search

nginxinc / nginx-gateway-fabric

NGINX Gateway Fabric provides an implementation for the Gateway API using NGINX as the data plane.
Apache License 2.0
424 stars 82 forks source link

feat: oauth2/oidc auth requests support for ngf #2148

Open hegerdes opened 2 weeks ago

hegerdes commented 2 weeks ago

Is your enhancement request related to a problem? Please describe. I want to transition from Ingress to Gateway API. Currently I use nginx (o)auth request module to authenticate user requests. I don't find a way to do this with ngf.
This is a game-breaker for adopting Gateway

What would you like to be added: Ideally a common interface between all Gateway implementations to do auth requests (via OAuth2/OIDC). If this is not possible to do in a provider unspecific way there could be a specific RouteFilter or like ingress annotations.

Why this is needed: This is needed to provide full feature compatibility with Ingress.

Additional context As far as I was I know there is no way to represent the following annotations/functions with nfg:

annotations:
    nginx.ingress.kubernetes.io/auth-signin: https://${MY_OAUTH_DOMAIN}/oauth2/start?rd=https://$host$request_uri
    nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.default.svc.cluster.local/oauth2/auth
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Auth-Request-Email, X-Auth-Request-User, X-Auth-Request-Access-Token"

Is there a way to express this with HTTPRouteFilters?
Is there an alternative approach?

mpstefan commented 4 days ago

Hey @hegerdes!

There isn't a standard for auth yet in the Gateway API, but we do have some aspects of what you're looking for coming up in two releases from now. You can see our thoughts around this here.

Using a remote oauth2 endpoint, as you describe, will implemented as a first-class feature at a later date. However, we are working on a method, very similar to ingress annotations, to customize nginx configuration SHOULD meet your use case. We're hoping to deliver this two releases from now as well. The epic for the customization is available here.

hegerdes commented 3 days ago

Thanks for the reply. This is awesome!

I didn't find these links. Maybe you can add a Roadmap link to the readme.
Will be waiting for this to test it out. Feel free to close this (or keep it for info if you want)