id}&quot;
</code></pre>
<p>This is working for Firebase tokens only. If you want to make this works with Custom tokens using some dedicated service account for example, you might need the jwksURI to point to your service account public keys, something like:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: getambassador.io/v2
kind: Filter
metadata:
  name: &quot;firebase-custom-filter&quot;
  namespace: ${kubernetes_namespace.hello_world.metadata[0].name}
spec:
  JWT:
    jwksURI:  &quot;https://www.googleapis.com/service_accounts/v1/jwk/${service_account}@${local.project_id}.iam.gserviceaccount.com&quot;
    audience: &quot;${local.project_id}&quot;
    issuer:   &quot;https://securetoken.google.com/${local.project_id}&quot;
</code></pre>
