Open Cito opened 2 years ago
After investigating this today a bit more I think I found the cause of the problem: Emissary-ingress is looking for the AuthService in the "emissary" namespace, not in the "default" namespace, where it was created.
So the solution is to either create the AuthService in the "emissary" namespace, or to specify the namespace explicitly in the auth_service
field.
In the config file https://app.getambassador.io/yaml/v2-docs/3.0.0/demo/demo-auth-enable.yaml
it is currently specified like this:
apiVersion: getambassador.io/v2
kind: AuthService
name: authentication
auth_service: "example-auth:3000"
path_prefix: "/extauth"
allowed_request_headers:
- "x-qotm-session"
allowed_authorization_headers:
- "x-qotm-session"
After making the following change, everything worked like expected:
auth_service: "example-auth.default:3000"
Leaving this open, maybe someone can confirm my analysis and fix the documentation, and maybe add some remarks about namespaces.
Thanks, @Cito for this catch! I've created a docs ticket for this.
Describe the bug
Authentication using an external authentication service does not seem to work on a Kubernetes Cluster running on Docker Desktop for Mac. The authentication service is never accessed, and the authentication fails with error code 403 (forbidden).
I was able to reproduce the same problem with Docker Desktop for Windows, and Minikube on Mac (commands to reproduce only shown for Docker Desktop for Mac, adapt accordingly).
To Reproduce
Install Docker Desktop for Mac, Enable Kubernetes.
Install Emissary-Ingress 3.0.0 and demo app according to the docs here:
Confirm that this works:
Should output something like this:
Install basic authentication demo according to the docs here:
As a result, I get an error 403:
When examining the logs as explained here, I find the following messages:
Also, the authentication service does not seem to be accessed by Emissary-ingress.
Expected behavior
The authentication service should be accessed, and authentication should be successful.
This should give a similar output as without authentication:
Even with wrong credentials, it should give an error 401, not 403.
Versions (please complete the following information):