Centralized OAuth2 authentication with Kong Ingress Controller Not Working

[shahamit]

I want to enable centralized authentication when deploying kong as a kubernetes ingress controller running with postgres database. Hence I deployed the plugin as decribed in this yaml file and added the plugin to the ingress component as shown in this yaml. The yaml file contents are pasted below too for easy reference. I am running k3s on my laptop as the kubernetes cluster.

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: oauth-mk8s-ingress
  namespace: kong
config:
  enable_authorization_code: true
  issuer: https://dev-13044354.okta.com/oauth2/default
plugin: oauth2

---
apiVersion: v1
kind: Service
metadata:
  name: mk8s-k8s-order-service
  namespace: mk8s
spec:
  ports:
  - port: 8981
    targetPort: 8981
    name: tcp
  selector:
    app: mk8s-k8s-order
---
apiVersion: v1
kind: Service
metadata:
  name: mk8s-k8s-customer-service
  namespace: mk8s
spec:
  ports:
  - port: 8980
    targetPort: 8980
    name: tcp
  selector:
    app: mk8s-k8s-customer
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mk8s-k8s-ingress
  namespace: mk8s
  annotations:
    konghq.com/plugins: oauth-mk8s-ingress
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - path: /api/order
        pathType: Prefix
        backend:
          service:
            name: mk8s-k8s-order-service
            port:
              number: 8981
      - path: /api/customer
        pathType: Prefix
        backend:
          service:
            name: mk8s-k8s-customer-service
            port:
              number: 8980

Even after applying the plugin I do not get an error if the Authorization header is not passed when making the api request through curl. I get a valid api response.
If I modify my application code to support OAuth2 authentication then it works (i.e. I get the 401 error) but that would defeat the purpose of having centralized authentication since each microservice would have to add support for OAuth2. I am hoping kong can do that centrally i.e. as an api gateway parse the http header and validate the access token either by communicating with the OAuth2 server or by itself if the access tokens are self-encoded JWT access tokens

I suspect one reason for this could be the fact that the address field is not populated for the ingress controller as shown in this screenshot. It gets populated when traefik acts as an ingress controller. Due to this I cannot access the apis exposed by the microservices (pods) from outside.

Could you please guide me on what could be missing?
Thanks.

[shahamit]

I could resolve the "address field not be populated for the ingress resource" problem by disabling traefik ingress controller that gets by default installed on k3s. After disabling it, my ingress resource does get an external ip assigned after which apis can be called from outside.

The plugin still isn't getting activated though. The original problem remains

[shaneutt]

So after reviewing I think there may be a bit of a problem here, it looks like you're trying to use Okta as the oauth server but technically the Kong OAuth Plugin is limited in that is only uses Kong as the oauth server. The Oauth protocol technically supports what you're trying to do but the plugin doesn't currently (this is something you could put in a feature request for). OIDC should be able to do this however, have you considered using OIDC for your purposes or are you bound to OAuth?

[shahamit]

it looks like you're trying to use Okta as the oauth server but technically the Kong OAuth Plugin is limited in that is only uses Kong as the oauth server.

Yes @shaneutt. We already have an OAuth server in our application infrastructure hence for testing I was simulating the use case using Okta. I am expecting that Kong acts as a delegator in delegating the access token validation to the OAuth2 server once it receives any api requests OR it can do the token validation by itself if they are self access tokens

OIDC should be able to do this however, have you considered using OIDC for your purposes or are you bound to OAuth?

We have an OAuth server already. Also the OIDC plugin comes only in the enterprise edition as this compatibility matrix shows right?

[shaneutt]

We have an OAuth server already. Also the OIDC plugin comes only in the enterprise edition as this compatibility matrix shows right?

Yes, as seen here too: https://docs.konghq.com/kubernetes-ingress-controller/1.3.x/guides/using-oidc-plugin/#main

Enterprise is needed for the OIDC plugin.

We already have an OAuth server in our application infrastructure hence for testing I was simulating the use case using Okta. I am expecting that Kong acts as a delegator in delegating the access token validation to the OAuth2 server once it receives any api requests OR it can do the token validation by itself if they are self access tokens

Right, oauth as a protocol has support for this but the kong oauth plugin doesn't. I believe to get what you want we need a feature request and new contributions to that plugin.

[shahamit]

Right, oauth as a protocol has support for this but the kong oauth plugin doesn't. I believe to get what you want we need a feature request and new contributions to that plugin.

I just came across the OAuth introspection plugin that I somehow missed earlier. It does exactly what we have been discussing. It validates the access token granted by other OAuth servers. It is available in the plus & enterprise (not in free) editions. Did you also miss it @shaneutt ?

[shaneutt]

Yep that one slipped past me so good work on the find 👍