如何在KrakenD同一API端点配置两个JWT验证器？

你遇到的问题根源是JSON对象中重复的键会被后续值覆盖，所以第一个github.com/devopsfaith/krakend-jose/validator配置被第二个完全替换，导致仅第二个验证器生效。

KrakenD 1.3的JWT验证器支持将配置放在数组中，以此实现同一端点多源JWT验证。修改后的配置如下：

{
  "endpoint": "/paas/hydra/test/ab/projects/{project}",
  "method": "GET",
  "output_encoding": "no-op",
  "headers_to_pass": ["Authorization"],
  "extra_config": {
    "github.com/devopsfaith/krakend-jose/validator": [
      {
        "alg": "RS256",
        "jwk-url": "{{ .jwk.host }}/oauth2/v1/keys",
        "cache": true,
        "cache_duration": 1800,
        "disable_jwk_security": true
      },
      {
        "alg": "RS256",
        "jwk-url": "https://authbluetokens.aexp.com/v2/app2app/tokens/keys",
        "cache": true,
        "cache_duration": 1800,
        "disable_jwk_security": true
      }
    ]
  },
  "backend": [
    {
      "method": "GET",
      "encoding": "no-op",
      "host": ["http://localhost:8080"],
      "url_pattern": "/v6/workspaces/{project}",
      "extra_config": {
        "github.com/devopsfaith/krakend/transport/http/client/executor": {
          "name": "bomoktacustom",
          "audienceid": "0oasx1emolGCrwnht0x7,0oasx1nyh6ytqb96z0x7,0oaohi3lo9nr9lMXu0x7,0oarc7drtoyMIbAic0x7,0oaqnh8rpuaCUFhD70x7,0oaqctxj5rYvoUVuy0x7,0oappvfm4hre783rH0x7,0oawdujgrqi4DPyBz0x7,*.aexp.com"
        },
        "github.com/devopsfaith/krakend-ratelimit/juju/proxy": {
          "maxRate": 6,
          "capacity": 6
        },
        "github.com/devopsfaith/krakend-martian": {
          "header.Modifier": {
            "scope": ["request", "response"],
            "name": "Content-Type",
            "value": "application/json"
          }
        }
      }
    }
  ]
}

配置说明 #

• 将两个验证器配置放在同一个github.com/devopsfaith/krakend-jose/validator数组下，KrakenD会依次尝试每个验证器，只要任意一个验证通过，请求就会被允许
• 每个验证器会独立缓存各自JWK URL返回的密钥，互不干扰

注意事项 #

• 确保两个JWK URL都能被KrakenD节点正常访问
• 令牌的签名算法需与配置中的alg（此处为RS256）严格匹配
• 若需针对不同令牌添加额外校验（如受众audience），可在对应验证器的配置中添加audience参数

内容的提问来源于stack exchange，提问作者PoemCD