Are there any plans to add OpenID support in the nginx ingress controller like: https://github.com/pingidentity/lua-resty-openidc ?
eicnix
All 7 comments
No. That is out of the scope of the nginx ingress controller.
aledbf
on 16 Jun 2017
You can use a custom nginx configured with that module and try to use the external auth example https://github.com/kubernetes/ingress/tree/master/examples/external-auth/nginx as reference to see if it is possible to make it work like the oauth2 proxy
aledbf
on 16 Jun 2017
Ok. Thanks for the info.
eicnix
on 16 Jun 2017
@aledbf @eicnix wouldn't it make sense to make this available at the ingress decorator level? essentially plugin would check with server like keycloak if the jwt token is valid, and then based on group membership it would be able to allow or deny access to unprotected kube services. this would allow for having a single ingress grid with mapping of very many individual container protected by nginx oidc plugin in various group membership configurations all configured with decorators. swagger openapi does that perfectly https://swagger.io/docs/specification/authentication/openid-connect-discovery/ but no-one clued into making that into an ingress controller yet.
styk-tv
on 23 Aug 2018
You can use a custom nginx configured with that module and try to use the external auth example https://github.com/kubernetes/ingress/tree/master/examples/external-auth/nginx as reference to see if it is possible to make it work like the oauth2 proxy
@aledbf link is broken. Do you know where is the relevant documentation now?
It's really sad that ingress-nginx won't have support for Oidc, even if just enabling the necessary plugins and letting us configure it via config snippet.
brunojcm
on 31 Oct 2019
New Link of the documentation is:
https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/external-auth
godofdream
on 14 Nov 2019
With the new ingress-nginx plugin system you can achieve this yourself. In https://www.elvinefendi.com/2019/11/22/ingress-nginx-openidc-plugin.html I describe how to use the plugin system to add OpenID Connect support to ingress-nginx.
ElvinEfendi
on 2 Dec 2019
Related issues
cehoffman
路
3Comments
oilbeater
路
3Comments
bashofmann
路
3Comments
yuyang0
路
3Comments
natemurthy
路
3Comments
Most helpful comment
@aledbf @eicnix wouldn't it make sense to make this available at the ingress decorator level? essentially plugin would check with server like keycloak if the jwt token is valid, and then based on group membership it would be able to allow or deny access to unprotected kube services. this would allow for having a single ingress grid with mapping of very many individual container protected by nginx oidc plugin in various group membership configurations all configured with decorators. swagger openapi does that perfectly https://swagger.io/docs/specification/authentication/openid-connect-discovery/ but no-one clued into making that into an ingress controller yet.