pwillie/oidc-ingress

oidc-ingress

A webhook authentication service using OIDC and cookies

Motivation for creating this service is to easily add OIDC authentication to any service running behind an Nginx Ingress controller in Kubernetes. By using cookies there is no need for client side changes and any legacy system/service can be authenticated.

Kubernetes Nginx Ingress OIDC sequence diagram

Created using: https://sequencediagram.org/

Configuration

Env Var	CMD line arg	Default Value	Notes
CLIENTS	-clients	-	OIDC clients config expressed in yaml (see below)
LISTEN	-listen	:8000	Web server listen address
INTERNAL	-internal	:9000	Internal listen address for healthz and metrics endpoints
VERSION	-version	-	When set will print version and exit

Clients

Clients env var (or cmd line arg) is a YAML formated string. For example:

- provider: https://oauth.provider.url/
  clientid: client_id
  clientsecret: client_secret
  noredirect: false (default: false)
  scopes: (default: - openid)
    - openid
    - email
    - profile

note: noredirect will suppress the ?rd={redirect url} from the path. Handy for Azure AD as querystring is stripped anyway and redirect url must match exactly.

Building

$ make build
$ ./bin/oidc-ingress

Testing

$ make test

oidc-ingress's Issues

How do you connect this up to the nginx-ingress controller?

I've just come across this - was almost prepared to write my own when I discovered your work, so thanks for making this open source.

I've got a minikube cluster running and just deployed this, then set:

ingress.kubernetes.io/auth-url: http://oidc-ingress-proxy.ingress:8000/auth/verify/myclientid

on my other service. But it's being completely ignored; as far as I can tell anyway.

Any ideas?

Cheers,
Paul