Closed vakrat1 closed 4 years ago
Hi there,
Thank you for reporting this! Could you post your Ambassador config for the AuthService? My initial guess is that it's set up so that /events gets dropped when requests are routed there so the OAuth client thinks the user is trying to access /. If the AuthService really gets the original URL, I'm interested in whats stored within Redis in the middle of the authentication redirect (when you haven't yet returned from Keycloak to the service).
This software only stores the requested URL and then redirects back to it when the authentication is done, so if it would return something else than it sees it really is a bug. The only time user is redirected to / is when we see an outdated session and user is forced to re-auth with Keycloak.
Hi Appreciate so much your time and effort.
As for the Ambassador config for the AuthService, do you mean this configuration?
---
apiVersion: v1
kind: Service
metadata:
name: ambassador-oidc-auth
annotations:
getambassador.io/config: |
---
apiVersion: ambassador/v0
kind: AuthService
name: authentication
auth_service: "oidc-auth:9090"
proto: http
allowed_headers:
- "X-Auth-Userinfo"
---
apiVersion: ambassador/v0
kind: Mapping
name: login_mapping
prefix: /login
rewrite: /login
service: oidc-auth:9090
spec:
type: ClusterIP
selector:
app: oidc-auth
ports:
- port: 9090
name: http-oidc-auth
targetPort: http-api
Here is also the deployment.yaml file of the oidc-auth middleware:
---
apiVersion: v1
kind: Service
metadata:
name: oidc-auth
spec:
type: ClusterIP
selector:
app: oidc-auth
ports:
- port: 9090
name: http-oidc-auth
targetPort: http-api
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: oidc-auth
spec:
replicas: 1
strategy:
type: RollingUpdate
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
labels:
app: oidc-auth
spec:
containers:
- name: oidc-auth
image: ajmyyra/ambassador-auth-oidc:1.3
imagePullPolicy: Always
ports:
- name: http-api
containerPort: 9090
env:
- name: PORT
value: "9090"
- name: REDIS_ADDRESS
value: "localhost:6379"
- name: OIDC_SCOPES
value: "profile email"
- name: JWT_HMAC_SECRET
valueFrom:
secretKeyRef:
name: ambassador-auth-jwt-key
key: jwt-key
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
name: ambassador-auth-redis-password
key: redis-password
- name: OIDC_PROVIDER
valueFrom:
secretKeyRef:
name: ambassador-auth-oidc-provider
key: oidc-provider
- name: SELF_URL
valueFrom:
secretKeyRef:
name: ambassador-auth-self-url
key: self-url
- name: CLIENT_ID
valueFrom:
secretKeyRef:
name: ambassador-auth-client-id
key: client-id
- name: CLIENT_SECRET
valueFrom:
secretKeyRef:
name: ambassador-auth-client-secret
key: client-secret
- name: auth-redis
image: bitnami/redis:latest
imagePullPolicy: Always
ports:
- name: redis-port
containerPort: 6379
env:
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
name: ambassador-auth-redis-password
key: redis-password
I see a small difference in login_mapping section of your config.
apiVersion: ambassador/v0
kind: Mapping
name: login_mapping
prefix: /login
rewrite: /login
service: oidc-auth:9090
This is different from our example config that only has prefix: /login/
without the rewrite. What happens if you have just that?
It seems like I had some leftover configuration in Ambassador, since I was trying several configurations while trying to fix the problem I had (turn on/off the Pro mode)
I got back to the basic configuration, as mentioned by you and it works like a magic.
Thank you so much for your time and support
Great to hear! Also happy to notice that people are using the software. I'm doing some improvements for this soon, and adding support for #19. Code quality and test coverage isn't that good currently, so hoping to have this addressed.
These are wonderful news. I think this is a great project!
Hi I'm trying to connect Ambassador GW to Keycloak using this auth-oidc middleware. The only change I made in the auth-deployment.yaml and auth-service.yaml was to change from port 8080 to 9090.
I'm using MacOS Here is the K8S deployments:
The task is to make Ambassador to redirect to Keycloak in case the user is not authenticated, or in case the session is expired.
Here are the secrets I configured:
I'm able to successfully go thru the OIDC process, as was nicely explained in the OIDC-flow.png
The problem I'm facing is that the last redirect is wrong. I'll explain.... Here what I see in the browser: 1- going to http://localhost/events
Call is being directed to keycloak as was expected
2- Keycloak shows login screen
3- Code is being sent to the browser and from there back to oidc-auth service for generating JWT (if I get it correctly)
4- And now that user is authenticated, I expect the browser to be redirected back to my original request which was http://localhost/events. But here is the problem, the browser is being redirected to http://localhost (which of course returns 404 Error), instead of going to http://localhost/events.
You could see from the attached images, that the authentication process is correct. The only thing is missing how to make sure the last redirect URL is set correctly
This is the Ambassador image:
This is the Keycloak image:
Appreciate your help