1

Is it possible to use spring cloud oauth 2 server with kubernetes api gateway ingress.

I have used it with zuul to authenticate user before making a call. Can I do similar with ingress?

Edit 1:

To explain it more clearly, what I am trying to achieve

I am using token based oAuth2 implementation given by the spring cloud.

  1. oauth is running as one of the service behind the zuul.
  2. zuul has routes mapped for the oauth server and resource server
  3. client call the auth server via zuul and gets the token.
  4. client call resource server via zuul with token passed
  5. zuul is configured to validate the token before making a call to resource server.

In this way we can stop any downstream traffic to go without a valid token.

can we do token validation in ingress with auth server running with in a cluster?

Chandresh Mishra
  • 1,081
  • 3
  • 24
  • 45

2 Answers2

2

I have not used Spring Cloud OAuth 2 but as OAuth is a standard I believe you can set it up if you are using Nginx Ingress as the ingress controller, you can specify and external Oauth Provider (As OAuth generally has the same flow) like this on your ingress:

...
metadata:
  name: application
  annotations:
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
...

You can find more information here with an example of using GitHub as an OAuth provider

Spazzy757
  • 889
  • 4
  • 20
  • Please see the edit 1 . can we achieve this ? spring cloud auth also provide 2 url : oauth/token and oauth/authorize – Chandresh Mishra Sep 20 '19 at 09:10
  • oauth2 is an open standard, so technically I would say yes you can get this to work, there is a full description of all the annotations [here](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication) – Spazzy757 Sep 20 '19 at 09:48
  • could i have a service dedicated for that inside the cluster, exposed as nodeport for oauth and then a ingress or and ambassador filter accessing that ? – Tiago Medici Apr 23 '20 at 17:48
0

There are currently three different nginx-ingress-controllers (see here), which differ in functionality. I believe that none of these ingress controllers themselves can perform an oauth token introspection. However, requests can be routed to the authorization server's introspection interface using the auth_request module.

Specifically for your case, you can use the auth-url annotation (see) in the ingress controller to direct the requests to the introspection interface of the spring cloud oauth2 server (see). The introspection interface is available under /oaut/check_token by default when @EnableAuthorizationServer is used. If the introspection interface returns a 2XX, the ingress will forward the request. This functionality is based on the auth_request module, which expects a 2xx response code from the external service if the access is allowed and 401 or 403 if denied.

If you use JWTs and want to validate the request by only checking the signature, this can in some cases actually be done by the ingress itself. To my knowledge, only the nginx plus ingress controller (paid) can validate JWTs. But there is also the nginx-based kong-ingress controller, which you can equip with pulgins (see here). There is e.g. promoted with oauth2 integration and JWT validation.

Did you find out more than me?

Moritz Lange
  • 1
  • 2