External auth with Google

First, you set up your OAuth app and credentials in Google. Then, you use those credentials to configure Google as the external auth provider for the Gloo UI.

Before you begin link

1. Complete the get started guide to install Gloo Mesh Enterprise.
2. Optional: Review the information about how authentication and authorization work with the Gloo UI.

Set up OAuth in Google link

Set up Google to accept external auth requests from the Gloo UI. You get credentials that you can use to set up Google as an identity provider (IdP) in Gloo UI.

1. Log in to the Google Developer Console.
2. Optional: For first-time users, or to separate your resources from others in your cloud, create a project.
3. Configure your OAuth consent screen details. If you have an existing consent screen that you want to use, skip to the next step.
   1. From the menu, click OAuth consent screen.
   2. Select the Internal user type, and click Create.
   3. From the OAuth consent screen tab, enter the details of your app.
      • In the App information section, enter a name and email for your app.
      • You can skip the App domain and Authorized domain sections.
      • In the Developer contact information section, enter your email.
      • Click Save and continue.
   4. Optional: From the Scopes tab, you can restrict permissions to particular APIs in your app. For testing purposes, you can skip this section. Click Save and continue.
   5. Review the summary and click Back to dashboard.
4. Create the credentials to use Google as an OAuth client.
   1. From the menu, click Credentials.
   2. From the Credentials menu bar, click + Create credentials, and then OAuth client ID.
   3. From the Application type dropdown, select Web application. You can optionally rename the client.
   4. In the Authorized redirect URIs section, click + Add URI.
   5. Enter the URL for users to access the Gloo UI. For example, if you expose the UI locally, enter http://localhost:8090/oidc-callback.
   6. Click Create.
5. Store the Client ID and Client secret values as environment variables. You can also download the client information as a JSON file.

     export CLIENT_ID=<client-id>
   export CLIENT_SECRET=<client-secret>
     

Configure the dashboard settings for authentication link

Configure the Gloo UI to use Google authentication.

1. Create a Kubernetes secret with the client secret from your Google credentials. Note that the client secret value is base64-encoded.

     kubectl apply -f - <<EOF
   apiVersion: v1
   kind: Secret
   type: Opaque
   metadata:
     name: dashboard
     namespace: gloo-mesh
   data:
     oidc-client-secret: $(echo -n ${CLIENT_SECRET} | base64)
   EOF
     

2. Create a Dashboard custom resource.

     kubectl apply -f - <<EOF
   apiVersion: admin.gloo.solo.io/v2
   kind: Dashboard
   metadata:
     name: settings
     namespace: gloo-mesh
   spec:
     authn:
       oidc:
         appUrl: http://localhost:8090/
         clientId: ${CLIENT_ID}
         clientSecretName: dashboard
         issuerUrl: https://accounts.google.com
   EOF
     

   Review the following table to understand this configuration. For more information, see the API reference.

   Setting	Description
   namespace	Create the dashboard settings in the same namespace as the Gloo UI deployment (gloo-mesh) in the management cluster.
   authn.oidc	Configure the details to set up authentication via an OIDC provider, in this case Google.
   appURL	The URL to send the user to after successful authentication: http://localhost:8090/
   clientId	The client ID token that you got when you registered your app with the identity provider. In this example, you set the client ID as an environment variable on your local machine in the previous section.
   clientSecretRef	The Kubernetes secret that has the client secret that you got when you registered your app with the identity provider. The secret must exist on the same cluster as the ExtAuthServer resource that this policy refers to. In this example, you created the secret in the previous step.
   issuerUrl	The URL of the OpenID Connect identity provider. Gloo Mesh Enterprise automatically discovers the OIDC configuration by querying the .well-known/openid-configuration endpoint on the issuer_url. In this example, Gloo Mesh Enterprise expects to find OIDC discovery information at https://accounts.google.com.

3. Open the Gloo UI.

     meshctl dashboard
     

4. Test that the Gloo UI requires authentication by opening the login URL and clicking Sign in to Gloo Mesh Enterprise. This URL matches the Authorized redirect URIs that you configured in your Google credentials, such as http://localhost:8090/welcome.

Cleanup link

You can optionally remove the resources that you set up as part of this guide.

1. Remove the OIDC authentication section from the dashboard resource.

     kubectl apply -f - <<EOF
   apiVersion: admin.gloo.solo.io/v2
   kind: Dashboard
   metadata:
     name: settings
     namespace: gloo-mesh
   EOF
     

2. Remove the Kubernetes secret with your Okta OIDC credentials.

     kubectl delete secret dashboard -n gloo-mesh
     

3. Remove the OIDC credentials in your Google account.

   1. Log in to the Google Developer Console.
   2. From the Credentials, find the credentials that you created earlier and use the trash icon to remove them.

Next steps link

Great job on setting up external authentication to the Gloo UI! Now, Gloo Mesh Enterprise extracts the username in the format expected from the AuthN user mapping from the Google tokens. Then, it matches the username to the cluster role binding in RBAC for authorization.

Next, review this guide to:

• Configure your OIDC settings by using a Helm values file and use that file to install Gloo Mesh Enterprise. Setting up OIDC by using Helm ensures that your settings are not overwritten, even after you upgrade Gloo Mesh Enterprise.
• Persist UI sessions by storing the Google tokens in Redis instead of only in the user’s browser.