I have a GKE Backend with GLCB(using Ingress-GCP, routing done based on path to various bakend service). My need is to verify the token in the header and pass the request to the backend iff it is valid token. And to check the validity of token i need to pass to the firebase. Once firebase say's OK then route to the correct backend.
I was initially using ingress-GCE but seems this can be only achieved by using Istio. Can any one suggest how to do istio based end user authentication ?
You can use AuthorizationPolicy and RequestAuthentication to do this. There is example about that in istio documentation.
What Istio does in the RequestAuthentication ?
As mentioned here
RequestAuthentication defines what request authentication methods are supported by a workload. If will reject a request if the request contains invalid authentication information, based on the configured authentication rules. A request that does not contain any authentication credentials will be accepted but will not have any authenticated identity. To restrict access to authenticated requests only, this should be accompanied by an authorization rule.
As mentioned here
issuer -> Identifies the issuer that issued the JWT. See issuer A JWT with different iss claim will be rejected.
Example: https://foobar.auth0.com Example: 1234567-compute@developer.gserviceaccount.com
jwksUri -> URL of the provider’s public key set to validate signature of the JWT. See OpenID Discovery.
There are 2 examples of jwtRules and jwskUri for firebase.
Additionall resources:
