Skip to content

Commit c937366

Browse files
committed
Fix pre-commit and lint errors
1 parent 9047c3e commit c937366

File tree

1 file changed

+20
-17
lines changed

1 file changed

+20
-17
lines changed

docs/proposals/authentication-filter.md

Lines changed: 20 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -47,11 +47,12 @@ This document also focus on HTTP Basic Authentication and JWT Authentication. Ot
4747

4848
This portion of the proposal will cover API design and interaction experience for use of Basic Auth and JWT.
4949
This portioan also contains:
50+
5051
1. The Golang API
5152
2. Example spec for Basic Auth
5253
- Example HTTPRoutes and NINGX configuration
5354
3. Example spec for JWT Auth
54-
- Example HTTPRoutes
55+
- Example HTTPRoutes
5556
- Examples for Local & Remote JWKS configration
5657
- Example NINGX configuration for both Local & Remote JWKS
5758
- Example of additioanl optional fields
@@ -575,6 +576,7 @@ http {
575576
### Example spec for JWT Auth
576577

577578
For JWT Auth, there is two options.
579+
578580
1. Local JWKS file stored as as a Secret or as a ConfigMap
579581
2. Remote JWKS from an IdP provider like Keycloak
580582

@@ -593,8 +595,8 @@ spec:
593595
mode: File # Defaults to File.
594596
file:
595597
# In File mode, exactly one of configMapRef or secretRef must be defined.
596-
configMapRef:
597-
name: jwt-keys
598+
configMapRef:
599+
name: jwt-keys
598600
secretRef:
599601
name: jwt-keys-secure
600602
key: jwks.json
@@ -769,11 +771,12 @@ http {
769771
}
770772
```
771773

772-
2. NGINX Config when using `Mode: Remote`
774+
1. NGINX Config when using `Mode: Remote`
773775

774776
These are some directives the `Remote` mode uses over the `File` mode:
775-
- `auth_jwt_key_request`: When using the `Remote` mode, this is used in place of `auth_jwt_key_file`. This will call the `internal` NGINX location `/jwks_uri` to redirect the request to the external auth provider (e.g. KeyCloak)
776-
- `proxy_cache_path`: This is used to configuring caching of the JWKS after an initial request allowing subseuqnt requests to not request re-authenticaiton for a time
777+
778+
- `auth_jwt_key_request`: When using the `Remote` mode, this is used in place of `auth_jwt_key_file`. This will call the `internal` NGINX location `/jwks_uri` to redirect the request to the external auth provider (e.g. KeyCloak)
779+
- `proxy_cache_path`: This is used to configuring caching of the JWKS after an initial request allowing subseuqnt requests to not request re-authenticaiton for a time
777780

778781
```nginx
779782
http {
@@ -878,7 +881,7 @@ spec:
878881
mode: Remote
879882
remote:
880883
url: https://issuer.example.com/.well-known/jwks.json
881-
884+
882885
# Required claims (exact matching done via maps in NGINX; see config)
883886
require:
884887
iss:
@@ -887,15 +890,15 @@ spec:
887890
aud:
888891
- "api"
889892
- "cli"
890-
893+
891894
# Where client presents the token (defaults to Authorization header)
892895
tokenSource:
893896
header: true
894897
cookie: false
895898
cookieName: access_token
896899
query: false
897900
queryParam: access_token
898-
901+
899902
# Identity propagation to backend and header stripping
900903
propagation:
901904
addIdentityHeaders:
@@ -1076,20 +1079,20 @@ It is certainly possible for us to provide an External Authentication Services t
10761079

10771080
In regards to documentation of filter behavour with the `AuthenticationFilter`, the Gateway API documentation on filters states the following:
10781081

1079-
```
1082+
```text
10801083
Wherever possible, implementations SHOULD implement filters in the order they are specified.
10811084
10821085
Implementations MAY choose to implement this ordering strictly, rejecting
1083-
any combination or order of filters that cannot be supported.
1086+
any combination or order of filters that cannot be supported.
10841087
If implementations choose a strict interpretation of filter ordering, they MUST clearly
10851088
document that behavior.
10861089
```
10871090

10881091
## References
10891092

1090-
- [Gateway API ExternalAuthFilter GEP]((https://gateway-api.sigs.k8s.io/geps/gep-1494/))
1091-
- [HTTPExternalAuthFilter Specification](https://gateway-api.sigs.k8s.io/reference/spec/#httpexternalauthfilter)
1092-
- [Kubernetes documentation on CEL validaton](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules)
1093-
- [NGINX HTTP Basic Auth Module](https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html)
1094-
- [NGINX JWT Auth Module](https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html)
1095-
- [NGINX OIDC Module](https://nginx.org/en/docs/http/ngx_http_oidc_module.html)
1093+
- [Gateway API ExternalAuthFilter GEP]((https://gateway-api.sigs.k8s.io/geps/gep-1494/))
1094+
- [HTTPExternalAuthFilter Specification](https://gateway-api.sigs.k8s.io/reference/spec/#httpexternalauthfilter)
1095+
- [Kubernetes documentation on CEL validaton](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules)
1096+
- [NGINX HTTP Basic Auth Module](https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html)
1097+
- [NGINX JWT Auth Module](https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html)
1098+
- [NGINX OIDC Module](https://nginx.org/en/docs/http/ngx_http_oidc_module.html)

0 commit comments

Comments
 (0)