Skipper: OAuth ingress proxy

[MarcusNoble]

Is it possible to use Skipper as an OAuth proxy with things like GitHub / Google? (Similar to https://github.com/helm/charts/tree/master/stable/oauth2-proxy)

The docs talk about OAuth / JWT but aren't really clear on how they're used. Is there any real-world example on how to achieve this kind of thing?

[szuecs]

Hi!
I guess you want openID connect which is not supported until https://github.com/zalando/skipper/pull/743 is merged. We only support tokeninfo (no rfc but a known protocol) and tokenintrospection as defined in the rfc as documented for svc-to-svc authentication and authorization.
I am not sure what we miss in the documentation to make it more clear. I would happy to get some suggestions for enhancing it.
I tried to look into docs from oauth-proxies, but I never understand (have to guess) what they use as protocol, but maybe we can add something that makes it more clear what we provide and what not.
What do you think we should have?
Maybe use cases?

[MarcusNoble]

Thanks for the reply. I feel it's my lack of understanding around oauth / openID that's causing my confusion.

As to my specific use case, I'm trying to make the Kubernetes Dashboard available via some authentication mechanism we already use (such as GitHub or LDAP) rather than the token-based access it implements itself. Though I do think this would be a nice thing more wide-spread for our internal applications so they don't each need their own authentication mechanism.

From what I can tell oauth2-proxy provided this capability but required the nginx ingress (and is now deprecated anyway).

[mikkeloscar]

@MarcusNoble #743 should solve exactly this problem.

[MarcusNoble]

That's great to hear. Thanks. Subscribed to that PR :)

[szuecs]

If you need ldap or whatever custom integration you can also use https://opensource.zalando.com/skipper/reference/filters/#webhook.

On the other hand #743 should implement the most clean solution for UI tools and public IAM providers like github, google, ...

[MarcusNoble]

I have just come across this issue related to authentication on ALBs: https://github.com/zalando-incubator/kube-ingress-aws-controller/issues/166

If implemented could this also be used with Skipper? I wasn't aware that ALBs could have built in authentication, it looks like a very handy feature.

Alternatively, is it possible to create an authenticated ALB manually and specify to skipper / kube-ingress to use that ALB?

[mikkeloscar]

Alternatively, is it possible to create an authenticated ALB manually and specify to skipper / kube-ingress to use that ALB?

Not really, we don't have the support for that for now.

I think it's simpler to implement this in skipper as we already have an open PR. Having it in the ingress-controller to configure the ALB might also be good, but is probably more work if you just want a working solution for now :)

[MarcusNoble]

Just incase people get here for a similar reason I did:

I managed to create an authenticated kubernetes dashboard by following the tutorial at the bottom of this post: https://blog.heptio.com/on-securing-the-kubernetes-dashboard-16b09b1b7aca

I used Skipper instead of Contour without any issues. Worked with GitHub for me but don't see why it wouldn't work for any other OAuth2 compatible provider.

[aryszka]

thanks for sharing this!

[szuecs]

I think we can close this issue and document in #822 #898 how the OpenID Connect filters implemented by #743 work.

[MarcusNoble]

Did you mean #898 ?

[szuecs]

yes @MarcusNoble , I edited my comment