ext_authz Authentication

[xervon]

Description:
Are there any plans of supporting ext_authz request authentication?

[arkodg]

@xervon the project supports a native Authn API and plans on allowing advanced users to configure envoy filters such as ext_authz as well, #24 is the tracking issue that should address this use case, which should hopefully be part of the 0.4.0 release in April 2023

[xervon]

Thanks for the quick answer. I guess I should have clarified that I had already seen both of those. I was wondering if there were already plans to extend the AuthenticationFilter with support for ext_authz (similar to #881 as far as I understand that one). And if there are no plans regarding this, what would have to be done if I wanted to take a stab at this?

[arkodg]

@xervon imho ext_authz is something an advanced user would be aware of, so would prefer taking the #24 route, understand the shortcomings once implemented and used, and if it still required, expose the fields of the underlying envoy filter into the higher level authn API

[xervon]

IMO it seems particularly useful to make ext_authz easily available to all users. Not only is this the case in most ingress controllers I know of (see links at the bottom) but it also allows the user to use pretty much any authn/authz method they prefer using custom authn/authz servers or tools like Ory oathkeeper. This means it's an alternative, in case another authn/z method isn't supported by AuthenticationFilter.

Also: as far as I understand the plans in #24 the custom configuration seems to be planned to be all or nothing. From my standpoint envoy-gateway in it's current state feels very well integrated with gateway api. Having to configure the full proxy if I want to use any authz/authn besides JWT feels quite restrictive. If this goes beyond the scope of these first releases it might still be worth thinking about being able to override at least just the authn/authz part of the config while leaving the rest of the request processing alone, though I don't know envoy well enough to know if this would be possible.

References in other ingress controllers:
haproxy-ingress
gloo
traefik
ambassador
nginx
contour

[arkodg]

thanks for sharing all the references for other projects @xervon , the original design doc did account for ext_authz, hoping other @envoyproxy/gateway-maintainers can chime in

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[arkodg]

speaking with many users at Kubecon, who would like to integrate with an external authz system like OPA
this can now be added into https://gateway.envoyproxy.io/latest/api/extension_types/#securitypolicy

[akhenakh]

Agree it's a very common to point to an ext_authz_filter filter to talk to an authorization server, resorting to patching xDS for a basic need is not optimal

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.