Debug Origin authentication failed

The Origin authentication failed. message is specific to JWT token authorization and is returned by the Istio proxy. When this happens, it means that the JWT token itself could not be validated and the request never reaches the Mixer adapter.

Check your token

apigee-istio -o theganyo1-eval -e test token inspect -f path/to/file

or

apigee-istio -o theganyo1-eval -e test token inspect <<< "<your token>"

Check your authentication policy

The targets section must include your Istio service:

targets:
- name: helloworld

Your issuer and jwks_uri should match your Apigee org and env:

origins:
- jwt:
    issuer: https://organization-env.apigee.net/istio-auth/token
    jwks_uri: https://organization-env.apigee.net/istio-auth/certs

Check the deployed authentication policy

istioctl get policy <your policy name> -o yaml

The output should match your authentication policy.

Check the proxy logs on your service pod

kubectl logs helloworld-v1-679bf9b67b-2mts4 istio-proxy

You should see some logging that starts like this:

Loaded JwtAuthConfig: {
"rules": [
 {
  "issuer": "https://theganyo1-eval-test.apigee.net/istio-auth/token",
  "local_jwks": { ...

It should match your authentication policy.