<p>I am using Istio-1.0.6 to implement Authentication/Authorization. I am attempting to use Jason Web Tokens (JWT). I followed most of the examples from the documentation but I am not getting the expected outcome. Here are my settings:</p>

<p>Service</p>

<pre><code>kubectl describe services hello
Name:              hello
Namespace:         agud
Selector:          app=hello
Type:              ClusterIP
IP:                10.247.173.177
Port:              &lt;unset&gt;  8080/TCP
TargetPort:        8080/TCP
Endpoints:         172.16.0.193:8080
Session Affinity:  None
</code></pre>

<p>Gateway</p>

<pre><code>kubectl describe gateway
Name:         hello-gateway
Namespace:    agud
Kind:         Gateway
Metadata:
  Cluster Name:
  Creation Timestamp:  2019-03-15T13:40:43Z
  Resource Version:    1374497
  Self Link:           
/apis/networking.istio.io/v1alpha3/namespaces/agud/gateways/hello-gateway
  UID:                 ee483065-4727-11e9-a712-fa163ee249a9
Spec:
  Selector:
    Istio:  ingressgateway
  Servers:
    Hosts:
      *
    Port:
      Name:      http
      Number:    80
      Protocol:  HTTP
</code></pre>

<p>Virtual Service</p>

<pre><code>kubectl describe virtualservices
Name:         hello
Namespace:    agud
API Version:  networking.istio.io/v1alpha3
Kind:         VirtualService
Metadata:
  Cluster Name:
  Creation Timestamp:  2019-03-18T07:38:52Z
  Generation:          0
  Resource Version:    2329507
  Self Link:           
/apis/networking.istio.io/v1alpha3/namespaces/agud/virtualservices/hello
  UID:                 e099b560-4950-11e9-82a1-fa163ee249a9
Spec:
  Gateways:
    hello-gateway
  Hosts:
    *
  Http:
    Match:
      Uri:
        Exact:  /hello
      Uri:
        Exact:  /secured
    Route:
      Destination:
        Host:  hello.agud.svc.cluster.local
        Port:
          Number:  8080
</code></pre>

<p>Policy</p>

<pre><code>kubectl describe policies
Name:         jwt-hello
Namespace:    agud
API Version:  authentication.istio.io/v1alpha1
Kind:         Policy
Metadata:
  Cluster Name:
  Creation Timestamp:  2019-03-18T07:45:33Z
  Generation:          0
  Resource Version:    2331381
  Self Link:           
/apis/authentication.istio.io/v1alpha1/namespaces/agud/policies/jwt-hello
  UID:                 cf9ed2aa-4951-11e9-9f64-fa163e804eca
Spec:
  Origins:
    Jwt:
      Audiences:
        hello
      Issuer:         testing@secure.istio.io
      Jwks Uri:       https://raw.githubusercontent.com/istio/istio/release-1.0/security/tools/jwt/samples/jwks.json
  Principal Binding:  USE_ORIGIN
  Targets:
    Name:  hello.agud.svc.cluster.local
</code></pre>

<p>RESULT</p>

<p>I am expecting to get a 401 error but I am getting a 200. What is wrong with my configuration and how do I fix this?</p>

<pre><code>curl $INGRESS_HOST/hello -s -o /dev/null -w "%{http_code}\n"
200
</code></pre>

Dale Angus
<p>You have:</p>

<pre><code>Port:              &lt;unset&gt;  8080/TCP
</code></pre>

<p>For <em>Istio routing and security</em>, you must set the port name to <code>http</code> or <code>http-&lt;something&gt;</code>.</p>

<p>I tried with Istio 1.1. I got a <code>503</code> rather than a <code>401</code>.</p>
