--- title: RequestAuthentication description: Request authentication configuration for workloads. location: https://istio.io/docs/reference/config/security/request_authentication.html layout: protoc-gen-docs generator: protoc-gen-docs schema: istio.security.v1beta1.RequestAuthentication aliases: [/docs/reference/config/security/v1beta1/request_authentication] number_of_entries: 1 ---

## RequestAuthentication

RequestAuthentication defines what request authentication methods are supported by a workload. If will reject a request if the request contains invalid authentication information, based on the configured authentication rules. A request that does not contain any authentication credentials will be accepted but will not have any authenticated identity. To restrict access to authenticated requests only, this should be accompanied by an authorization rule. Examples:

- Require JWT for all request for workloads that have label `app:httpbin`

    apiVersion: security.istio.io/v1beta1
    kind: RequestAuthentication
    metadata:
      name: httpbin
      namespace: foo
    spec:
      selector:
        matchLabels:
          app: httpbin
      jwtRules:
      - issuer: "issuer-foo"
        jwksUri: https://example.com/.well-known/jwks.json
    ---
    apiVersion: security.istio.io/v1beta1
    kind: AuthorizationPolicy
    metadata:
      name: httpbin
      namespace: foo
    spec:
      selector:
        matchLabels:
          app: httpbin
      rules:
      - from:
        - source:
            requestPrincipals: ["*"]

- The next example shows how to set a different JWT requirement for a different `host`. The `RequestAuthentication` declares it can accpet JWTs issuer by either `issuer-foo` or `issuer-bar` (the public key set is implicitly set from the OpenID Connect spec).

    apiVersion: security.istio.io/v1beta1
    kind: RequestAuthentication
    metadata:
      name: httpbin
      namespace: foo
    spec:
      selector:
        matchLabels:
          app: httpbin
      jwtRules:
      - issuer: "issuer-foo"
      - issuer: "issuer-bar"
    ---
    apiVersion: security.istio.io/v1beta1
    kind: AuthorizationPolicy
    metadata:
      name: httpbin
      namespace: foo
    spec:
      selector:
        matchLabels:
          app: httpbin
     rules:
     - from:
       - source:
           requestPrincipals: ["issuer-foo/*"]
       to:
         hosts: ["example.com"]
     - from:
       - source:
           requestPrincipals: ["issuer-bar/*"]
       to:
         hosts: ["another-host.com"]

- You can fine tune the authorization policy to set different requirement per path. For example, to require JWT on all paths, except /healthz, the same `RequestAuthentication` can be used, but the authorization policy could be:

    apiVersion: security.istio.io/v1beta1
    kind: AuthorizationPolicy
    metadata:
      name: httpbin
      namespace: foo
    spec:
      selector:
        matchLabels:
          app: httpbin
     rules:
     - from:
       - source:
           requestPrincipals: ["*"]
     - to:
       - operation:
           paths: ["/healthz]

Field | Type | Description | Required
--- | --- | --- | ---
`selector` | `WorkloadSelector` | The selector determines the workloads to apply the RequestAuthentication on. If not set, the policy will be applied to all workloads in the same namespace as the policy. | No
`jwtRules` | `JWTRule[]` | Define the list of JWTs that can be validated at the selected workloads’ proxy. A valid token will be used to extract the authenticated identity. Each rule will be activated only when a token is presented at the location recorgnized by the rule. The token will be validated based on the JWT rule config. If validation fails, the request will be rejected. Note: if more than one token is presented (at different locations), the output principal is nondeterministic. | No