AWS Load Balancer Auth

AWS recently added the functionality to authenticate a user on the load balancer and have a authenticated and hydrated user details in the request header.

I wasn’t able to decode the object that comes from the load balancer even though it will decode on jwt.io. The example AWS give is in python but should be straight forward enough to decode the token.

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html

Has anyone attempted to decode the x-amzn-oidc-data header using jwt.decode?

[morganabel]

@daerion I found a way to make this work, but it’s not pretty…

Basically, the verify method in this library won’t work, but the signature can be verified using the underlying node-jwa library. Then you just have to check things like is the token still valid (I am only checking if token is not expired):

const base64Url = require("base64url");
const jwt = require("jsonwebtoken");
const jws = require("jws");
const fetch = require("node-fetch").default;

async function verifyToken(token) {
  var base64UrlToken = base64Url.fromBase64(token);
  const decoded = jwt.decode(base64UrlToken, { complete: true });

  const { kid, signer } = decoded.header;
  const region = signer.split(":")[3];

  const uri = `https://public-keys.auth.elb.${region}.amazonaws.com/${kid}`;

  console.log(`Fetching key at: ${uri}`);

  const response = await fetch(uri);
  const key = await response.text();

  console.log(key);

  try {
    const verify = jws.verify(token, "ES256", key);
    if (!verify) {
      return null;
    }

    var clockTimestamp = Math.floor(Date.now() / 1000);
    if (clockTimestamp >= decoded.header.exp) {
      // Token expired.
      return null;
    }
  } catch (err) {
    console.error(err);
    throw err;
  }

  return decoded.payload;
}

[trallnag]

Just ran into the same issue…