Combining OIDC and JWT authentication #2425
Replies: 7 comments 23 replies
-
|
@sadovnikov are the service clients and browser clients reaching the same designation endpoint ? if not, you could split up intent (different path matches) into separate HTTPRoutes, and a different BackendTrafficPolicy config for each HTTPRoute |
Beta Was this translation helpful? Give feedback.
-
|
@zhaohuabing, thank you for the idea of using a different HTTP Route. I'll give it a try |
Beta Was this translation helpful? Give feedback.
-
|
@zhaohuabing, using two separate HTTP Routes on the same Interestingly enough, the browser clients, who do not send the |
Beta Was this translation helpful? Give feedback.
-
|
@sadovnikov Should the HTTPRoutes be at different paths？ Could you please paste the HTTPRoute and SecurityPolicy？ |
Beta Was this translation helpful? Give feedback.
-
|
I've done more tests. Now, JWT authentication takes precedence
I think, because both HTTP Routes are for the same I wonder if using both authentication methods on the same paths should be supported. With Ambassador, it's possible to control the order, in which the filters are applied, and conditionally skip the next filters.
|
Beta Was this translation helpful? Give feedback.
-
JWT tokens are used not only by scripts and server side applications , but also by SPA in a browser where same routes may be used |
Beta Was this translation helpful? Give feedback.
-
|
These two HTTPRoutes are equivalent, they both match the same requests sent to "reference-apps.platform-lab.internal.xxx.yyy/cbdp-k8s-sample-pr-195". So when the requests com in, they may be sent to one route or the other, depends on which HTTPRoute is the first one in the xDS route configuration, which is random. I suggest a configuration like this:
- apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: cbdp-k8s-sample-web-pr-195-jwt
namespace: reference-apps
spec:
hostnames:
- reference-apps.platform-lab.internal.xxx.yyy
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: default
namespace: envoy-gateway-system
rules:
- backendRefs:
- group: ""
kind: Service
name: cbdp-k8s-sample-web-pr-195
port: 80
weight: 1
matches:
- path:
type: PathPrefix
value: /cbdp-k8s-sample-pr-195/application-endpoint
- apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: cbdp-k8s-sample-web-pr-195-oidc
namespace: reference-apps
spec:
hostnames:
- reference-apps.platform-lab.internal.xxx.yyy
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: default
namespace: envoy-gateway-system
rules:
- backendRefs:
- group: ""
kind: Service
name: cbdp-k8s-sample-web-pr-195
port: 80
weight: 1
matches:
- path:
type: PathPrefix
value: /cbdp-k8s-sample-pr-195/user-endpointOr they can use different hostname such as "api.reference-apps.platform-lab.internal.xxx.yyy" and "www.reference-apps.platform-lab.internal.xxx.yyy"
I think we can put the jwt filter in front of the oauth2 filter, but I guess you wouldn't want OIDC for those requests that only need jwt. As I said, they serve different purposes. |
Beta Was this translation helpful? Give feedback.
-
|
@zhaohuabing, I understand your answer. Thank you! Most probably, now we'll go with using different hostnames. However, I think, the question of ordering and combining different authentication methods on the same "host/path" will be coming up from other users too |
Beta Was this translation helpful? Give feedback.
-
|
@sadovnikov Different authentication methods(Basic, JWT, OIDC, etc) can be combined in a Regarding the ordering, do you have any specific use cases that you need to change the order of the filters for different Route? |
Beta Was this translation helpful? Give feedback.
-
I don't see any header in the browser requests, but JWT auth lets them through. Does JWT authentication accept the
No, I do not. The current implementation may be good enough. However, if somebody adds Thanks again for your attention |
Beta Was this translation helpful? Give feedback.
-
Yes, JWT token can be extracted from cookies by configuring the |
Beta Was this translation helpful? Give feedback.
-
I was asking about this because currently we do not use |
Beta Was this translation helpful? Give feedback.
-
|
I got it. It could be a bug. Could you please raise an issue and attache related HTTPRoute and SecurityPolicy? We can track this in that issue. It will also be very useful if you could paste the configuration pushed to the envoy by execute "egctl config envoy-proxy all". If there're any sensitive information in the config, you can mask them before pasting the config. |
Beta Was this translation helpful? Give feedback.
-
|
I logged
|
Beta Was this translation helpful? Give feedback.
-
|
Not sure if this is the best place to ask but subject seems to be on point. We have OIDC provider configured as below: apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: foobar-public
spec:
targetRef:
group: gateway.networking.k8s.io
kind: HTTPRoute
name: foobar-public
# NOTE: when uncommented then shows: Jwt is not in the form of Header.Payload.Signature with two dots and 3 sections
# ^ after being successfully authenticated using OIDC
# jwt:
# providers:
# - name: jumpcloud
# remoteJWKS:
# uri: "https://oauth.id.jumpcloud.com/.well-known/jwks.json"
oidc:
provider:
issuer: "https://oauth.id.jumpcloud.com"
clientID: "FOOBAR"
clientSecret:
kind: Secret
name: "foobar-client-secret"
logoutPath: "/logout"
redirectURL: https://FOOBAR/oauth2/callback
scopes:
- openid
- emailWe can see that but how we can reference value from Cookie / Envoy / OIDC? 🤔 |
Beta Was this translation helpful? Give feedback.
-
|
@zhaohuabing shouldnt the JWT from OIDC live in |
Beta Was this translation helpful? Give feedback.
-
|
@arkodg @evilr00t We can enable A IMO, we can add an example in the user doc to show how to use jwtextractor to get the id token from OIDC. |
Beta Was this translation helpful? Give feedback.
-
|
ah thanks @zhaohuabing, what does the OIDC spec say, is the right home for the jwt ? |
Beta Was this translation helpful? Give feedback.
-
|
I'm not aware of any OIDC spec about placing the id token in HTTP headers. In the OIDC Authorization Code Flow, the id token is returned in the response body from the token endpoint. Normally, the |
Beta Was this translation helpful? Give feedback.
-
|
Raised an issue in Envoy upstream: envoyproxy/envoy#32805 to track this. |
Beta Was this translation helpful? Give feedback.
-
|
Below is a working combination of JWT and OIDC auth in Envoy gateway config Why is it not possible to achieve the same with helmchart config? http_filters:
- name: envoy.filters.http.jwt_authn
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
providers:
azure:
issuer: "https://sts.windows.net/***********************************/"
audiences: ["api://***********************************"]
remote_jwks:
http_uri:
uri: "https://login.microsoftonline.com/***********************************/discovery/v2.0/keys"
cluster: azure_provider
timeout: 10s
cache_duration:
seconds: 300
from_headers:
- name: "Authorization"
value_prefix: "Bearer "
forward: true
payload_in_metadata: "jwt_payload"
rules:
- match:
prefix: "/"
requires:
requires_any:
requirements:
- provider_name: azure
- allow_missing: {}
- name: envoy.filters.http.oauth2
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
config:
token_endpoint:
cluster: azure_provider
uri: "https://login.microsoftonline.com/***********************************/oauth2/v2.0/token"
timeout: 10s
authorization_endpoint: "https://login.microsoftonline.com/***********************************/oauth2/v2.0/authorize"
auth_scopes: "api://***********************************"
redirect_uri: "***********************************"
redirect_path_matcher:
path:
exact: /envoy/callback
signout_path:
path:
exact: /envoy/logout
credentials:
client_id: "***********************************"
token_secret:
name: "token"
sds_config:
path: "/etc/envoy/secrets/azure-secret.yaml"
hmac_secret:
name: "hmac"
sds_config:
path: "/etc/envoy/secrets/hmac.yaml"
cookie_names:
oauth_hmac: "envoy_session"
forward_bearer_token: true
disable_access_token_set_cookie: false
disable_refresh_token_set_cookie: true
disable_id_token_set_cookie: true
cookie_configs:
bearer_token_cookie_config:
same_site: "STRICT"
oauth_hmac_cookie_config:
same_site: "LAX"
pass_through_matcher:
- name: "Authorization"
string_match:
prefix: "Bearer "
key points here are: 2 OIDC filter lets through requests with Auth Bearer header - being second in the chain it relies on JWT filter that has already validated it |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
Hello When I try to use passThroughAuthHeader I get error in ArgoCD: Here's the yaml |
Beta Was this translation helpful? Give feedback.
-
|
its introduced in v1.5.0 |
Beta Was this translation helpful? Give feedback.
-
|
Great! Thanks! Below is complete working solution: |
Beta Was this translation helpful? Give feedback.
-
|
can I ask also about path string match I had Are there equivalent options in API? |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I'm testing OIDC authentication, which is planned for the
v1.0release and, so far, have not discovered any problems with OIDC implementation itself. However, I'm failing to create aSecurityPolicyor their combination to authorise requests using either JWT or OIDC.In our use case, the same URLs can be used
Currently, if OIDC authentication is configured, requests with valid JWT get redirected to the IDP.
Is there a way to configure the gateway to redirect to IDP only those requests that do not have a valid JWT token?
Beta Was this translation helpful? Give feedback.
All reactions