Istio Role Based Access Control (RBAC)

In this section, you’ll learn how to use a JWT claim to manage the access to the services.

The first thing you need to do is applying all the steps described at End-user authentication with JWT section so you enable JWT authentication logic inside the mesh.

After that, you are ready to use JWT in the authorization phase as well.

Now apply the following Istio resource which makes that only tokens that contain a field named role with value customer.

and then you can do a new call with the new token containing the role claim with value customer`:

Notice that now only valid JWT tokens containing the claim role set to customer will succeed, the rest you’ll get an access denied.

To validate that this is working correctly, do the following thing:

Open istiofiles/authorization-policy-jwt.yaml and change the role with value xxx and save the file.

And then replace it:

After that, repeat the same request as before:

But notice that now the access is denied because the role field value in the token is customer instead of xxx.

In this chapter you’ve seen how to RBAC. Obviously, you should also enable mTLS to authenticate also your requests.

Check mTLS section to learn more about mTLS and Istio.

Follow End-user authentication with JWT Clean Up steps there to clean all JWT stuff and then call: