The ALB takes care of the routing of the incoming HTTP(S) requests to your applications that are deployed in your cluster. In many cases, you may want to authenticate and authorize the clients that send those incoming requests. This article will show you how to use the new IBM Cloud Kubernetes Service ALB OAuth Proxy Add-On to integrate the Kubernetes Ingress controller with IBM Cloud App ID to protect your applications. For more information about IBM Cloud App ID please see this YouTube channel.
How it works
The IBM Cloud Kubernetes Service ALB OAuth Proxy Add-On deploys and manages an OAuth2-Proxy deployment in your cluster for each and every IBM Cloud App ID service instance that you want to use. The OAuth2-Proxy provides the OIDC Relying Party (Client) function for the Kubernetes Ingress controller (ALB).
The following figure presents the interactions of the different system components during an OIDC Authorization Code Flow:
The User Agent sends a GET request to obtain the protected data from the Application.
The IBM Cloud Kubernetes Service ALB is configured to authenticate such a request. The ALB sends an Authentication request to the OAuth2-Proxy, which has been deployed by the ALB OAuth Proxy Add-on previously.
As there is no valid Access Token in the request, the OAuth2-Proxy sends a 401 Unauthorized response to the ALB.
The ALB redirects the User Agent to the URL, which will trigger the start of the authorization flow. The URL’s host part points to the ALB.
The User Agent sends a new request to the new URL. Due to the host of the URL, the request is routed to the ALB again.
The ALB is configured to send this kind of request to the OAuth2-Proxy.
The OAuth2-Proxy redirects the User Agent to the Authorization Endpoint of the IBM Cloud App ID Service.
The IBM Cloud App ID Service executes the authentication of the End-User behind the User Agent. The IBM Cloud App ID Service uses the services of the Identity Provider, which has been configured for this IBM Cloud App ID Service instance to authenticate the End-User.
If the authentication of the End-User is successful, the IBM Cloud App ID Service redirects the User Agent to the redirect URL, which has been registered in the IBM Cloud App ID Service instance. The host part of the redirect URL points to the ALB. The IBM Cloud App ID Service includes the Authorization Code into the redirection response.
The User Agent sends a new request with the Authorization Code to the callback URL.
The ALB is configured to route this kind of requests to the OAuth2-Proxy.
The OAuth2-Proxy sends the Authorization Code to the Token endpoint of the IBM Cloud App ID Service.
The IBM Cloud App ID Service responds with an Access Token, an ID Token, and (optionally) a Refresh Token.
The OAuth2-Proxy redirects the User Agent to the original request URL. As we use the OAuth2-Proxy in stateless mode, the redirection response contains the Access Token, the ID Token, and the Refresh Token in cookies.
The User Agent sends a new request to the original request URL, but this time, it includes the Access Token, the ID Token, and the Refresh Token in the request as cookies.
The ALB is configured to authenticate such a request, so the ALB sends an Authentication request to the OAuth2-Proxy.
The OAuth2-Proxy validates the tokens and it answers with a 202 Accepted response to the ALB.
The ALB routes the request to the backend Application. The request may contain the Access Token, or the ID Token based on the ALB configuration.
Create an IBM Cloud App ID service instance and bind that to the cluster:
Replace the auto-filled service name with your own unique name for the IBM Cloud App ID service instance. The service instance name must contain only alphanumeric characters or hyphens (-) and can’t contain spaces.
Click Create. The App ID management console will be displayed:
In the IBM Cloud App ID management console, navigate to Manage Authentication:
In the Identity providers tab, make sure that you have an Identity Provider selected. If no Identity Provider is selected, the user will not be authenticated but will be issued an access token for anonymous access to the app. Next, create a Cloud Directory user:
Click Edit on the Cloud Directory card.
In the left-hand navigation, click Users:
Click Create User. Give the details of your user in the dialog box, and save the user:
Navigate back to Manage Authentication, and select the Authentication settings tab:
In the Authentication settings tab, add redirect URLs for your app. A redirect URL is the callback endpoint of your app. To prevent phishing attacks, IBM Cloud App ID validates the request URL against the allowlist of redirect URLs. A redirect URL shall have the following form:
Bind the IBM Cloud App ID service instance to your IBM Cloud Kubernetes Service cluster. Be sure to bind the service instance to the same Kubernetes namespace that your Ingress resources will be created:
ibmcloud cluster service bind --cluster <cluster_name_or_ID> --namespace <namespace> --service <your_App_ID_service_name>
Usage of the ALB OAuth Proxy Add-on
Enable the ALB OAuth Proxy Add-on for your cluster:
Verify that the IBM Cloud App ID authentication is enforced for your apps. Access your app’s URL in a web browser. If IBM Cloud App ID is correctly applied, you are redirected to an IBM Cloud App ID authentication log-in page. Log in with the user you created in the Cloud Directory above. After a successful authentication, you are redirected to your app and you can see the response of your app in the browser.