Trying to access with query string parameter. Got: "Jwks doesn't have key to match kid or alg from Jwt"

[lorenzobassi96]

I am working on Istio 1.16.

In my environment, I have:

• A Kubernetes cluster
• Keycloak IDP (external to the cluster)
• oauth2proxy installed in the Kubernetes cluster.

I want to base my Authorization on the content of the query parameter.
curl -k https://x.x.x.x/somepath/?access_token=$TOKEN

Reading the documentation, I need to use fromParam filder in the RequestAuthentication

This is my RequestAuthentication:

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: xran-idp-authn
spec:
  jwtRules:
  - fromParams:
    - access_token
    forwardOriginalToken: false
    issuer: https://registry.local/auth/realms/jma
    jwksUri: https://registry.local/auth/realms/jma/protocol/openid-connect/certs
  selector: {}

When I try to get the service,
curl -k https://X.X.X.X/somepath/?access_token=$TOKEN

I have the following:
Jwks doesn't have key to match kid or alg from Jwt

Looking at the logs in the istio sidecar, I see this:

2024-02-07T07:36:03.720238Z     debug   envoy http external/envoy/source/common/http/conn_manager_impl.cc:1680 [C21][S4126602580812274902] encoding headers via codec (end_stream=false):
':status', '401'
'www-authenticate', 'Bearer realm="https://X.X.X.X/somepath/?access_token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJQYTNub3lwY29aczl3RHNMYmxXWEJBN3lnSzd0RnhXa0RjYVlnaFF5QU9FIn0.eyJleHAiOjE3MDcyOTEzNzUsImlhdCI6MTcwNzI5MTA3NSwianRpIjoiNjVkZTM2ZmItMzgyNy00ZmZjLThlYzctMDM5NzNkNjczMDdjIiwiaXNzIjoiaHR0c", error="invalid_token"'

Can someone helm me in understanding the cause of this?
I did not find anything usefull for fixing this issue.

Thanks in advance