{"action":"created","issue":{"url":"https://api.github.com/repos/TykTechnologies/tyk/issues/906","repository_url":"https://api.github.com/repos/TykTechnologies/tyk","labels_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/906/labels{/name}","comments_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/906/comments","events_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/906/events","html_url":"https://github.com/TykTechnologies/tyk/issues/906","id":241965154,"number":906,"title":"Multiple auth schemes for single API definition","user":{"login":"hustshawn","id":3147161,"avatar_url":"https://avatars3.githubusercontent.com/u/3147161?v=3","gravatar_id":"","url":"https://api.github.com/users/hustshawn","html_url":"https://github.com/hustshawn","followers_url":"https://api.github.com/users/hustshawn/followers","following_url":"https://api.github.com/users/hustshawn/following{/other_user}","gists_url":"https://api.github.com/users/hustshawn/gists{/gist_id}","starred_url":"https://api.github.com/users/hustshawn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hustshawn/subscriptions","organizations_url":"https://api.github.com/users/hustshawn/orgs","repos_url":"https://api.github.com/users/hustshawn/repos","events_url":"https://api.github.com/users/hustshawn/events{/privacy}","received_events_url":"https://api.github.com/users/hustshawn/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-07-11T08:21:37Z","updated_at":"2017-07-12T07:11:04Z","closed_at":"2017-07-12T03:10:20Z","body":"**Do you want to request a *feature* or report a *bug*?**\r\nbug may be.\r\n**What is the current behavior?**\r\nAs suggested from community https://community.tyk.io/t/multiple-auth-schemes-for-single-api-definition/694/4, I put the so called  `custom JWK URL`(http://localhost/files/idp_jwks.json, and it was verified the json can be accessed )  to the secret field, , but tyk cannot pick up the url of json to parse the JWT.\r\n**What is the expected behavior?**\r\nThe API request can pass the authentication.\r\n**If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem**\r\nBelow attached the api definition\r\n```json\r\n{\r\n    \"id\": \"5964544ae595230001212bf1\",\r\n    \"name\": \"test\",\r\n    \"slug\": \"test\",\r\n    \"api_id\": \"9a83a146c3d341e376aebe945a92070e\",\r\n    \"org_id\": \"59635dd4e5952300019e3fb8\",\r\n    \"use_keyless\": false,\r\n    \"use_oauth2\": false,\r\n    \"use_openid\": false,\r\n    \"openid_options\": {\r\n        \"providers\": [],\r\n        \"segregate_by_client\": false\r\n    },\r\n    \"oauth_meta\": {\r\n        \"allowed_access_types\": [],\r\n        \"allowed_authorize_types\": [],\r\n        \"auth_login_redirect\": \"\"\r\n    },\r\n    \"auth\": {\r\n        \"use_param\": false,\r\n        \"param_name\": \"\",\r\n        \"use_cookie\": false,\r\n        \"cookie_name\": \"\",\r\n        \"auth_header_name\": \"Authorization\"\r\n    },\r\n    \"use_basic_auth\": false,\r\n    \"enable_jwt\": true,\r\n    \"use_standard_auth\": false,\r\n    \"enable_coprocess_auth\": false,\r\n    \"jwt_signing_method\": \"rsa\",\r\n    \"jwt_source\": \"aHR0cDovL2xvY2FsaG9zdC9maWxlcy9pZHBfandrcy5qc29u\",\r\n    \"jwt_identity_base_field\": \"sub\",\r\n    \"jwt_client_base_field\": \"\",\r\n    \"jwt_policy_field_name\": \"kid\",\r\n    \"notifications\": {\r\n        \"shared_secret\": \"\",\r\n        \"oauth_on_keychange_url\": \"\"\r\n    },\r\n    \"enable_signature_checking\": false,\r\n    \"hmac_allowed_clock_skew\": -1,\r\n    \"base_identity_provided_by\": \"\",\r\n    \"definition\": {\r\n        \"location\": \"header\",\r\n        \"key\": \"x-api-version\"\r\n    },\r\n    \"version_data\": {\r\n        \"not_versioned\": true,\r\n        \"versions\": {\r\n            \"Default\": {\r\n                \"name\": \"Default\",\r\n                \"expires\": \"\",\r\n                \"paths\": {\r\n                    \"ignored\": [],\r\n                    \"white_list\": [],\r\n                    \"black_list\": []\r\n                },\r\n                \"use_extended_paths\": true,\r\n                \"extended_paths\": {},\r\n                \"global_headers\": {},\r\n                \"global_headers_remove\": [],\r\n                \"global_size_limit\": 0,\r\n                \"override_target\": \"\"\r\n            }\r\n        }\r\n    },\r\n    \"uptime_tests\": {\r\n        \"check_list\": [],\r\n        \"config\": {\r\n            \"expire_utime_after\": 0,\r\n            \"service_discovery\": {\r\n                \"use_discovery_service\": false,\r\n                \"query_endpoint\": \"\",\r\n                \"use_nested_query\": false,\r\n                \"parent_data_path\": \"\",\r\n                \"data_path\": \"\",\r\n                \"port_data_path\": \"\",\r\n                \"target_path\": \"\",\r\n                \"use_target_list\": false,\r\n                \"cache_timeout\": 60,\r\n                \"endpoint_returns_list\": false\r\n            },\r\n            \"recheck_wait\": 0\r\n        }\r\n    },\r\n    \"proxy\": {\r\n        \"preserve_host_header\": false,\r\n        \"listen_path\": \"/test/\",\r\n        \"target_url\": \"http://httpbin.org/\",\r\n        \"strip_listen_path\": true,\r\n        \"enable_load_balancing\": false,\r\n        \"target_list\": [],\r\n        \"check_host_against_uptime_tests\": false,\r\n        \"service_discovery\": {\r\n            \"use_discovery_service\": false,\r\n            \"query_endpoint\": \"\",\r\n            \"use_nested_query\": false,\r\n            \"parent_data_path\": \"\",\r\n            \"data_path\": \"hostname\",\r\n            \"port_data_path\": \"port\",\r\n            \"target_path\": \"/api-slug\",\r\n            \"use_target_list\": false,\r\n            \"cache_timeout\": 60,\r\n            \"endpoint_returns_list\": false\r\n        }\r\n    },\r\n    \"disable_rate_limit\": false,\r\n    \"disable_quota\": false,\r\n    \"custom_middleware\": {\r\n        \"pre\": [],\r\n        \"post\": [],\r\n        \"post_key_auth\": [],\r\n        \"auth_check\": {\r\n            \"name\": \"\",\r\n            \"path\": \"\",\r\n            \"require_session\": false\r\n        },\r\n        \"response\": [],\r\n        \"driver\": \"\",\r\n        \"id_extractor\": {\r\n            \"extract_from\": \"\",\r\n            \"extract_with\": \"\",\r\n            \"extractor_config\": {}\r\n        }\r\n    },\r\n    \"custom_middleware_bundle\": \"\",\r\n    \"cache_options\": {\r\n        \"cache_timeout\": 60,\r\n        \"enable_cache\": true,\r\n        \"cache_all_safe_requests\": false,\r\n        \"cache_response_codes\": [],\r\n        \"enable_upstream_cache_control\": false\r\n    },\r\n    \"session_lifetime\": 0,\r\n    \"active\": true,\r\n    \"auth_provider\": {\r\n        \"name\": \"\",\r\n        \"storage_engine\": \"\",\r\n        \"meta\": {}\r\n    },\r\n    \"session_provider\": {\r\n        \"name\": \"\",\r\n        \"storage_engine\": \"\",\r\n        \"meta\": null\r\n    },\r\n    \"event_handlers\": {\r\n        \"events\": {}\r\n    },\r\n    \"enable_batch_request_support\": false,\r\n    \"enable_ip_whitelisting\": false,\r\n    \"allowed_ips\": [],\r\n    \"dont_set_quota_on_create\": false,\r\n    \"expire_analytics_after\": 0,\r\n    \"response_processors\": [],\r\n    \"CORS\": {\r\n        \"enable\": false,\r\n        \"allowed_origins\": [],\r\n        \"allowed_methods\": [],\r\n        \"allowed_headers\": [],\r\n        \"exposed_headers\": [],\r\n        \"allow_credentials\": false,\r\n        \"max_age\": 24,\r\n        \"options_passthrough\": false,\r\n        \"debug\": false\r\n    },\r\n    \"domain\": \"\",\r\n    \"do_not_track\": false,\r\n    \"tags\": [],\r\n    \"enable_context_vars\": false\r\n}\r\n```\r\n\r\nThe access token(The token can be passed via the normal JWT authentication method with public key):\r\n```Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIwIiwiYXpwIjoiaVBob25lLUFwcCIsImlhdCI6MTQ4MjA3MTYzNiwiZXhwIjoyMTUwMDAzOTk1LCJraWQiOiI1OTY0NTVjNGU1OTUyMzAwMDEyMTJiZjIifQ.c1N1hPooRGXnK53lUOYVywmnX6vklpL9MayvoFeX1uANcigThXJjrM0WhwDFUKlwy37gn3Aef-cFJhpnJ52QwA```\r\nThe jwks json file:\r\n```json\r\n{\r\n\t\"keys\": [\r\n\t\t{\r\n\t\t\t\"alg\": \"RS256\",\r\n\t\t\t\"kty\": \"RSA\",\r\n\t\t\t\"use\": \"sig\",\r\n\t\t\t\"x5c\": [\r\n \"MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJ4AhQ6FGspvMAnBmclAzydVB35i/MJeDq+OB5di7YLy3VcH66MJ0NSnEy/s55hgcQQ+IozJK4UTyAyGwRGVxn8CAwEAAQ==\"\r\n\t\t\t],\r\n\t\t\t\"kid\": \"596455c4e595230001212bf2\"\r\n\t\t}\r\n\t]\r\n}\r\n```\r\nAttaches the RSA public / private key for your reference.\r\n```\r\n-----BEGIN PUBLIC KEY-----\r\nMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJ4AhQ6FGspvMAnBmclAzydVB35i/MJe\r\nDq+OB5di7YLy3VcH66MJ0NSnEy/s55hgcQQ+IozJK4UTyAyGwRGVxn8CAwEAAQ==\r\n-----END PUBLIC KEY-----\r\n```\r\n```\r\n-----BEGIN RSA PRIVATE KEY-----\r\nMIIBOgIBAAJBAJ4AhQ6FGspvMAnBmclAzydVB35i/MJeDq+OB5di7YLy3VcH66MJ\r\n0NSnEy/s55hgcQQ+IozJK4UTyAyGwRGVxn8CAwEAAQJBAI6yn3kGo7SSiMs266KE\r\ngtLeC3+M/QS6F/9bgeWqtiGdtRnRXyR50qesjPoD9q0Wmy9u0AkdX6Q6Zft+PMhR\r\nLEkCIQDKbYgVSAze6wtXprtH/s4hiXKuydNVGb4N9en8D5klwwIhAMfRJHyJQQ1c\r\nqhxdS0bwWYQac9g+RbKiiC/wnGENOUSVAiBpwlAWzk3rKWIDqVivhLCtVOJV75w6\r\nGfjx0kktJ/kbgQIgVpSDt8aNPmnxd7rg/Er2rqv7mC5bauzMD+G1EMR3FQUCIFrx\r\n/GzNTSq7dvJzUh47kSO6HI2w+OYdXiYKZF29colc\r\n-----END RSA PRIVATE KEY-----\r\n```\r\n**Which versions of Tyk affected by this issue? Did this work in previous versions of Tyk?**\r\nLatest version from docker image."},"comment":{"url":"https://api.github.com/repos/TykTechnologies/tyk/issues/comments/314676007","html_url":"https://github.com/TykTechnologies/tyk/issues/906#issuecomment-314676007","issue_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/906","id":314676007,"user":{"login":"hustshawn","id":3147161,"avatar_url":"https://avatars3.githubusercontent.com/u/3147161?v=3","gravatar_id":"","url":"https://api.github.com/users/hustshawn","html_url":"https://github.com/hustshawn","followers_url":"https://api.github.com/users/hustshawn/followers","following_url":"https://api.github.com/users/hustshawn/following{/other_user}","gists_url":"https://api.github.com/users/hustshawn/gists{/gist_id}","starred_url":"https://api.github.com/users/hustshawn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hustshawn/subscriptions","organizations_url":"https://api.github.com/users/hustshawn/orgs","repos_url":"https://api.github.com/users/hustshawn/repos","events_url":"https://api.github.com/users/hustshawn/events{/privacy}","received_events_url":"https://api.github.com/users/hustshawn/received_events","type":"User","site_admin":false},"created_at":"2017-07-12T07:11:04Z","updated_at":"2017-07-12T07:11:04Z","body":"@lonelycode After further investigation, the above error are not in our scope, may be a bug itself since it resumed after I re-launched all the instance containers.\r\n\r\nAnyway, I still got the error log\r\n```\r\ntyk_pump_1       | time=\"Jul 12 06:54:38\" level=info msg=\"Purging 1 records\" \r\ntyk_gateway_1    | time=\"Jul 12 06:54:41\" level=error msg=\"Failed to deccode JWT to RSA type\" \r\ntyk_gateway_1    | time=\"Jul 12 06:54:41\" level=info msg=\"Attempted JWT access with non-existent key.\" origin=172.19.0.1 path=\"/test/\" \r\ntyk_gateway_1    | time=\"Jul 12 06:54:41\" level=error msg=\"JWT validation error: Invalid Key: Key must be PEM encoded PKCS1 or PKCS8 private key\" origin=172.19.0.1 path=\"/test/\" \r\ntyk_gateway_1    | time=\"Jul 12 06:54:41\" level=error msg=\"request error: Key not authorized\" api_id=ef55a8721f2b4743649c41fc7a1f4d5b org_id=5965a72872b54c000157b43f path=\"/\" server_name=\"http://httpbin.org/\" user_id= user_ip=172.19.0.1 \r\n```\r\n\r\nI am just wondering what is lying behind if I just put the JWK URL to the `jwt_source` field ?\r\nand if it was configured via dashboard, it will be transformed into a blob; if I directly configure it from db, make this key as `jwt_source: \"https://my-internal-server.com/idp_jwks.json\"`, I will still get above error log.\r\n\r\nAny tips for me so that I can debug where the problem is?"}}
{"actor":{"display_login":"hustshawn"}}