Google

You can use Gloo Mesh Gateway external auth to authenticate users to your apps with other accounts that they have. In this guide, you set up Gloo Mesh Gateway to authenticate with users’ Google accounts. You can adapt these steps for other identity providers, such as Apple or Facebook.

Before you begin link

1. Set up Gloo Mesh Gateway in a single cluster.
2. Install Bookinfo and other sample apps.

3. Configure an HTTP listener on your gateway and set up basic routing for the sample apps.

4. Make sure that the external auth service is installed and running. If not, install the external auth service.

     kubectl get pods -A -l app=ext-auth-service
     

Register your app with Google link

To use Google as an identity provider (IdP), you must register your app with the Google API.

1. Log in to the Google Developer Console.
2. Optional: For first-time users, or to separate your resources from others in your cloud, create a project.
3. Configure your OAuth consent screen details. If you have an existing consent screen that you want to use, skip to the next step.
   1. From the menu, click OAuth consent screen.
   2. Select the Internal user type, and click Create.
   3. From the OAuth consent screen tab, enter the details of your app.
      • In the App information section, enter a name and email for your app.
      • You can skip the App domain and Authorized domain sections.
      • In the Developer contact information section, enter your email.
      • Click Save and continue.
   4. Optional: From the Scopes tab, you can restrict permissions to particular APIs in your app. For testing purposes, you can skip this section. Click Save and continue.
   5. Review the summary and click Back to dashboard.
4. Create the credentials to use Google as an OAuth client.
   1. From the menu, click Credentials.
   2. From the Credentials menu bar, click + Create credentials, and then OAuth client ID.
   3. From the Application type dropdown, select Web application. You can optionally rename the client.
   4. In the Authorized redirect URIs section, click + Add URI.
   5. Enter the following URI for demonstration purposes: http://localhost:8080/callback
   6. Click Create.
5. Store the Client ID and Client secret values as environment variables. You can also download the client information as a JSON file.

     export CLIENT_ID=<client-id>
   export CLIENT_SECRET=<client-secret>
     

Configure an OAuth policy link

Create the external auth policy that uses Google as an identity provider.

1. Store the client secret as a Kubernetes secret in the workload cluster that you want to create the external auth policy in.

     kubectl apply -f - <<EOF
   apiVersion: v1
   kind: Secret
   metadata:
     name: google
     namespace: bookinfo
   type: extauth.solo.io/oauth
   data:
     client-secret: $(echo -n ${CLIENT_SECRET} | base64)
   EOF
     

2. Create an external auth server to use for your policy.

     kubectl apply -f - <<EOF
   apiVersion: admin.gloo.solo.io/v2
   kind: ExtAuthServer
   metadata:
     name: ext-auth-server
     namespace: bookinfo
   spec:
     destinationServer:
       port:
         number: 8083
       ref:
         cluster: $CLUSTER_NAME
         name: ext-auth-service
         namespace: gloo-mesh
   EOF
     

3. Create a route table for the ratings app and external auth policy. Note that the route table selects the virtual gateway that you created before you began, and routes to the ratings service.

     kubectl apply -f - <<EOF
   apiVersion: networking.gloo.solo.io/v2
   kind: RouteTable
   metadata:
     name: bookinfo
     namespace: bookinfo
     labels:
       expose: "true"
   spec:
     hosts:
       - '*'
     virtualGateways:
       - name: istio-ingressgateway
         namespace: bookinfo
         cluster: $CLUSTER_NAME
     workloadSelectors: []
     http:
       - name: ratings
         labels:
           oauth: "true"
         matchers:
         - uri:
             exact: /ratings/1
         - uri:
             prefix: /callback
         forwardTo:
           destinations:
           - ref:
               name: ratings
               namespace: bookinfo
               cluster: $CLUSTER_NAME
   EOF
     

4. Create an external auth policy that uses Google for OIDC.

     kubectl apply -f - <<EOF
   apiVersion: security.policy.gloo.solo.io/v2
   kind: ExtAuthPolicy
   metadata:
     name: ratings-google
     namespace: bookinfo
   spec:
     applyToRoutes:
     - route:
         labels:
           oauth: "true"
     config:
       server:
         name: ext-auth-server
         namespace: bookinfo
         cluster: $CLUSTER_NAME
       glooAuth:
         configs:
         - oauth2:
             oidcAuthorizationCode:
               appUrl: http://localhost:8080
               callbackPath: /callback
               clientId: ${CLIENT_ID}
               clientSecretRef:
                 name: google
                 namespace: bookinfo
               issuerUrl: https://accounts.google.com
               scopes:
               - email
               session:
                 cookieOptions:
                   notSecure: true
               headers:
                 idTokenHeader: jwt
   EOF
     

Review the following table to understand this configuration. For more information, see the API reference.

Verify the OAuth policy link

1. Enable port-forwarding of the ingress gateway so that you can reach your apps on the local host. You can store the port-forward process ID as an environment variable so that you can end the process later. If you deployed your ingress gateway in a different namespace or with a different version, update the command.

     kubectl port-forward -n gloo-mesh-gateways deploy/$(kubectl get deployment -l "app=istio-ingressgateway" -n gloo-mesh-gateways -o jsonpath='{.items[].metadata.name}') 8080
     

2. In your web browser, open the path to your application. You are redirected to the authentication page from the Google identity provider.

3. Enter your user credentials from Google.

   

   

   Example output: Gloo Gateway redirects you to the /callback page, with the information from Google added as a query string in the URL.

   

   

Cleanup link

  kubectl delete secret google -n bookinfo 
kubectl delete extauthserver ext-auth-server -n bookinfo 
kubectl delete routetable bookinfo -n bookinfo 
kubectl delete extauthpolicy ratings-google -n bookinfo