2018-08-30 18:24:56 +00:00
|
|
|
# External Basic Authentication
|
2017-03-08 12:02:13 +00:00
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
### Example 1
|
2017-03-08 12:02:13 +00:00
|
|
|
|
2019-12-12 23:12:12 +00:00
|
|
|
Use an external service (Basic Auth) located in `https://httpbin.org`
|
2017-03-08 12:02:13 +00:00
|
|
|
|
|
|
|
|
```
|
|
|
|
|
$ kubectl create -f ingress.yaml
|
|
|
|
|
ingress "external-auth" created
|
2018-01-28 00:32:08 +00:00
|
|
|
|
2017-03-08 12:02:13 +00:00
|
|
|
$ kubectl get ing external-auth
|
|
|
|
|
NAME HOSTS ADDRESS PORTS AGE
|
|
|
|
|
external-auth external-auth-01.sample.com 172.17.4.99 80 13s
|
2018-01-28 00:32:08 +00:00
|
|
|
|
2017-03-08 12:02:13 +00:00
|
|
|
$ kubectl get ing external-auth -o yaml
|
2021-08-21 20:42:00 +00:00
|
|
|
apiVersion: networking.k8s.io/v1
|
2017-03-08 12:02:13 +00:00
|
|
|
kind: Ingress
|
|
|
|
|
metadata:
|
|
|
|
|
annotations:
|
2017-11-24 18:46:51 +00:00
|
|
|
nginx.ingress.kubernetes.io/auth-url: https://httpbin.org/basic-auth/user/passwd
|
2017-03-08 12:02:13 +00:00
|
|
|
creationTimestamp: 2016-10-03T13:50:35Z
|
|
|
|
|
generation: 1
|
|
|
|
|
name: external-auth
|
|
|
|
|
namespace: default
|
|
|
|
|
resourceVersion: "2068378"
|
2021-08-21 20:42:00 +00:00
|
|
|
selfLink: /apis/networking/v1/namespaces/default/ingresses/external-auth
|
2017-03-08 12:02:13 +00:00
|
|
|
uid: 5c388f1d-8970-11e6-9004-080027d2dc94
|
|
|
|
|
spec:
|
|
|
|
|
rules:
|
|
|
|
|
- host: external-auth-01.sample.com
|
|
|
|
|
http:
|
|
|
|
|
paths:
|
2021-11-02 00:12:58 +00:00
|
|
|
- path: /
|
|
|
|
|
pathType: Prefix
|
|
|
|
|
backend:
|
|
|
|
|
service:
|
|
|
|
|
name: http-svc
|
|
|
|
|
port:
|
|
|
|
|
number: 80
|
2017-03-08 12:02:13 +00:00
|
|
|
status:
|
|
|
|
|
loadBalancer:
|
|
|
|
|
ingress:
|
|
|
|
|
- ip: 172.17.4.99
|
|
|
|
|
$
|
|
|
|
|
```
|
|
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
## Test 1: no username/password (expect code 401)
|
2017-10-13 13:55:03 +00:00
|
|
|
|
|
|
|
|
```console
|
2017-03-08 12:02:13 +00:00
|
|
|
$ curl -k http://172.17.4.99 -v -H 'Host: external-auth-01.sample.com'
|
|
|
|
|
* Rebuilt URL to: http://172.17.4.99/
|
|
|
|
|
* Trying 172.17.4.99...
|
|
|
|
|
* Connected to 172.17.4.99 (172.17.4.99) port 80 (#0)
|
|
|
|
|
> GET / HTTP/1.1
|
|
|
|
|
> Host: external-auth-01.sample.com
|
|
|
|
|
> User-Agent: curl/7.50.1
|
|
|
|
|
> Accept: */*
|
|
|
|
|
>
|
|
|
|
|
< HTTP/1.1 401 Unauthorized
|
|
|
|
|
< Server: nginx/1.11.3
|
|
|
|
|
< Date: Mon, 03 Oct 2016 14:52:08 GMT
|
|
|
|
|
< Content-Type: text/html
|
|
|
|
|
< Content-Length: 195
|
|
|
|
|
< Connection: keep-alive
|
|
|
|
|
< WWW-Authenticate: Basic realm="Fake Realm"
|
|
|
|
|
<
|
|
|
|
|
<html>
|
|
|
|
|
<head><title>401 Authorization Required</title></head>
|
|
|
|
|
<body bgcolor="white">
|
|
|
|
|
<center><h1>401 Authorization Required</h1></center>
|
|
|
|
|
<hr><center>nginx/1.11.3</center>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
|
|
|
|
* Connection #0 to host 172.17.4.99 left intact
|
|
|
|
|
```
|
|
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
## Test 2: valid username/password (expect code 200)
|
|
|
|
|
|
2017-03-08 12:02:13 +00:00
|
|
|
```
|
|
|
|
|
$ curl -k http://172.17.4.99 -v -H 'Host: external-auth-01.sample.com' -u 'user:passwd'
|
|
|
|
|
* Rebuilt URL to: http://172.17.4.99/
|
|
|
|
|
* Trying 172.17.4.99...
|
|
|
|
|
* Connected to 172.17.4.99 (172.17.4.99) port 80 (#0)
|
|
|
|
|
* Server auth using Basic with user 'user'
|
|
|
|
|
> GET / HTTP/1.1
|
|
|
|
|
> Host: external-auth-01.sample.com
|
|
|
|
|
> Authorization: Basic dXNlcjpwYXNzd2Q=
|
|
|
|
|
> User-Agent: curl/7.50.1
|
|
|
|
|
> Accept: */*
|
|
|
|
|
>
|
|
|
|
|
< HTTP/1.1 200 OK
|
|
|
|
|
< Server: nginx/1.11.3
|
|
|
|
|
< Date: Mon, 03 Oct 2016 14:52:50 GMT
|
|
|
|
|
< Content-Type: text/plain
|
|
|
|
|
< Transfer-Encoding: chunked
|
|
|
|
|
< Connection: keep-alive
|
|
|
|
|
<
|
|
|
|
|
CLIENT VALUES:
|
|
|
|
|
client_address=10.2.60.2
|
|
|
|
|
command=GET
|
|
|
|
|
real path=/
|
|
|
|
|
query=nil
|
|
|
|
|
request_version=1.1
|
|
|
|
|
request_uri=http://external-auth-01.sample.com:8080/
|
|
|
|
|
|
|
|
|
|
SERVER VALUES:
|
|
|
|
|
server_version=nginx: 1.9.11 - lua: 10001
|
|
|
|
|
|
|
|
|
|
HEADERS RECEIVED:
|
|
|
|
|
accept=*/*
|
|
|
|
|
authorization=Basic dXNlcjpwYXNzd2Q=
|
|
|
|
|
connection=close
|
|
|
|
|
host=external-auth-01.sample.com
|
|
|
|
|
user-agent=curl/7.50.1
|
|
|
|
|
x-forwarded-for=10.2.60.1
|
|
|
|
|
x-forwarded-host=external-auth-01.sample.com
|
|
|
|
|
x-forwarded-port=80
|
|
|
|
|
x-forwarded-proto=http
|
|
|
|
|
x-real-ip=10.2.60.1
|
|
|
|
|
BODY:
|
|
|
|
|
* Connection #0 to host 172.17.4.99 left intact
|
|
|
|
|
-no body in request-
|
|
|
|
|
```
|
|
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
## Test 3: invalid username/password (expect code 401)
|
|
|
|
|
|
2017-03-08 12:02:13 +00:00
|
|
|
```
|
|
|
|
|
curl -k http://172.17.4.99 -v -H 'Host: external-auth-01.sample.com' -u 'user:user'
|
|
|
|
|
* Rebuilt URL to: http://172.17.4.99/
|
|
|
|
|
* Trying 172.17.4.99...
|
|
|
|
|
* Connected to 172.17.4.99 (172.17.4.99) port 80 (#0)
|
|
|
|
|
* Server auth using Basic with user 'user'
|
|
|
|
|
> GET / HTTP/1.1
|
|
|
|
|
> Host: external-auth-01.sample.com
|
|
|
|
|
> Authorization: Basic dXNlcjp1c2Vy
|
|
|
|
|
> User-Agent: curl/7.50.1
|
|
|
|
|
> Accept: */*
|
|
|
|
|
>
|
|
|
|
|
< HTTP/1.1 401 Unauthorized
|
|
|
|
|
< Server: nginx/1.11.3
|
|
|
|
|
< Date: Mon, 03 Oct 2016 14:53:04 GMT
|
|
|
|
|
< Content-Type: text/html
|
|
|
|
|
< Content-Length: 195
|
|
|
|
|
< Connection: keep-alive
|
|
|
|
|
* Authentication problem. Ignoring this.
|
|
|
|
|
< WWW-Authenticate: Basic realm="Fake Realm"
|
|
|
|
|
<
|
|
|
|
|
<html>
|
|
|
|
|
<head><title>401 Authorization Required</title></head>
|
|
|
|
|
<body bgcolor="white">
|
|
|
|
|
<center><h1>401 Authorization Required</h1></center>
|
|
|
|
|
<hr><center>nginx/1.11.3</center>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
|
|
|
|
* Connection #0 to host 172.17.4.99 left intact
|
|
|
|
|
```
|
