I have a sample application (web-app, backend-1, backend-2) deployed on minikube all under a JWT policy, and they all have proper destination rules, Istio sidecar and MTLS enabled in order to secure the east-west traffic.

apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: oidc
spec:
  targets:
  - name: web-app
  - name: backend-1
  - name: backend-2
  peers:
  - mtls: {}
  origins:
  - jwt:
      issuer: "http://myurl/auth/realms/test"
      jwksUri: "http://myurl/auth/realms/test/protocol/openid-connect/certs"
  principalBinding: USE_ORIGIN

When I run the following command I receive a 401 unauthorized response when requesting the data from the backend, which is due to $TOKEN not being forwarded to backend-1 and backend-2 headers during the http request.

gt; curl http://minikubeip/api "Authorization: Bearer $TOKEN"

Is there a way to forward http headers to backend-1 and backend-2 using native kubernetes/istio? Am I forced to make application code changes to accomplish this?

Edit: This is the error I get after applying my oidc policy. When I curl web-app with the auth token I get

{"errors":[{"code":"APP_ERROR_CODE","message":"401 Unauthorized"}

Note that when I curl backend-1 or backend-2 with the same auth-token I get the appropriate data. Also, there is no other destination rule/policy applied to these services currently, policy enforcement is on, and my istio version is 1.1.15. This is the policy I am applying:

apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: default
  namespace: default
spec:
  # peers:
  # - mtls: {}
  origins:
  - jwt:
      issuer: "http://10.148.199.140:8080/auth/realms/test"
      jwksUri: "http://10.148.199.140:8080/auth/realms/test/protocol/openid-connect/certs"
  principalBinding: USE_ORIGIN