Application-gateway-kubernetes-ingress: Auth Proxy Support

Created on 18 May 2020 · 9Comments · Source: Azure/application-gateway-kubernetes-ingress

Is your feature request related to a problem? Please describe.
The customer I'm working with requires JWT OAUTH2 token validation for all ingress activity. We're unclear with available approaches for setting up an authentication proxy for our frontend AGIC route. Our identity provider is AAD.

Nginx supports service authentication today

annotations:
  kubernetes.io/ingress.class: nginx
  nginx.ingress.kubernetes.io/auth-url: "http://oauth2-proxy.default.svc.cluster.local:4180/oauth2/auth"
  nginx.ingress.kubernetes.io/auth-signin: "http://<DNS prefix>.<azure region>.cloudapp.azure.com/oauth2/start"

Are there any alternative approaches that would support this use-case?

Describe the solution you'd like
A new annotation in the AGIC where we can provide the authentication url and signin endpoint for the ingress controller.

feature auth

Source

erikschlegel

👍14

Most helpful comment

This feature is needed and is preventing my company from moving to the AG Ingress Controller.
It would also be useful to have this feature working without having to run oauth2-proxy in the cluster.

IvanJosipovic on 15 Aug 2020

👍5

All 9 comments

This feature is needed and is preventing my company from moving to the AG Ingress Controller.
It would also be useful to have this feature working without having to run oauth2-proxy in the cluster.

IvanJosipovic on 15 Aug 2020

👍5

@caya @erikschlegel Do either of you know if there has been an update on this ask? We have another customer with similar query as below:

"Does Application gateway ingress controller supports JWT validation?
We need to perform JWT Oauth Token validation for all ingress activities in aks.
Nginx support this feature through
location / { proxy_pass: } Or annotations: nginx.ingress.kubernetes.io/auth-url:
Does Application Gateway Ingress Controller(standard v2 sku) supports this functionality."

Karishma-Tiwari-MSFT on 24 Sep 2020

OAuth is not currently supported on AppGW, but is on our roadmap. Until we support it on AppGW, we won't have support for it on AGIC. I can update this thread once it's available on AppGW.

mscatyao on 25 Sep 2020

👍2

Is there a workaround for this?
I'm trying to use oauth2 proxy image as a sidecar to things I want to add auth proxy. I'm getting some weird errors on oauth2 container. From what I read it seems like AGIC is rewriting some stuff oauth container was looking for like cookie, headers etc. Can I configure AGIC to be less abrasive?

alchemistake on 25 Jan 2021

Hi, are there any news on the subject?

jonno85 on 31 May 2021

👍1

There is a workaround with APIM + AGIC, but that is not feasible (because of high cost). Application Gateway should support Authentication similar to APIM.