passing IdP access token to app via `Authorization "Bearer $ACCESS_TOKEN"` from kubernetes ingress-nginx

[ahilmathew]

Hey, I'm very new to vouch proxy. Having an issue that I'll try to explain below.

I am running an AKS cluster which hosts 2 apps behind ingress-nginx controller. One is a client and other app hosts the location api. All requests to this API should have a Authorization: Bearer <token> which is then validated by the location app with Okta.

User visits the client app through a browser -> user gets redirected to Okta which forwards the auth request to an IdP -> User gets authenticated and is redirected back to the client app. This all works fine.

My question is how do I get hold of the access_token issued by the IdP and pass it on to the location app as an Authorization header. I just recently found out that VP issues it's own tokens after the end user authenticates with an IdP.

So is it even possible to access the original access_token? Am I using VP for the right use case? (https://github.com/vouch/vouch-proxy/issues/484#issuecomment-1179280657)

[ahilmathew]

I think I found the answer. I've been correct in using -

  headers:
    jwt: X-Vouch-Token
    querystring: access_token
    accesstoken: X-Vouch-IdP-AccessToken
    idtoken: X-Vouch-IdP-IdToken

And then in ingress-nginx

    nginx.ingress.kubernetes.io/configuration-snippet: |
      auth_request_set $auth_resp_x_vouch_idp_accesstoken $upstream_http_x_vouch_idp_accesstoken;
      proxy_set_header Authorization "Bearer $auth_resp_x_vouch_idp_accesstoken";

X-Vouch-IdP-AccessToken does give you the access token from the IdP.

The reason the token didn't work for the location api is because I was using the wrong authorization server when I configured oidc for vouch-proxy. So the jwt that was being verified would not work as it was not issued by the same authorization server.

[bnfinet]

@ahilmathew nice job on the self help :)

You may not need querystring: access_token in the config. Otherwise that all looks reasonable to my eyes though I'm not currently a k8s user so I'd defer to someone more knowledgeable about nginx-ingress.

I'll close this now though do please chime back in if I'm misunderstanding that you now have a working config for this use case or if there was another question and I can re-open.

Cheers!