Kong GatewayのJWTプラグインを使ってAuth0のJWTオーソライザーをローカル環境で構築してみた

const express = require('express');
const app = express();
const port = 3000;

app.get('/', (req, res) => {
  res.send('Hello world DESUWA!');
});

app.listen(port, () => {
  console.log(`Example app listening at http://localhost:${port}`);
});

{
  "name": "my-kong-jwt-plugin",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "express": "^4.21.2"
  }
}

FROM node:18-alpine

WORKDIR /app

COPY package*.json ./

RUN npm install

COPY . .

EXPOSE 3000

CMD ["node", "index.js"]

version: "3.8"

services:
  my-api-server:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "3000:3000"
    networks:
      - my-kong-jwt-plugin

  kong:
    image: kong/kong-gateway:latest
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: "/kong/declarative/kong.yml"
      KONG_ADMIN_LISTEN: "0.0.0.0:8001"
    ports:
      - "8000:8000"
      - "8001:8001"
    volumes:
      - "./kong.yml:/kong/declarative/kong.yml"
    depends_on:
      - my-api-server
    networks:
      - my-kong-jwt-plugin

networks:
  my-kong-jwt-plugin:

_format_version: "3.0"
_transform: true

services:
  - name: my-api-service
    url: http://my-api-server:3000

routes:
  - name: api-requests
    service: my-api-service
    paths:
      - /api

plugins:
  - name: jwt
    service: my-api-service
    config:
      key_claim_name: iss
      claims_to_verify:
        - exp
      header_names:
        - Authorization

consumers:
  - username: "auth0-user"
    jwt_secrets:
      - key: https://{your_auth0_tenant}.auth0.com/
        algorithm: RS256
        secret: {ランダム文字列} # head /dev/urandom | hexdump | sha256sum で出力されてるランダムな文字列
        rsa_public_key: |
          -----BEGIN PUBLIC KEY-----
          ...
          -----END PUBLIC KEY-----

$ openssl x509 -pubkey -noout -in cert.pem > pubkey.pem

$ tree -L 1
.
├── Dockerfile
├── compose.yml
├── index.js
├── kong.yml
├── package.json
└── package-lock.json

$ docker compose up

$ curl --request POST \
  --url https://{your_auth0_tenant}.auth0.com/oauth/token \
  --header 'content-type: application/json' \
  --data '{"client_id":"...","client_secret":"...","audience":"http://localhost:8000/api","grant_type":"client_credentials"}'

{"access_token":"...","expires_in":86400,"token_type":"Bearer"}

$ curl localhost:8000/api
{"message":"Unauthorized"}

$ curl localhost:8000/api -H 'Authorization: Bearer ...'
Hello world DESUWA!

$ curl localhost:8000/api -H 'Authorization: Bearer xxx'
{"message":"Invalid signature"}