<p>I'm new to Istio. I'm implementing Authorization with JWT. I get RBAC access denied error for a valid JWT token. I've added the JWT Payload and Authorization Policy for reference. I'm using kubernetes version v1.18.3 and Istio 1.6.2. I'm running cluster on minikube.</p>
<p>JWT Payload:</p>
<pre><code>{
  &quot;iss&quot;: &quot;https://dev-n63ipah2.us.auth0.com/&quot;,
  &quot;sub&quot;: &quot;sEbjHGBcZ16D0jk8wohIp7vPoT0MWTO0@clients&quot;,
  &quot;aud&quot;: &quot;http://10.97.72.213/&quot;,
  &quot;iat&quot;: 1594125596,
  &quot;exp&quot;: 1594211996,
  &quot;azp&quot;: &quot;sEbjHGBcZ16D0jk8wohIp7vPoT0MWTO0&quot;,
  &quot;scope&quot;: &quot;read:contact write:contact update:contact delete:contact&quot;,
  &quot;gty&quot;: &quot;client-credentials&quot;
}
</code></pre>
<p>Authorization Policy:</p>
<pre><code>apiVersion: &quot;security.istio.io/v1beta1&quot;
kind: &quot;AuthorizationPolicy&quot;
metadata:
  name: dex-ms-contact-require-jwt
  namespace: default
spec:
  selector:
    matchLabels:
      app: dex-ms-contact
  action: ALLOW
  rules:
  - from:
    - source:
       requestPrincipals: [&quot;https://dev-n63ipah2.us.auth0.com/sEbjHGBcZ16D0jk8wohIp7vPoT0MWTO0@clients&quot;]
    to:
    - operation:
       methods: [&quot;*&quot;]
       paths: [&quot;*&quot;]
    when:
    - key: request.auth.claims[iss]
      values: [&quot;https://dev-n63ipah2.us.auth0.com/&quot;]
</code></pre>
<p>After applying authorization policy I hit GET <a href="http://10.97.72.213/contact/1" rel="nofollow noreferrer">http://10.97.72.213/contact/1</a> API through Postman and I get 403 Forbidden RBAC: access denied.</p>
<p>Note: 10.97.72.213 is the Public Ipaddress of the Minikube cluster.</p>

Sweta Sharma
<p>According to the Istio documentation:</p>
<pre><code>requestPrincipals - Optional. A list of request identities (i.e. “iss/sub” claims), which matches to the “request.auth.principal” attribute.
</code></pre>
<p>In your case the <code>iss</code> is <code>https://dev-n63ipah2.us.auth0.com/</code> and the <code>sub</code> is <code>https://dev-n63ipah2.us.auth0.com/</code>, so the you probably want something like this:</p>
<pre><code>- from:
    - source:
       requestPrincipals: [&quot;https://dev-n63ipah2.us.auth0.com//sEbjHGBcZ16D0jk8wohIp7vPoT0MWTO0@clients&quot;]
</code></pre>
<p>(please note the double slash - first is part of iss the second is the separator).</p>
