Kubernetes Nginx-Ingress oauth_proxy how to pass information/token to service

1/20/2020

I am running a Kubernetes Cluster with an Nginx-ingress fronting couple of web apps. Because Nginx doesn't support SSO/OIDC by default, I use an oauth_proxy for authentication.

Everything is working, only verified users are able to access the web pages.

Is it possible to pass or request information from the Identity Provider to the client?

Edit

I already use oauth2_proxy (https://github.com/pusher/oauth2_proxy) with Azure AD. The issue is that I need all user details from the IP.

Logs from my oauth2_proxy:

$ kubectl logs oauth2-proxy-7ddc97f9d5-ckm29
[oauthproxy.go:846] Error loading cookied session: Cookie "_oauth2_proxy" not present
...
[requests.go:25] 200 GET https://graph.windows.net/me?api-version=1.6 {
  "odata.metadata":"https://graph.windows.net/myorganization/$metadata#directoryObjects/@Element",
  "odata.type":"Microsoft.DirectoryServices.User",
  "objectType":"User", 
  ... ,
  "sipProxyAddress":"nico.schuck@example.com",
  "streetAddress":"my stree",
  "surname":"Schuck",
  "telephoneNumber":55512345,
  "usageLocation":"DE",
  "userType":"Member"
}
165.xxx.xxx.214 - nico.schuck@example.com [2020/01/17 11:22:02] [AuthSuccess] Authenticated via OAuth2: Session{email:nico.schuck@example.com user: token:true id_token:true created:2020-01-17 11:22:02.28839851 +0000 UTC m=+181.592452463 expires:2020-01-17 12:22:02 +0000 UTC refresh_token:true}
-- Nico Schuck
kubernetes
nginx-ingress

1 Answer

1/20/2020

Consider oauth2_proxy which works well with nginx ingress for SSO. Follow the below link

https://github.com/bitly/oauth2_proxy

You should be using below configuration in your Ingress Rule

metadata:
  name: application
  annotations:
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
-- P Ekambaram
Source: StackOverflow