You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/proposals/authentication-filter.md
+20-17Lines changed: 20 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,11 +47,12 @@ This document also focus on HTTP Basic Authentication and JWT Authentication. Ot
47
47
48
48
This portion of the proposal will cover API design and interaction experience for use of Basic Auth and JWT.
49
49
This portioan also contains:
50
+
50
51
1. The Golang API
51
52
2. Example spec for Basic Auth
52
53
- Example HTTPRoutes and NINGX configuration
53
54
3. Example spec for JWT Auth
54
-
- Example HTTPRoutes
55
+
- Example HTTPRoutes
55
56
- Examples for Local & Remote JWKS configration
56
57
- Example NINGX configuration for both Local & Remote JWKS
57
58
- Example of additioanl optional fields
@@ -575,6 +576,7 @@ http {
575
576
### Example spec for JWT Auth
576
577
577
578
For JWT Auth, there is two options.
579
+
578
580
1. Local JWKS file stored as as a Secret or as a ConfigMap
579
581
2. Remote JWKS from an IdP provider like Keycloak
580
582
@@ -593,8 +595,8 @@ spec:
593
595
mode: File # Defaults to File.
594
596
file:
595
597
# In File mode, exactly one of configMapRef or secretRef must be defined.
596
-
configMapRef:
597
-
name: jwt-keys
598
+
configMapRef:
599
+
name: jwt-keys
598
600
secretRef:
599
601
name: jwt-keys-secure
600
602
key: jwks.json
@@ -769,11 +771,12 @@ http {
769
771
}
770
772
```
771
773
772
-
2. NGINX Config when using `Mode: Remote`
774
+
1. NGINX Config when using `Mode: Remote`
773
775
774
776
These are some directives the `Remote` mode uses over the `File` mode:
775
-
- `auth_jwt_key_request`: When using the `Remote` mode, this is used in place of `auth_jwt_key_file`. This will call the `internal` NGINX location `/jwks_uri` to redirect the request to the external auth provider (e.g. KeyCloak)
776
-
- `proxy_cache_path`: This is used to configuring caching of the JWKS after an initial request allowing subseuqnt requests to not request re-authenticaiton for a time
777
+
778
+
- `auth_jwt_key_request`: When using the `Remote` mode, this is used in place of `auth_jwt_key_file`. This will call the `internal` NGINX location `/jwks_uri` to redirect the request to the external auth provider (e.g. KeyCloak)
779
+
- `proxy_cache_path`: This is used to configuring caching of the JWKS after an initial request allowing subseuqnt requests to not request re-authenticaiton for a time
- [Kubernetes documentation on CEL validaton](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules)
- [Kubernetes documentation on CEL validaton](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules)
0 commit comments