"nested-2": map[string]any{
						"key2": "valueC",
					},
				},
				"iss": "******@****.***",
				"sub": "sub-1",
				"exp": 4757608018.0,
			},
		},
		{
			name:  "TokenIssuer2",
			token: TokenIssuer2,
			wantClaims: map[string]any{
				"groups": []any{"group-2"},
				"iss":    "******@****.***",
				"sub":    "sub-2",
				"exp":    4715782783.0,
			},
		},
		{

)

// TestRequestAuthentication tests beta authn policy for jwt.
func TestRequestAuthentication(t *testing.T) {
	payload1 := strings.Split(jwt.TokenIssuer1, ".")[1]
	payload2 := strings.Split(jwt.TokenIssuer2, ".")[1]
	payload3 := strings.Split(jwt.TokenIssuer1WithNestedClaims2, ".")[1]
	framework.NewTest(t).
		Label(label.IPv4). // https://github.com/istio/istio/issues/35835
		Run(func(t framework.TestContext) {

							opts.HTTP.Path = "/"
							opts.HTTP.Headers = headers.New().
								WithHost(fmt.Sprintf("example.%s.com", to.ServiceName())).
								WithAuthz(jwt.TokenIssuer2).
								Build()
							opts.Check = check.Status(http.StatusForbidden)
						},
					},
					{
						name: "deny with expired token",
						customizeCall: func(opts *echo.CallOptions, to echo.Target) {

							path:   "/token2",
							allow:  false,
						},
						{
							prefix: "[Token2]",
							jwt:    jwt.TokenIssuer2,
							path:   "/token1",
							allow:  false,
						},
						{
							prefix: "[Token2]",
							jwt:    jwt.TokenIssuer2,
							path:   "/token2",
							allow:  true,
						},
						{
							prefix: "[Token3]",
							jwt:    jwt.TokenIssuer1,

				name      string
				baseToken string
			}{
				{"TokenIssuer1", jwt.TokenIssuer1},
				{"TokenIssuer1WithAud", jwt.TokenIssuer1WithAud},
				{"TokenIssuer1WithAzp", jwt.TokenIssuer1WithAzp},
				{"TokenIssuer2", jwt.TokenIssuer2},
				{"TokenIssuer1WithNestedClaims1", jwt.TokenIssuer1WithNestedClaims1},
				{"TokenIssuer1WithNestedClaims2", jwt.TokenIssuer1WithNestedClaims2},

	// Generated by: security/tools/jwt/samples/gen-jwt.py tests/common/jwt/key.pem -jwks=tests/common/jwt/jwks.json
	// --expire=3153600000 --iss=******@****.*** --sub=sub-2 --listclaim groups "group-2"
	// nolint: lll

			})

			t.NewSubTest("deny with sub-2 token").Run(func(t framework.TestContext) {
				opt := opt.DeepCopy()
				opt.HTTP.Path = "/"
				opt.HTTP.Headers = headers.New().
					WithAuthz(jwt.TokenIssuer2).
					Build()
				opt.Check = check.Status(http.StatusForbidden)
				src.CallOrFail(t, opt)
			})

			t.NewSubTest("deny with expired token").Run(func(t framework.TestContext) {