ExtAuthPolicy

Proto: ext_auth_policy.proto

Package: security.policy.gloo.solo.io

Set up an external authentication and authorization to protect the workloads in your cluster. For example, you can set up basic, passthrough, API key, OAuth, OPA, or LDAP authentication.

To enforce external auth, each workspace must have an external auth server. You can select which external auth service is used to enforce the policy by configuring an ExtAuthServer resource. If you don’t configure this resource, then the policy uses the default ext-auth-service that was created for you at installation. If you did not enable the external-auth-service during installation, the policy cannot be enforced. For more information, see the ExtAuthServer API reference.

The external auth policies tell the ext-auth-service how to enforce authentication and authorization of matching traffic. You can match traffic by selecting routes or destinations. If you don’t select any routes or destinations, an external auth policy is applied to all destinations by default. You cannot apply more than one external auth policy to the same route or destination. Note that when you create the policy with a destination selector, only Kubernetes services can be specified in the applyToDestination section. Virtual destinations or external services are not supported.

For more information, see the external auth guides.

Example: The following basic example refers to the Kubernetes service of the default ext-auth-service that you got during installation, but you can also use a virtual destination that points to an external auth service instead.

  apiVersion: security.policy.gloo.solo.io/v2
kind: ExtAuthPolicy
metadata:
  annotations:
    cluster.solo.io/cluster: ""
  name: basic-auth
  namespace: bookinfo
spec:
  applyToDestinations:
  - port:
      number: 9080
    selector:
      labels:
        app: ratings
  config:
    glooAuth:
      configs:
      - basicAuth:
          apr:
            users:
              user:
                hashedPassword: 8BvzLUO9IfGPGGsPnAgSu1
                salt: TYiryv0/
    server:
      name: default-server
---
apiVersion: admin.gloo.solo.io/v2
kind: ExtAuthServer
metadata:
  annotations:
    cluster.solo.io/cluster: ""
  name: default-server
  namespace: bookinfo
spec:
  destinationServer:
    port:
      number: 8083
    ref:
      cluster: cluster-1
      name: ext-auth-service
      namespace: gloo-mesh
  

For more complex examples, see the guide for the type of external auth policy that you want to apply.

ExtAuthPolicyReport link

ExtAuthPolicyReport.WorkspacesEntry link

ExtAuthPolicySpec link

Specifications for the policy.

ExtAuthPolicySpec.Config link

Make sure to select the appropriate ExtAuthServer to use, which might be in a different cluster and namespace than the ExtAuthPolicy. For auth configurations that require a client secret from the identity provider issuer, the secret must be in the same cluster as the ExtAuthServer resource.

ExtAuthPolicySpec.Config.CustomAuth link

Configure the selected route or destination with auth options provided by your own external auth server.

ExtAuthPolicySpec.Config.CustomAuth.ContextExtensionsEntry link

ExtAuthPolicyStatus link

The status of the policy after it is applied to your Gloo environment.