I am trying to integrate keycloak with the kubernetes applications using oauth2 proxy. The use case is to authorize applications and API calls using keycloak with browser login/Bearer token. I have an example application, oauth2 proxy and keycloak running in the same namespace of kubernetes cluster. All the 3 applications are behind nginx-ingress.
Currently I am able to authorize the application using the keycloak browser login, but facing issue while authenticating it using curl request or with postman.
Expected Behaviour: The expected behaviour is that it should authorize the request using bearer token and give me the output from example app.
Microservice Endpoints:
- keycloak: keycloak.microservices.com
- example-app: app.microservices.com/demo-service
- oauth2 proxy: app.microservices.com/oauth2
What I tried:
- Tried making curl request using
-H "Authorization Bearer TOKEN". It returns302redirect error - Tried making request from postman but it returns
200 OKwith html code for keycloak sign in page. - I tried changing config in oauth2 config.
current oauth2-proxy configmap arguments:
oauth2-proxy.cfg: |-
provider="keycloak"
provider_display_name="Keycloak"
login_url="https://<DOMAIN>/realms/test/protocol/openid-connect/auth"
redeem_url="https://<DOMAIN>/realms/test/protocol/openid-connect/token"
validate_url="https://<DOMAIN>/realms/test/protocol/openid-connect/userinfo"
profile_url="https://<DOMAIN>/realms/test/protocol/openid-connect/userinfo"
skip_jwt_bearer_tokens="true"
pass_authorization_header = "true"
pass_access_token = "true"
pass_user_headers = "true"
pass_basic_auth= "true"
set_authorization_header = "true"
set_xauthrequest = "true"
cookie_refresh = "1m"
cookie_expire = "30m"
request_logging="true"
auth_logging="true"
standard_logging="true"
client_id="CLIENT_ID"
client_secret="xyz"
cookie_secret="xyz"
cookie_secure="true"
# Upstream config
http_address="0.0.0.0:4180"
upstreams="file:///dev/null"
email_domains=["*"]
oidc_issuer_url="https://<DOMAIN>/realms/nginx-plus"
cookie_domains=["*"]
scope="openid"
whitelist_domains=["*"]
error:
Error retrieving session from token in Authorization header: [unable to verify bearer token, not implemented]
example-app ingress annotations:
nginx.ingress.kubernetes.io/auth-signin: http://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: http://oauth-proxy.keycloak.svc.cluster.local:4180/oauth2/auth
nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user, x-auth-request-email"