external-auth-server with keycloak and ambassador

Hi,

So my setup is: Ambassador v: 0.72.0 Keycloak v: 5.0.0 And external-auth-server as middle-ware providing openid-connect authentication to a webservice.

I followed the setup first for the Traefik example, substituting config where it was needed. My configuration for the external-auth-server values.yaml looks as follows:

configTokenSignSecret: ZQTJMHgsRUYD4vaDJnmutYMU
configTokenEncryptSecret: MAuZtmwxfvcJCabSmhrvcAjv
issuerSignSecret: mEAYPr9bcZk8dFda8T6dBmzK
issuerEncryptSecret: QjjgXyVvVyVyUfBW6ZhFTG3w
cookieSignSecret: 5spCwm2jCtekwEb3G6Hcnav8
cookieEncryptSecret: YwX3gzTZmPNUL9v5RMhwsnZq
sessionEncryptSecret: jMV5WtUCfSme4xx9Qkmu2Jv2
logLevel: "info"
redis-ha:
  enabled: false

In addition i made a couple of changes to the service.yaml to accommodate ambassadors annotation-based configuration… These looks like this:

  annotations:
    getambassador.io/config: |
      ---
      apiVersion: ambassador/v1
      kind:  AuthService
      name:  authentication
      auth_service: {{ include "external-auth-server.fullname" . }}
      proto: http
      allowed_request_headers:
        - authorization
      include_body:
        max_bytes: 4096
        allow_partial: true
      ---
      apiVersion: ambassador/v1
      kind:  Mapping
      name:  eas_mapping
      prefix: /eas/
      bypass_auth: true
      service: {{ include "external-auth-server.fullname" . }}

I managed to create a CONFIG_TOKEN for the keycloak. The configuration for the plugin added to generate-config-token.js that i used was:

      {
        type: "oidc",
        issuer: {
            /**
            * via discovery (takes preference)
            */
            discover_url: "http://keycloak.default.svc.cluster.local/auth/realms/master/.well-known/openid-configuration",
  
        },
        client: {
            /**
            * manually defined (preferred)
            */
            client_id: "lightningbadger",
            client_secret: "4dbd29da-5b81-417e-a230-abad914de57e"
    
            /**
            * via client registration
            */
            //registration_client_uri: "",
            //registration_access_token: "",
        },
        scopes: ["openid", "email", "profile"], // must include openid
        /**
        * static redirect URI
        * if your oauth provider does not support wildcards place the URL configured in the provider (that will return to this proper service) here
        */
        redirect_uri: "http://api.lightningbadger.io/eas/oauth/callback",
        features: {
            /**
            * how to expire the cookie
            * true = cookies expire will expire with tokens
            * false = cookies will be 'session' cookies
            * num seconds = expire after given number of seconds
            */
            cookie_expiry: true,
    
            /**
            * how frequently to refresh userinfo data
            * true = refresh with tokens (assuming they expire)
            * false = never refresh
            * num seconds = expire after given number of seconds
            */
            userinfo_expiry: true,
    
            /**
            * how long to keep a session (server side) around
            * true = expire with tokenSet (if applicable)
            * false = never expire
            * num seconds = expire after given number of seconds (enables sliding window)
            *
            * sessions become a floating window *if*
            * - tokens are being refreshed
            * or
            * - userinfo being refreshed
            * or
            * - session_expiry_refresh_window is a positive number
            */
            session_expiry: true,
    
            /**
            * window to update the session window based on activity if
            * nothing else has updated it (ie: refreshing tokens or userinfo)
            *
            * should be a positive number less than session_expiry
            *
            * For example, if session_expiry is set to 60 seconds and session_expiry_refresh_window value is set to 20
            * then activity in the last 20 seconds (40-60) of the window will 'slide' the window
            * out session_expiry time from whenever the activity occurred
            */
            session_expiry_refresh_window: 86400,
    
            /**
            * will re-use the same id (ie: same cookie) for a particular client if a session has expired
            */
            session_retain_id: true,
    
            /**
            * if the access token is expired and a refresh token is available, refresh
            */
            refresh_access_token: true,
    
            /**
            * fetch userinfo and include as X-Userinfo header to backing service
            */
            fetch_userinfo: true,
    
            /**
            * check token validity with provider during assertion process
            */
            introspect_access_token: false,
    
            /**
            * which token (if any) to send back to the proxy as the Authorization Bearer value
            * note the proxy must allow the token to be passed to the backend if desired
            *
            * possible values are id_token, access_token, or refresh_token
            */
            authorization_token: "access_token"
        },
        assertions: {
            /**
            * assert the token(s) has not expired
            */
            exp: true,
    
            /**
            * assert the 'not before' attribute of the token(s)
            */
            nbf: true,
    
            /**
            * assert the correct issuer of the token(s)
            */
            iss: true,
    
            /**
            * custom userinfo assertions
            */
            userinfo: [
            ],
    
            /**
            * custom id_token assertions
            */
            id_token: [
            ]
        },
        cookie: {
            //name: "_my_company_session",//default is _oeas_oauth_session
            //domain: "example.com", //defaults to request domain, could do sso with more generic domain
            //path: "/",
        },
        // see HEADERS.md for details
        headers: {},
    }

However, here comes the part on which i got stuck. The examples provided in this repo uses Traefik configuration and adds this to the

ingress.kubernetes.io/auth-url: https://eas.example.com/verify?fallback_plugin=0&config_token=PLACE_CONFIG_TOKEN_OUTPUT_HERE 

However, since we are using ambassador this is not an option. So I expect I need to mount the configuration into a secret with the env adapter. Which i tried without any luck. So i tried adding the following to my values.yaml

configTokenStores:
 primary:
   adapter: env
   options:
     cache_ttl: 3600
     var: < I HAVE NO IDEA WHAT TO ADD HERE>
configTokens:
 1:  <MY CONFIG TOKEN NOT URL ENCODED >

Can you maybe help me out with this configuration 😃 Then i can maybe help with writing some documentation 😛

[travisghansen]

I just landed initial support for ambassador in latest as an FYI.

[Romeren]

In case you want some debug info… these are the configuration of that last call that fails:

{
    "url": "http://<External auth service host>/oauth/callback",
    "parameters": {
        "__eas_oauth_handler__": [
            "authorization_callback"
        ],
        "state": [
            "ebaa58c05013409343e41bce4c7007b20a3316696d86e05b6a79bcc5b6ceaf14071567532f4217595bbf6263bf769a45a94e68d591a4a0e6b7069a55b125a7b927c48fe5c0835512d61737a9d03e4fab64093a35ad2f00531de529607ec7b6212e62671e68cf9c150fc867fbc46e678b27ba9a3ab38018dabf570f6fe1ef7b6d73484c0ac311416427c204866b0e69631ad3807c6ff810280221527a8db4394797afe8204051fd08fa55fd101850a22d1b32fcf6798e4ab086f215ccbb2692595f08881eead3200c6bc9e184808f3725afcd16fd6c38c278d35abd32b112a8ab347c501be3bd15b487c01b45b472f7fed57faed99db4524f2746f6d8455d530eabac55a48277556a8c1fb18ba59e3887ae08d98d785d6ec734b5ec3f85472ac1"
        ],
        "session_state": [
            "da010069-bf7a-401f-b869-60a257f2c174"
        ],
        "code": [
            "07d99bfd-ecd7-482c-814b-489ed280bf02.da010069-bf7a-401f-b869-60a257f2c174.ddcb87d1-0937-49a2-af37-3253ca9520cf"
        ]
    },
    "cookies": {
        "AUTH_SESSION_ID": "da010069-bf7a-401f-b869-60a257f2c174.keycloak-0",
        "KC_RESTART": "eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI5MDVlNzUzMC03Yjk3LTQwNjMtYjhlMi0xYjJhODBjMmM1YTEifQ.eyJjaWQiOiJsaWdodG5pbmdiYWRnZXIiLCJwdHkiOiJvcGVuaWQtY29ubmVjdCIsInJ1cmkiOiJodHRwOi8vYXBpLmxpZ2h0bmluZ2JhZGdlci5pby9lYXMvb2F1dGgvY2FsbGJhY2s_X19lYXNfb2F1dGhfaGFuZGxlcl9fPWF1dGhvcml6YXRpb25fY2FsbGJhY2siLCJhY3QiOiJBVVRIRU5USUNBVEUiLCJub3RlcyI6eyJzY29wZSI6Im9wZW5pZCBlbWFpbCBwcm9maWxlIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwL2F1dGgvcmVhbG1zL21hc3RlciIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwiY29kZV9jaGFsbGVuZ2VfbWV0aG9kIjoicGxhaW4iLCJyZWRpcmVjdF91cmkiOiJodHRwOi8vYXBpLmxpZ2h0bmluZ2JhZGdlci5pby9lYXMvb2F1dGgvY2FsbGJhY2s_X19lYXNfb2F1dGhfaGFuZGxlcl9fPWF1dGhvcml6YXRpb25fY2FsbGJhY2siLCJzdGF0ZSI6ImViYWE1OGMwNTAxMzQwOTM0M2U0MWJjZTRjNzAwN2IyMGEzMzE2Njk2ZDg2ZTA1YjZhNzliY2M1YjZjZWFmMTQwNzE1Njc1MzJmNDIxNzU5NWJiZjYyNjNiZjc2OWE0NWE5NGU2OGQ1OTFhNGEwZTZiNzA2OWE1NWIxMjVhN2I5MjdjNDhmZTVjMDgzNTUxMmQ2MTczN2E5ZDAzZTRmYWI2NDA5M2EzNWFkMmYwMDUzMWRlNTI5NjA3ZWM3YjYyMTJlNjI2NzFlNjhjZjljMTUwZmM4NjdmYmM0NmU2NzhiMjdiYTlhM2FiMzgwMThkYWJmNTcwZjZmZTFlZjdiNmQ3MzQ4NGMwYWMzMTE0MTY0MjdjMjA0ODY2YjBlNjk2MzFhZDM4MDdjNmZmODEwMjgwMjIxNTI3YThkYjQzOTQ3OTdhZmU4MjA0MDUxZmQwOGZhNTVmZDEwMTg1MGEyMmQxYjMyZmNmNjc5OGU0YWIwODZmMjE1Y2NiYjI2OTI1OTVmMDg4ODFlZWFkMzIwMGM2YmM5ZTE4NDgwOGYzNzI1YWZjZDE2ZmQ2YzM4YzI3OGQzNWFiZDMyYjExMmE4YWIzNDdjNTAxYmUzYmQxNWI0ODdjMDFiNDViNDcyZjdmZWQ1N2ZhZWQ5OWRiNDUyNGYyNzQ2ZjZkODQ1NWQ1MzBlYWJhYzU1YTQ4Mjc3NTU2YThjMWZiMThiYTU5ZTM4ODdhZTA4ZDk4ZDc4NWQ2ZWM3MzRiNWVjM2Y4NTQ3MmFjMSJ9fQ.PuMViFSetOaDeGTFODRNObRdXRb3pjb9INH3etOvCHc",
        "KEYCLOAK_IDENTITY": "eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI5MDVlNzUzMC03Yjk3LTQwNjMtYjhlMi0xYjJhODBjMmM1YTEifQ.eyJqdGkiOiJiODk3YTUxOS0yMDBhLTRjMmUtYmVhMS1mMDU2NzMxZTNlMzEiLCJleHAiOjE1NjE3NTU2NDMsIm5iZiI6MCwiaWF0IjoxNTYxNzE5NjQzLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjUwMDAvYXV0aC9yZWFsbXMvbWFzdGVyIiwic3ViIjoiMzRlNjQ4OGQtNmMyNS00NDFhLTkwM2ItNDZlODdkNjRkNzhiIiwiYXV0aF90aW1lIjowLCJzZXNzaW9uX3N0YXRlIjoiZGEwMTAwNjktYmY3YS00MDFmLWI4NjktNjBhMjU3ZjJjMTc0Iiwic3RhdGVfY2hlY2tlciI6IkluWUtoVDVjTjBudkdhLXBLd2lNV2w0QXhmSlhwZWJvZWZ2LS1MUlFpMncifQ.eqF4K1g-PTE0UQIJT6VAmgVqk84urZK9YQ6p7-rfsJw",
        "KEYCLOAK_SESSION": "master/34e6488d-6c25-441a-903b-46e87d64d78b/da010069-bf7a-401f-b869-60a257f2c174"
    } 
}