# Use downstream identity provider's token directly (JWT Forwarding) **URL:** \ **Category:** Support\ **Tags:** idp\ **Created:** [November 1, 2021, 4:26pm UTC](https://discuss.pomerium.com/t/use-downstream-identity-providers-token-directly-jwt-forwarding/30 "2021-11-01T16:26:04Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\ **Post date:** [November 1, 2021, 4:26pm UTC](https://discuss.pomerium.com/t/use-downstream-identity-providers-token-directly-jwt-forwarding/30/1 "2021-11-01T16:26:04Z")
> [@](#): > > [**View in #support on Slack**](https://slack.com/archives/CK92MUAES/p1635350620013100) > > ![Rayane_BELLAZAAR](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/bc1ad8821e5d570fbaae8d74f586b3f921d0b791.png) **@Rayane\_BELLAZAAR:** Hi everyone, > I have an application exposed behind pomerium proxy which are waiting for a header: `Authorization Bearer` and when I set my route with the properties `pass_identity_headers: true` its not enough and I don’t see any Authorization Header. I know that its not a new subject for you _(I see a lot of messages about this problem)_ but, can we do something or do you have a workaround for this problem ? > Thanks > > ![Caleb_Doxsey](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/2ae298c09a39e80b418afe69971e1bf8296942ad.jpeg) **@Caleb\_Doxsey:** The identity headers are: > > • X-Pomerium-Jwt-Assertion > • X-Pomerium-Claim-\* > We don’t pass an Authorization header > > ![Rayane_BELLAZAAR](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/bc1ad8821e5d570fbaae8d74f586b3f921d0b791.png) **@Rayane\_BELLAZAAR:** @Caleb\_Doxsey thanks your your reply so there is no way to rewrite this header by using [https://www.pomerium.io/reference/#jwt-claim-headers](https://www.pomerium.io/reference/#jwt-claim-headers) ? > > > Settings | Pomerium > > ![Caleb_Doxsey](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/2ae298c09a39e80b418afe69971e1bf8296942ad.jpeg) **@Caleb\_Doxsey:** I’ve not tried setting the Authorization header in this way. It seems like it wouldn’t be very useful because the claim would need to include `Bearer ...` and there’s no way to use string manipulation to add the prefix. > > It is possible to add an Authorization header that doesn’t change via set\_request\_header: [https://www.pomerium.io/reference/#set-request-headers](https://www.pomerium.io/reference/#set-request-headers) > > > Settings | Pomerium > > ![Rayane_BELLAZAAR](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/bc1ad8821e5d570fbaae8d74f586b3f921d0b791.png) **@Rayane\_BELLAZAAR:** @Caleb\_Doxsey Yes but The solution behind is waiting for the JWT and it changes when it is expired so I think we can’t use this > > ![Caleb_Doxsey](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/2ae298c09a39e80b418afe69971e1bf8296942ad.jpeg) **@Caleb\_Doxsey:** So you want the `X-Pomerium-Jwt-Assertion` header to be in `Authorization` instead? (prefixed with Bearer?) > > ![Rayane_BELLAZAAR](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/bc1ad8821e5d570fbaae8d74f586b3f921d0b791.png) **@Rayane\_BELLAZAAR:** @Caleb\_Doxsey exactly. The application exposed behind is waiting for this header name :[https://kiali.io/docs/configuration/authentication/header/#http-header](https://kiali.io/docs/configuration/authentication/header/#http-header) > > > Kiali: Header strategy > > ![Caleb_Doxsey](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/2ae298c09a39e80b418afe69971e1bf8296942ad.jpeg) **@Caleb\_Doxsey:** we typically support a use case like this via a service account. For example with Kubernetes: > > [https://www.pomerium.io/guides/kubernetes.html#pomerium-service-account](https://www.pomerium.io/guides/kubernetes.html#pomerium-service-account) > > The JWT we generate is Pomerium-specific and not the same JWT that an identity provider would give us. I’m not sure that even if we had a mechanism for constructing the header in this way it would actually work, because the token wouldn’t be in the format the application expected it. > > It looks like this Kiall product supports impersonation with headers. We have a special Kubernetes integration to construct headers like this. Maybe it would also work for this product? > > > Kubernetes API / Kubectl | Pomerium > > This strategy: > [https://kiali.io/docs/configuration/authentication/token/](https://kiali.io/docs/configuration/authentication/token/) > > Basically we use a single account for the app, but use impersonation headers to specify the user > > > Kiali: Token strategy > > ![Rayane_BELLAZAAR](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/bc1ad8821e5d570fbaae8d74f586b3f921d0b791.png) **@Rayane\_BELLAZAAR:** @Caleb\_Doxsey the main paint point is we are using okta and our user should be authenticated through this provider. > > ![Caleb_Doxsey](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/2ae298c09a39e80b418afe69971e1bf8296942ad.jpeg) **@Caleb\_Doxsey:** We don’t support forwarding the JWT directly to a downstream application. In general we don’t want to expose the identity token because we can’t restrict access to the IdP if we forward it. We also are merging additional information that’s not available in the identity token. For example groups are synchronized separately with a service account > > ![Rayane_BELLAZAAR](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/bc1ad8821e5d570fbaae8d74f586b3f921d0b791.png) **@Rayane\_BELLAZAAR:** @Caleb\_Doxsey Ok I understand thanks you for your reply! ---
**Author:** ![bobby](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/bobby/32/1_2.png) [@bobby](https://discuss.pomerium.com/u/bobby)\ **Post date:** [November 1, 2021, 5:27pm UTC](https://discuss.pomerium.com/t/use-downstream-identity-providers-token-directly-jwt-forwarding/30/2 "2021-11-01T17:27:34Z")
This feature is currently being tracked: [option to pass oAuth access token as authorization header to upstream · Issue #1915 · pomerium/pomerium · GitHub](https://github.com/pomerium/pomerium/issues/1915)