breakfix: Unable to authenticate with more than 1 replica

[andrefmarques]

Describe the issue

I'm using ghcr.io/authp/authp:v1.0.5 with the Caddyfile described bellow to provide an login page to authenticate and access some services. This is deployed on GKE. Everything is worked as expected when using 1 replica, but when there's more than 1 replica the authentication fails, when entering the password or the username.

Configuration

{
    debug
    order authenticate before respond
    order authorize before basicauth

    security {
        local identity store localdb {
            realm local
            path /tmp/users.json
        }

        authentication portal partners {
            crypto key sign-verify 428f41ab-67ec-47d1-8633-bcade9dcc7ed

            enable identity store localdb
            cookie domain partners.domain.com

            ui {
                links {
                    "Service1" "/portal/service/index.html" icon "las la-phone"
                }
            }

        }

        authorization policy partners {
            set auth url https://partners.domain.com/auth
            allow roles authp/admin authp/user authp/guest
            crypto key verify 428f41ab-67ec-47d1-8633-bcade9dcc7ed

            validate bearer header
            inject headers with claims
            inject header "X-Entreprise-Local-Internal" from "X-Entreprise-Local-Internal"
        }

    }
}

:8080 {
    route /* {
        authenticate with partners
    }

    route /portal/service* {
        authorize * with partners
        reverse_proxy http://portal-gateway.istio-system.svc.cluster.local:8080 {
            header_up Host portal-gateway.istio-system.svc.cluster.local
        }
    }

}

Version Information

http.authentication.hashes.bcrypt v2.7.5
http.authentication.hashes.scrypt v2.7.5
http.authentication.providers.http_basic v2.7.5
http.handlers.authentication v2.7.5
tls.client_auth.leaf v2.7.5
http.authentication.providers.authorizer v1.1.21
http.handlers.authenticator v1.1.21
security v1.1.21
security.secrets.aws_secrets_manager v1.0.1

Expected behavior

Be able to authenticate when using more than 1 replica

Additional context

Deployed in GKE with Deployment and istio sidecar.

[greenpau]

First, please migrate to using ghcr.io/authcrunch/authcrunch. See here.

@andrefmarques , the instances do not share state by design.

There is a cookie with unique session id: AUTHP_SESSION_ID. Configure the load-balancer with the sticky based on the cookie.

GKE does not support setting your own cookie. BUT, it can generate its own.

Look for the term "Session affinity". See https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#session_affinity