Bypass JWT signature validation via a build-time flag instead of config

platform-api/config/config.go

@@ -330,6 +330,37 @@ type JWT struct {
 	TokenTTL       time.Duration `koanf:"token_ttl"`
 }
 
+// skipJWTValidation is stamped in at BUILD time via ldflags, exactly like the
+// binary's version (-X ...config.skipJWTValidation=true) — it is deliberately NOT
+// a config-file field. Disabling JWT signature validation is a property of a
+// specific build (the cloud build fronted by a trusted mediation layer on a
+// private network that has already authenticated the caller and forwards an
+// unsigned internal token carrying the org context), never a runtime toggle an
+// operator could flip on an internet-facing deployment. The empty default that
+// every normal build carries means strict validation.
+var skipJWTValidation string
+
+// skipJWTValidationEnabled is the parsed skipJWTValidation, evaluated once at
+// package initialization (the ldflags value is fixed at link time) so
+// SkipJWTValidation() is a plain field read on the hot authentication path.
+var skipJWTValidationEnabled = parseSkipJWTValidation(skipJWTValidation)
+
+// parseSkipJWTValidation reports whether the build-time flag value enables the
+// bypass: true only for the literal "true" (case-insensitive, surrounding space
+// trimmed); any other value keeps strict validation.
+func parseSkipJWTValidation(v string) bool {
+	return strings.EqualFold(strings.TrimSpace(v), "true")
+}
+
+// SkipJWTValidation reports whether this build disables JWT signature and issuer
+// verification in "internal_token" mode (see skipJWTValidation). DANGEROUS: it
+// makes unsigned ("none") tokens acceptable, so it must only be true in a build
+// deployed behind a trusted mediation layer on a private network. Ignored in
+// "file" and "idp" modes.
+func SkipJWTValidation() bool {
+	return skipJWTValidationEnabled
+}
+
 // LoadPublicKey reads and parses the PEM-encoded RSA public key from
 // PublicKeyFile. The file is read fresh on every call rather than cached,
 // so PublicKeyFile is a mounted-file path, never inlined PEM content.

platform-api/config/skip_jwt_validation_test.go

@@ -0,0 +1,45 @@
+/*
+ *  Copyright (c) 2025, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package config
+
+import "testing"
+
+// parseSkipJWTValidation backs the ldflags-stamped build var. It is true only for
+// the literal "true" (case-insensitive, surrounding space trimmed) — the empty
+// value every normal build carries, and any other value, keep strict validation.
+func TestParseSkipJWTValidation(t *testing.T) {
+	cases := []struct {
+		name string
+		val  string
+		want bool
+	}{
+		{"empty default is strict", "", false},
+		{"explicit false", "false", false},
+		{"arbitrary value is strict", "1", false},
+		{"true enables bypass", "true", true},
+		{"uppercase TRUE", "TRUE", true},
+		{"padded true", "  true  ", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := parseSkipJWTValidation(tc.val); got != tc.want {
+				t.Errorf("parseSkipJWTValidation(%q) = %v, want %v", tc.val, got, tc.want)
+			}
+		})
+	}
+}

platform-api/internal/middleware/auth_skip_validation_test.go

@@ -0,0 +1,102 @@
+/*
+ *  Copyright (c) 2025, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// unsignedToken builds an alg:none JWT with the given claims, mirroring the
+// unsigned internal token a trusted mediation layer forwards.
+func unsignedToken(t *testing.T, claims jwt.MapClaims) string {
+	t.Helper()
+	tok := jwt.NewWithClaims(jwt.SigningMethodNone, claims)
+	s, err := tok.SignedString(jwt.UnsafeAllowNoneSignatureType)
+	if err != nil {
+		t.Fatalf("sign unsigned token: %v", err)
+	}
+	return s
+}
+
+func serve(mw func(http.Handler) http.Handler, token string, next http.HandlerFunc) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(http.MethodGet, "/api/v0.9/environments", nil)
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	rec := httptest.NewRecorder()
+	mw(next).ServeHTTP(rec, req)
+	return rec
+}
+
+// With SkipValidation, an unsigned token is accepted and its organization claim
+// is enriched into the request context for GetOrganizationFromRequest.
+func TestLocalJWTAuthMiddleware_SkipValidation_AcceptsUnsignedAndResolvesOrg(t *testing.T) {
+	mw := LocalJWTAuthMiddleware(AuthConfig{SkipValidation: true})
+	token := unsignedToken(t, jwt.MapClaims{"organization": "org-uuid-123", "sub": "system"})
+
+	var gotOrg string
+	var called bool
+	rec := serve(mw, token, func(w http.ResponseWriter, r *http.Request) {
+		called = true
+		gotOrg, _ = GetOrganizationFromRequest(r)
+	})
+
+	if !called {
+		t.Fatalf("next handler not called; status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	if gotOrg != "org-uuid-123" {
+		t.Errorf("organization = %q, want org-uuid-123", gotOrg)
+	}
+}
+
+// Even with SkipValidation, a token missing the organization claim is rejected.
+func TestLocalJWTAuthMiddleware_SkipValidation_RejectsMissingOrgClaim(t *testing.T) {
+	mw := LocalJWTAuthMiddleware(AuthConfig{SkipValidation: true})
+	token := unsignedToken(t, jwt.MapClaims{"sub": "system"})
+
+	called := false
+	rec := serve(mw, token, func(http.ResponseWriter, *http.Request) { called = true })
+
+	if called {
+		t.Fatal("next handler should not be called when the org claim is absent")
+	}
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("status = %d, want 401", rec.Code)
+	}
+}
+
+// Without SkipValidation, an unsigned (alg:none) token is rejected — signature
+// enforcement stays strict by default.
+func TestLocalJWTAuthMiddleware_StrictByDefault_RejectsUnsigned(t *testing.T) {
+	mw := LocalJWTAuthMiddleware(AuthConfig{SkipValidation: false})
+	token := unsignedToken(t, jwt.MapClaims{"organization": "org-uuid-123"})
+
+	called := false
+	rec := serve(mw, token, func(http.ResponseWriter, *http.Request) { called = true })
+
+	if called {
+		t.Fatal("next handler should not be called for an unsigned token under strict validation")
+	}
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("status = %d, want 401", rec.Code)
+	}
+}

platform-api/internal/server/server.go

@@ -673,6 +673,22 @@ func buildClaimMappings(cm config.ClaimMappings, roleScopeMap map[string][]strin
 // its own local-JWT middleware).
 func buildAuthenticator(cfg *config.Server, slogger *slog.Logger, roleScopeMap map[string][]string) (middleware.Authenticator, error) {
 	if cfg.Auth.Mode != config.AuthModeIDP {
+		// Signature-validation bypass: only for builds fronted by a trusted
+		// mediation layer on a private network that has already authenticated the
+		// caller and forwards an unsigned internal token carrying the org context
+		// (see config.SkipJWTValidation — a build-time flag, not a config field).
+		// No public key is loaded; claims are still read.
+		if config.SkipJWTValidation() {
+			slogger.Warn("Auth mode: internal_token with signature validation DISABLED (build-time config.skipJWTValidation=true) — accepting unsigned tokens; use ONLY behind a trusted mediation layer on a private network")
+			return middleware.NewJWTAuthenticator(
+				middleware.LocalJWTAuthMiddleware(middleware.AuthConfig{
+					TokenIssuer:    cfg.Auth.JWT.Issuer,
+					SkipPaths:      cfg.Auth.SkipPaths,
+					SkipValidation: true,
+					ClaimMappings:  buildClaimMappings(cfg.Auth.ClaimMappings, roleScopeMap),
+				}),
+			), nil
+		}
 		slogger.Info("Auth mode: jwt (asymmetric RS256 signature validation enabled)")
 		publicKey, err := cfg.Auth.JWT.LoadPublicKey()
 		if err != nil {