0

What I want to do

Calling an URL which is proxied by the oauth2 proxy. The oauth2 proxy should perform an authorization code flow in case no authentication is available. In case there is already an authentication available, the access token should be set to the Authorization Header in the request which is forwarded to the upstream.

What I tried

According to the documentation I'd expect that, when setting --pass-authorization-header the token which is requested should be added to the authorization header.

I also experimented with --pass-access-token which should set an X-Forwarded-Access-Token header. I couldn't see this header at my service either.

Could someone explain to me what I'm doing wrong?

Yannic Bürgmann
  • 6,301
  • 5
  • 43
  • 77
  • It's not clear to me, but is this related to your problem? https://github.com/oauth2-proxy/oauth2-proxy/issues/827 – Swiss Oct 30 '20 at 18:37

1 Answers1

1

I found the solution.

This post on a github issue lead me to my mistake.

I did misunderstand what the request is and what the response is and how to handle them using nginx ingresses.

If you are using OAuth2-Proxy with a Kubernetes ingress using nginx subrequests (https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/) the data that comes back to nginx is actually an HTTP response, so you will need to use HTTP Response headers (the --pass-* options configure request headers to the upstream). Try --set-authorization-header and then you need to use this annotation to have the Kubernetes take the subrequest response header and add it to the proxied request header: nginx.ingress.kubernetes.io/auth-response-headers https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication

Yannic Bürgmann
  • 6,301
  • 5
  • 43
  • 77