Open mvanderlee opened 4 years ago
AFAIR oathkeeper already has solution for that, I've been thinking about a similar thing in istio using mixer adapter. Oathkeeper decision API https://www.ory.sh/docs/oathkeeper/sdk/api#access-control-decision-api is what you could use in the middleware. It gives you more less "ok"/ "not ok" responses. @aeneasr correct me if I'm wrong 👍
For traefik I'd have to either create a wrapper service to call in the middleware, modify traefik, or modify oathkeeper.
Modifying oathkeeper was the easiest.
Instead of adding a new endpoint, as I've done in the PR, we could make the decision source comfortable for a single endpoint? I.e. in oathkeeper.yml: decision: source: request_path or headers proto_header: X-Forwarded-Proto host_header: X-Forwarded-Host Etc.
As per my comment https://github.com/ory/oathkeeper/pull/265#issuecomment-534967157 we would like to offer one endpoint per service. So moving the Decisions API in general to /decisions/generic
. For backwards compatibility ideas see https://github.com/ory/oathkeeper/pull/265/files#r329310302
For implementation ideas see this PR: https://github.com/ory/oathkeeper/pull/265
Additionally, we should document the set up for the different systems. Let's start with
in ORY Docs in a new section (e.g. Scenarios
-> Using with Traefik
/ Using with Nginx
/ ...).
Hi! I see 0.38 is moving forward with beta.2, will this feature be done by the time 0.38 is released? We're using traefik for our API in docker and we'd like to protect them with Oathkeeper, that would be awesome! Thanks a lot for all your efforts!
As soon as the PR is finished (contributions welcomed) this will be merged and released!
Any chance of adding @mholt's https://caddyserver.com/ to this list? (very much looking forward to trying ory out with Traefik on Docker Swarm - currently using Keycloak :)
I would love to use the changes part of #486. It has been merged in the next-gen branch. But its unclear when this might find its way in the master or next release, any updates on that? As a workaround untill then I can probably apply that PR onto the current master and build it myself?
We're currently looking for maintainers (as a full time job) for Ory Oathkeeper because we currently lack resources to implement these things internally.
Is your feature request related to a problem? Please describe.
I'd like to use Ory Oathkeeper with:
Oathkeeper -> Scenarios (new section!) ->Nginx ForwardAuth
Oathkeeper -> Scenarios (new section!) ->Nginx ForwardAuth
Oathkeeper -> Scenarios (new section!) ->Ambassador AuthService Plugin
Oathkeeper -> Scenarios (new section!) -> Envoy External Authorization
Additional info
As per my comment https://github.com/ory/oathkeeper/pull/265#issuecomment-534967157 we would like to offer one endpoint per service:
/decisions/generic/...
(this is currently/decisions
)/decisions/traefik/...
For backwards compatibility ideas see https://github.com/ory/oathkeeper/pull/265/files#r329310302
For implementation ideas see this PR: https://github.com/ory/oathkeeper/pull/265
Context
See comment https://github.com/ory/oathkeeper/issues/263#issuecomment-605912334