[THREESCALE-11474] JWT signature verification, support for ES256/ES512

[tkan145]

What

https://issues.redhat.com/browse/THREESCALE-11474

Notes

Due to lua-resty-jwt is somewhat abandon, we need to rebuild lua-resty-jwt to include the authentication bypass fix

• Create a new rockspec file. The source rockspec is from https://luarocks.org/manifests/cdbattags/lua-resty-jwt-0.2.3-0.rockspec

cat <<EOF >lua-resty-jwt-0.2.3-1.rockspec
rockspec_format = '3.0'
package = 'lua-resty-jwt'
version = '0.2.3-1'
source = {
  url = 'git://github.com/cdbattags/lua-resty-jwt',
}
description = {
  summary = 'JWT for ngx_lua and LuaJIT.',
  detailed = [[
    This library requires an nginx build
    with OpenSSL, the ngx_lua module,
    the LuaJIT 2.0, the lua-resty-hmac,
    and the lua-resty-string,
  ]],
  homepage = 'https://github.com/cdbattags/lua-resty-jwt',
  license = 'Apache License Version 2'
}
dependencies = {
  'lua >= 5.1',
  'lua-resty-openssl >= 0.6.8'
}
build = {
  type = 'builtin',
  modules = {
    ['resty.jwt'] = 'lib/resty/jwt.lua',
    ['resty.evp'] = 'lib/resty/evp.lua',
    ['resty.jwt-validators'] = 'lib/resty/jwt-validators.lua',
    ['resty.hmac'] = 'third-party/lua-resty-hmac/lib/resty/hmac.lua'
  }
}
EOF

• Pack into .rock file

luarocks pack lua-resty-jwt-0.2.3-1.rockspec

Verification steps:

1. Checkout this branch
2. Build runtime-image

make runtime-image IMAGE_NAME=apicast-test

3. Start dev-environment

cd dev-environments/keycloak-env
make gateway IMAGE_NAME=apicast-test

4. Seed keycloak data

make keycloak-data

5. Open browser and navigate to the keycloak admin page at http://127.0.0.1:9090
6. Login with username: admin and password: adminpass
7. Navigate to basic realm, then clients -> my-client -> Advanced
8. Change Access token signature algorithm to ES256, then click Save
9. Get access token

export ACCESS_TOKEN=$(make token)

10. Open another tab in the browser and navigate to http://jwt.io and paste the access token to decode. Check that "alg": "ES256"
11. Send request to APIcast

curl -v --resolve stg.example.com:8080:127.0.0.1 -H "Authorization: Bearer ${ACCESS_TOKEN}" "http://stg.example.com:8080"

12. Request should returns 200.
13. Navigate back to the keycloak portal and change Access token signature algorithm to ES512, then click Save
14. Repeat step 9 to 12