K
Q

Spring cloud oauth 2 with ingress kubernetes

9/20/2019

Is it possible to use spring cloud oauth 2 server with kubernetes api gateway ingress.

I have used it with zuul to authenticate user before making a call. Can I do similar with ingress?

Edit 1:

To explain it more clearly, what I am trying to achieve

I am using token based oAuth2 implementation given by the spring cloud.

  1. oauth is running as one of the service behind the zuul.
  2. zuul has routes mapped for the oauth server and resource server
  3. client call the auth server via zuul and gets the token.
  4. client call resource server via zuul with token passed
  5. zuul is configured to validate the token before making a call to resource server.

In this way we can stop any downstream traffic to go without a valid token.

can we do token validation in ingress with auth server running with in a cluster?

-- Chandresh Mishra
kubernetes
netflix-zuul
spring-boot
spring-cloud
spring-cloud-security

Similar Questions

Google cloud platform (GCP): mounting multiple volumes kubernetes
What is the relation between nodes, pods, containers? How app is replicated in cluster?
How to use GCP Local SSD with KubeDB
Hyperledger Fabric Orderer CA admin user registration fails
Kubernetes : why are my requests redirected to different pods although I set sessionAffinity to ClientIP?
At linux Server, run multiple k8s worker node, Some CPU cores are full, and most CPU cores are idle,how can I Spread the CPU load

2 Answers

11/8/2019

There are currently three different nginx-ingress-controllers (see here), which differ in functionality. I believe that none of these ingress controllers themselves can perform an oauth token introspection. However, requests can be routed to the authorization server's introspection interface using the auth_request module.

Specifically for your case, you can use the auth-url annotation (see) in the ingress controller to direct the requests to the introspection interface of the spring cloud oauth2 server (see). The introspection interface is available under /oaut/check_token by default when @EnableAuthorizationServer is used. If the introspection interface returns a 2XX, the ingress will forward the request. This functionality is based on the auth_request module, which expects a 2xx response code from the external service if the access is allowed and 401 or 403 if denied.

If you use JWTs and want to validate the request by only checking the signature, this can in some cases actually be done by the ingress itself. To my knowledge, only the nginx plus ingress controller (paid) can validate JWTs. But there is also the nginx-based kong-ingress controller, which you can equip with pulgins (see here). There is e.g. promoted with oauth2 integration and JWT validation.

Did you find out more than me?

-- Moritz Lange
Source: StackOverflow
9/20/2019

I have not used Spring Cloud OAuth 2 but as OAuth is a standard I believe you can set it up if you are using Nginx Ingress as the ingress controller, you can specify and external Oauth Provider (As OAuth generally has the same flow) like this on your ingress:

...
metadata:
  name: application
  annotations:
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
...

You can find more information here with an example of using GitHub as an OAuth provider

-- Spazzy757
Source: StackOverflow