https://docs.airlock.com/microgateway/5.2/configuration-guides/authentication/ This chapter contains configuration guides for authentication. Hugo en-US https://docs.airlock.com/microgateway/5.2/configuration-guides/authentication/jwt-authentication/ Mon, 01 Jan 0001 00:00:00 +0000 https://docs.airlock.com/microgateway/5.2/configuration-guides/authentication/jwt-authentication/ This guide shows how to enforce client authentication with JSON Web Tokens (JWTs) in Airlock Microgateway. Microgateway retrieves a JWT from the request, validates it using the configured JWKS and JWT settings, and then applies access control rules (optionally including claim checks). JWT authentication is configured by connecting these resources: JWKS: provides the public keys used to verify the JWT signature (either from a local Secret or a remote JWKS endpoint). JWT: defines where the token is extracted from and what makes a token acceptable (JWKS, issuer, audiences, subject, lifetime constraints). AccessControlPolicy: attaches to an HTTPRoute, enforces JWT authentication via authentication.jwt.jwtRef, and optionally authorizes requests based on JWT claims. Prerequisites A Gateway Deployment. An HTTPRoute routing traffic to your application/API (JWT authentication is attached via AccessControlPolicy.spec.targetRefs[].HTTPRoute). A JWT issuer that provides tokens and exposes signing keys (e.g., via a JWKS endpoint), or signing keys available as a local JWKS file. Configuration Create a JWKS resource Create a JWKS CR that provides the keys used to verify JWT signatures. You can source JWKS either: https://docs.airlock.com/microgateway/5.2/configuration-guides/authentication/oidc-authentication/ Mon, 01 Jan 0001 00:00:00 +0000 https://docs.airlock.com/microgateway/5.2/configuration-guides/authentication/oidc-authentication/ This guide shows how to enforce authentication with Airlock Microgateway to allow access only to authenticated and authorized users. Access is granted based on access policies evaluating the claims in the ID token provided by an external OIDC provider. The configuration steps below show how to configure authentication enforcement with OIDC to protect a web application. The examples are based on a Microsoft Entra ID integration and must be adjusted to your setup. https://docs.airlock.com/microgateway/5.2/configuration-guides/authentication/oidc-step-up-authentication/ Mon, 01 Jan 0001 00:00:00 +0000 https://docs.airlock.com/microgateway/5.2/configuration-guides/authentication/oidc-step-up-authentication/ This guide shows how to enforce step-up authentication using OpenID Connect (OIDC) with Airlock Microgateway. Step-up is a general authentication concept: it raises the required authentication strength for selected actions or paths. Airlock Microgateway currently supports interactive authentication via OIDC, so this article describes how to implement step-up requirements based on OIDC authentication results (e.g., required scopes and ACR values). The configuration steps below show how to extend the OIDC authentication setup with step-up requirements for selected subpaths. Configure OIDC authentication first as described in OIDC authentication, then add step-up rules in the access control policy for the paths that require stronger authentication (e.g., additional scopes or ACR values).