From c70dba4c4342e123417eea414c361b0e6e82c348 Mon Sep 17 00:00:00 2001 From: huabing zhao Date: Thu, 30 Nov 2023 14:43:49 +0800 Subject: [PATCH 1/4] user doc for oidc Signed-off-by: huabing zhao --- site/content/en/latest/user/oidc.md | 125 ++++++++++++++++++++++++++++ 1 file changed, 125 insertions(+) create mode 100644 site/content/en/latest/user/oidc.md diff --git a/site/content/en/latest/user/oidc.md b/site/content/en/latest/user/oidc.md new file mode 100644 index 00000000000..cbaebc76867 --- /dev/null +++ b/site/content/en/latest/user/oidc.md @@ -0,0 +1,125 @@ +--- +title: "OIDC Authentication" +--- + +This guide provides instructions for configuring [OpenID Connect (OIDC)][oidc] authentication. +OpenID Connect (OIDC) is an authentication standard built on top of OAuth 2.0. +It enables client applications to rely on authentication that is performed by an OpenID Connect Provider (OP) +to verify the identity of a user. + +Envoy Gateway introduces a new CRD called [SecurityPolicy][SecurityPolicy] that allows the user to configure OIDC +authentication. +This instantiated resource can be linked to a [Gateway][Gateway] and [HTTPRoute][HTTPRoute] resource. + +## Prerequisites + +Follow the steps from the [Quickstart](../quickstart) guide to install Envoy Gateway and the example manifest. +Before proceeding, you should be able to query the example backend using HTTP. + +OIDC authentication requires the redirect URL to be HTTPS. Follow the [Secure Gateways](../secure-gateways) guide + to generate the TLS certificates and update the Gateway configuration to add an HTTPS listener. + +Verify the Gateway status: + +```shell +kubectl get gateway/teg -o yaml +``` + +## Configuration + +This guide uses Google as the OIDC provider to demonstrate the configuration of OID. However, EG works with any OIDC +providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc. + +### Register an OIDC application + +Follow the steps in the [Google OIDC documentation][google-oidc] to register an OIDC application. Please use +`https://www.example.com/oauth2/callback` as the redirect URL when registering the application. `oauth2/callback` is the +default callback path used by Envoy Gateway. + +After registering the application, you should have the following information: +* Client ID: The client ID of the OIDC application. +* Client Secret: The client secret of the OIDC application. + +### Create a kubernetes secret + +Next, create a kubernetes secret with the Client Secret created in the previous step. The secret is an Opaque secret, +and the Client Secret must be stored in the key "client-secret". + +Note: please replace the ${CLIENT_SECRET} with the actual Client Secret that you got from the previous step. + +```shell +$ kubectl create secret generic my-app-client-secret --from-literal=client-secret=${CLIENT_SECRET} +secret "my-app-client-secret" created +``` + +### Create a SecurityPolicy + +Note: please replace the ${CLIENT_ID} with the actual Client ID that you got from the previous step. + +```shell +cat < Date: Thu, 30 Nov 2023 20:56:12 +0800 Subject: [PATCH 2/4] Update site/content/en/latest/user/oidc.md Co-authored-by: sh2 Signed-off-by: Huabing Zhao --- site/content/en/latest/user/oidc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/content/en/latest/user/oidc.md b/site/content/en/latest/user/oidc.md index cbaebc76867..49fb57e6df6 100644 --- a/site/content/en/latest/user/oidc.md +++ b/site/content/en/latest/user/oidc.md @@ -27,7 +27,7 @@ kubectl get gateway/teg -o yaml ## Configuration -This guide uses Google as the OIDC provider to demonstrate the configuration of OID. However, EG works with any OIDC +This guide uses Google as the OIDC provider to demonstrate the configuration of OIDC. However, EG works with any OIDC providers, including Auth0, Azure AD, Keycloak, Okta, OneLogin, Salesforce, UAA, etc. ### Register an OIDC application From 5679b9e03c77cac528a1992fa55db2a3fff016f2 Mon Sep 17 00:00:00 2001 From: Huabing Zhao Date: Thu, 30 Nov 2023 20:56:23 +0800 Subject: [PATCH 3/4] Update site/content/en/latest/user/oidc.md Co-authored-by: sh2 Signed-off-by: Huabing Zhao --- site/content/en/latest/user/oidc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/content/en/latest/user/oidc.md b/site/content/en/latest/user/oidc.md index 49fb57e6df6..dcd6b0c220f 100644 --- a/site/content/en/latest/user/oidc.md +++ b/site/content/en/latest/user/oidc.md @@ -107,7 +107,7 @@ successfully login, you should see the response from the backend service. Follow the steps from the [Quickstart](../quickstart) guide to uninstall Envoy Gateway and the example manifest. -Delete the SecurityPolicy and the secret +Delete the SecurityPolicy and the secret: ```shell kubectl delete securitypolicy/oidc-example From 01ea21a1eaa8b4eb1f519ab4d867dc98c38091e1 Mon Sep 17 00:00:00 2001 From: Huabing Zhao Date: Thu, 30 Nov 2023 20:57:11 +0800 Subject: [PATCH 4/4] Update site/content/en/latest/user/oidc.md Co-authored-by: sh2 Signed-off-by: Huabing Zhao --- site/content/en/latest/user/oidc.md | 1 - 1 file changed, 1 deletion(-) diff --git a/site/content/en/latest/user/oidc.md b/site/content/en/latest/user/oidc.md index dcd6b0c220f..3983d1530fa 100644 --- a/site/content/en/latest/user/oidc.md +++ b/site/content/en/latest/user/oidc.md @@ -95,7 +95,6 @@ sudo kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 443:4 Put www.exampe.com in the /etc/hosts file in your test machine, so we can use this host name to access the demo from a browser: ```shell -## ... 127.0.0.1 www.example.com ```