Durch die Nutzung von AWS re:Post stimmt du den AWS re:Post Nutzungsbedingungen
AWS re:Postre:Post

Can oauth2-proxy be used with an ALB?

0

I have an oauth2-proxy working with ingress-nginx and TLS terminating at the NLB, to protect an application behind it. Browsing to mycompany.com redirects to my oauth provider and after authenticating redirects to the app as expected.

However, I'd like to use an Application Load Balancer (ALB) instead of a Network Load Balancer, is it possible?

The ALB doesn't seem to support annotations such as: nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth" nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri" so I wonder if I'm barking up the wrong tree here.

TIA.

Themen
AWS Framework mit guter Struktur
Tags
SicherheitApplication Load BalancerNetwork Load Balancer
Sprache
English
jmmike
gefragt vor 4 Monaten412 Aufrufe
1 Antwort
1

Is this what you are looking for? https://medium.com/@jainendramandavi/okta-oidc-integration-with-aws-application-load-balancer-alb-5f6e03bbb66b

If not, can you explain what you mean by ALB not supporting the annotations?

AWS
EXPERTE
Aanchal Agrawal
beantwortet vor 4 Monaten
  • jmmike
    vor 4 Monaten

    [ EDIT: It seems Github doesn't support Open ID, rather OAUTH, so probably not compatible with ALB authentication: I will pursue using a different provider, thank you. ]

    Thanks for taking the time to reply! I was previously following this guide: kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth - but the way you suggest in the above article looks like it would be a lot simpler. However, trying to configure this for github "https://token.actions.githubusercontent.com" gives me the error when navigating to my page: "This token.actions.githubusercontent.com page can’t be found" I assume this means the URLs I've configured in the ALB OIDC settings are incorrect?

  • Aanchal Agrawal EXPERTE
    vor 4 Monaten

    I think so. Would need to look into the configuration further on what has been setup. Found a few documents online for it, not sure if it helps: https://stackoverflow.com/questions/76230388/github-actions-error-no-openidconnect-provider-found-in-your-account-for-https

    There's more guides over the internet. Let me know if those solutions don't work.

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen

Relevanter Inhalt