I have a couple of web apps running on Kubernetes. To math the requests I use NGINX ingress. Currently, all applications are validating the token from our Identity Provider (I use Keycloak on dev and planning Azure Active Directory for Production) separately.
Is it possible to do the validation on the Ingress level?
For example, the user tries to enter the page. The Ingress check for a valid token and redirect if necessary to the IP. If the user is successfully logged in, the ingress controller provides the token to the app.
Nginx ingress provides ability to plugin external OAUTH authentication provider via auth-url and auth-signin annotations.
metadata:
name: application
annotations:
nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"An example of protecting kubernetes dashboard with external auth provider.
Refer to docs for more details here