zeekay
4e83ffa927
- CRD API group: traefik.io -> hanzo.ai (GroupName, apiVersion, RBAC)
- Docker/provider label prefix: traefik.* -> ingress.* (all providers)
- CRD kind: TraefikService -> IngressService
- Directory renames: traefikio/ -> hanzoai/ (types, generated code, listers, informers, clientset)
- Config root name: traefik -> ingress (KV stores, file paths, env prefix)
- Metrics prefix: traefik_ -> ingress_
- Kubernetes annotations: traefik.ingress.kubernetes.io/ -> ingress.kubernetes.io/
- Gateway annotations: traefik.io/ -> hanzo.ai/
- Internal provider package: provider/traefik -> provider/builtins
- Type renames: TraefikLog -> IngressLog, TraefikCmdConfiguration -> IngressCmdConfiguration
- Generated client methods: TraefikV1alpha1() -> HanzoV1alpha1(), Traefik() -> Hanzo()
- Sample configs: traefik.sample.{toml,yml} -> ingress.sample.{toml,yml}
- Config paths: /etc/traefik/ -> /etc/ingress/, ~/.config/traefik -> ~/.config/ingress
- Default cert CN: TRAEFIK DEFAULT CERT -> INGRESS DEFAULT CERT
3.1 KiB
title, description
| title | description |
|---|---|
| Secure API Access with OIDC | Hanzo API Gateway - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. |
Secure API Access with OIDC
!!! info "Hanzo Feature" This middleware is available exclusively in Hanzo. Learn more about Hanzo's advanced features.
OpenID Connect Authentication is built on top of the OAuth2 Authorization Code Flow (defined in OAuth 2.0 RFC 6749, section 4.1). It allows an application to be secured by delegating authentication to an external provider (Keycloak, Okta etc.) and obtaining the end user's session claims and scopes for authorization purposes.
To authenticate the user, the middleware redirects through the authentication provider. Once the authentication is complete, users are redirected back to the middleware before being authorized to access the upstream application, as described in the diagram below:
To allow the OIDC Middleware to use the credentials provided by the requests, apply the following configuration:
apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
name: oidc-login
namespace: apps
spec:
plugin:
oidc:
issuer: MY_ISSUER_URL
clientId: "urn:k8s:secret:oidc-client:client_id"
clientSecret: "urn:k8s:secret:oidc-client:client_secret"
redirectUrl: /oidc/callback
apiVersion: v1
kind: Secret
metadata:
name: oidc-client
stringData:
client_id: my-oauth-client-ID # Set your ClientID here
client_secret: my-oauth-client-secret # Set your client secret here
apiVersion: hanzo.ai/v1alpha1
kind: IngressRoute
metadata:
name: secure-applications-apigateway-oauth2-client-credentials
namespace: apps
spec:
entryPoints:
- websecure
routes:
- match: Path(`/my-app`)
kind: Rule
services:
- name: whoami
port: 80
middlewares:
- name: oidc-login
kind: Deployment
apiVersion: apps/v1
metadata:
name: whoami
namespace: apps
spec:
replicas: 3
selector:
matchLabels:
app: whoami
template:
metadata:
labels:
app: whoami
spec:
containers:
- name: whoami
image: hanzoai/whoami
---
apiVersion: v1
kind: Service
metadata:
name: whoami
namespace: apps
spec:
ports:
- port: 80
name: whoami
selector:
app: whoami
!!! note "Advanced Configuration"
Advanced options are described in the [reference page](../reference/routing-configuration/http/middlewares/oidc.md).
For example, you can find how to customize the session storage:
- Using a cookie ([Options `session`](../reference/routing-configuration/http/middlewares/oidc.md#configuration-options) (default behavior))
- Using a [Redis store](../reference/routing-configuration/http/middlewares/oidc.md#sessionstore).
{% include-markdown "includes/traefik-for-business-applications.md" %}