HTTP

Before you begin link

1. Follow the Get started guide to install Gloo Gateway, set up a gateway resource, and deploy the httpbin sample app.

2. Get the external address of the gateway and save it in an environment variable.

     export INGRESS_GW_ADDRESS=$(kubectl get svc -n gloo-system gloo-proxy-http -o jsonpath="{.status.loadBalancer.ingress[0]['hostname','ip']}")
   echo $INGRESS_GW_ADDRESS  
     

     kubectl port-forward deployment/gloo-proxy-http -n gloo-system 8080:8080
     

Create an HTTP auth server link

1. Deploy the HTTP auth server.

     kubectl apply -f - <<EOF
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: extauth-httpservice
     namespace: httpbin
   spec:
     selector:
       matchLabels:
         app: http-extauth
     replicas: 1
     template:
       metadata:
         labels:
           app: http-extauth
       spec:
         containers:
           - name: http-extauth
             image: gcr.io/solo-public/passthrough-http-service-example
             imagePullPolicy: IfNotPresent
             ports:
               - containerPort: 9001
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: example-http-auth-service
     namespace: httpbin
     labels:
       app: http-extauth
   spec:
     ports:
     - port: 9001
       protocol: TCP
     selector:
       app: http-extauth
   EOF
     

2. Verify that the HTTP auth server is up and running.

     kubectl get pods -n gloo-system
     

Set up external auth link

1. Create an AuthConfig resource and add your external authentication rules. The following example configures basic authentication for the user user by using the hashed password and salt that you created earlier.

     kubectl apply -f- <<EOF
   apiVersion: enterprise.gloo.solo.io/v1
   kind: AuthConfig
   metadata:
     name: passthrough-auth
     namespace: httpbin
   spec:
     configs:
       - passThroughAuth:
           http:
             # Url of the http auth server to use for auth
             url: http://example-http-auth-service.httpbin.svc.cluster.local:9001
             # Set a connection timeout to external service, default is 5 seconds
             connectionTimeout: 3s
   EOF
     

2. Create a RouteOption resource and reference the AuthConfig resource that you just created.

     kubectl apply -f- <<EOF
   apiVersion: gateway.solo.io/v1
   kind: RouteOption
   metadata:
     name: passthrough-auth
     namespace: httpbin
   spec:
     options:
       extauth:
         configRef:
           name: passthrough-auth
           namespace: httpbin
   EOF
     

3. Create an HTTPRoute resource for the httpbin app that requires authentication for requests on the extauth.example domain.

     kubectl apply -f- <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: httpbin-passthrough-auth
     namespace: httpbin
   spec:
     parentRefs:
     - name: http
       namespace: gloo-system
     hostnames:
       - extauth.example
     rules:
       - filters:
           - type: ExtensionRef
             extensionRef:
               group: gateway.solo.io
               kind: RouteOption
               name: passthrough-auth
         backendRefs:
           - name: httpbin
             port: 8000
   EOF
     

4. Send a request to the httpbin app on the extauth.example domain. Verify that your request is denied and that you get back a 401 HTTP response code.

     curl -v http://$INGRESS_GW_ADDRESS:8080/status/200 -H "host: extauth.example:8080"
     

     curl -v localhost:8080/status/200 -H "host: extauth.example"
     

   Example output:

     * Mark bundle as not supporting multiuse
   < HTTP/1.1 401 Unauthorized
   < www-authenticate: Basic realm="gloo"
   < date: Fri, 19 Apr 2024 17:41:01 GMT
   < server: envoy
   < content-length: 0
     

5. Encode the expected user credentials in base64 format.

     echo -n "user:password" | base64
     

   Example output:

     dXNlcjpwYXNzd29yZA==
     

6. Send another request to the httpbin app. This time, you include the base64-encoded user:password credentials in the Authorization header. Verify that the request succeeds and that you get back a 200 HTTP response code.

     curl -v http://$INGRESS_GW_ADDRESS:8080/status/200 -H "host: extauth.example:8080" -H "Authorization: basic dXNlcjpwYXNzd29yZA=="
     

     curl -v localhost:8080/status/200 -H "host: extauth.example" -H "Authorization: basic dXNlcjpwYXNzd29yZA=="
     

   Example output:

     * Mark bundle as not supporting multiuse
   < HTTP/1.1 200 OK
   < access-control-allow-credentials: true
   < access-control-allow-origin: *
   < date: Fri, 19 Apr 2024 17:44:06 GMT
   < content-length: 0
   < x-envoy-upstream-service-time: 0
   < server: envoy
     

Cleanup link

  kubectl delete authconfig passthrough-auth -n httpbin
kubectl delete routeoption passthrough-auth -n httpbin
kubectl delete httproute httpbin-passthrough-auth -n httpbin