# Keycloak 21 and Istio 1.17 return 401 Invalid Token - Jwt issuer is not configured

**URL:** <https://forum.keycloak.org/t/keycloak-21-and-istio-1-17-return-401-invalid-token-jwt-issuer-is-not-configured/20501>\
**Category:** Securing applications\
**Created:** [February 26, 2023, 11:40am UTC](https://forum.keycloak.org/t/keycloak-21-and-istio-1-17-return-401-invalid-token-jwt-issuer-is-not-configured/20501 "2023-02-26T11:40:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonathanvila](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jonathanvila/32/1481_2.png) [@jonathanvila](https://forum.keycloak.org/u/jonathanvila)\
**Post date:** [February 26, 2023, 11:40am UTC](https://forum.keycloak.org/t/keycloak-21-and-istio-1-17-return-401-invalid-token-jwt-issuer-is-not-configured/20501/1 "2023-02-26T11:40:48Z")

</div>

I have installed istio and keycloak (ns keycloak) in a minikube.

Created a RequestAuthentication and a AuthorizationPolicy:

```auto
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: requestauth
  namespace: default
spec:
  selector:
    matchLabels:
      app: quarkus
  jwtRules:
    - issuer: "http://keycloak.keycloak.svc.cluster.local:8080/realms/demo"
      jwksUri: "http://keycloak.keycloak.svc.cluster.local:8080/realms/demo/protocol/openid-connect/certs"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: authpolicy
  namespace: default
spec:
  selector:
    matchLabels:
      app: quarkus
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]

```

And after getting the token :

```auto
  curl \
  -sk \
  --data "username=quarkus&password=quarkuspwd&grant_type=password&client_id=istio" \
  https://keycloak.192.168.49.2.nip.io/realms/demo/protocol/openid-connect/token \ 
  | jq ".access_token"

```

I do a call to my service :

```auto
curl -sv -H "Authorization: Bearer $token" "http://$GATEWAY_URL/echo/productpage"

```

it always return an error :

```auto
* Trying 10.98.21.200:80...
* Connected to 10.98.21.200 (10.98.21.200) port 80 (#0)
> GET /echo/productpage HTTP/1.1
> Host: 10.98.21.200
> User-Agent: curl/7.87.0
> Accept: */*
> Authorization: Bearer eyJhbG........
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< www-authenticate: Bearer realm="http://10.98.21.200/echo/productpage", error="invalid_token"
< content-length: 28
< content-type: text/plain
< date: Fri, 24 Feb 2023 17:12:33 GMT
< server: istio-envoy
< 
* Connection #0 to host 10.98.21.200 left intact
Jwt issuer is not configured%         

```

If I send a wrong header in the call :

```auto
curl -sv -H "AuthorizationXX: Bearer $token" "http://$GATEWAY_URL/echo/productpage"

```

I receive as expected , an RBAC error:

```auto
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden
< content-length: 19
< content-type: text/plain
< date: Sun, 26 Feb 2023 11:39:30 GMT
< server: istio-envoy
< x-envoy-upstream-service-time: 14
< 
* Connection #0 to host 10.98.21.200 left intact
RBAC: access denied%                                                                                                                                         

```

---

<div class="post-metadata">

**Author:** ![jonathanvila](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jonathanvila/32/1481_2.png) [@jonathanvila](https://forum.keycloak.org/u/jonathanvila)\
**Post date:** [February 27, 2023, 9:15am UTC](https://forum.keycloak.org/t/keycloak-21-and-istio-1-17-return-401-invalid-token-jwt-issuer-is-not-configured/20501/2 "2023-02-27T09:15:21Z")

</div>

I have checked with other JWT sources and apparently is not anything related to keycloak.

My apologies.