# HAProxy Ingress Basic Authentication This example demonstrates how to configure [Basic Authentication](https://tools.ietf.org/html/rfc2617) on HAProxy Ingress controller. ## Prerequisites This document has the following prerequisites: * Deploy [HAProxy Ingress controller](/examples/deployment/haproxy), you should end up with controller, a sample web app and an ingress resource to the `foo.bar` domain As mentioned in the deployment instructions, you MUST turn down any existing ingress controllers before running HAProxy Ingress. ## Using Basic Authentication HAProxy Ingress read user and password from `auth` file stored on secrets, one user and password per line. Secret name, realm and type are configured with annotations in the ingress resource: * `ingress.kubernetes.io/auth-type`: the only supported type is `basic` * `ingress.kubernetes.io/auth-realm`: an optional string with authentication realm * `ingress.kubernetes.io/auth-secret`: name of the secret Each line of the `auth` file should have: * user and insecure password separated with a pair of colons: `::`; or * user and an encrypted password separated with colons: `:` HAProxy evaluates encrypted passwords with [crypt](http://man7.org/linux/man-pages/man3/crypt.3.html) function. Use `mkpasswd` or `makepasswd` to create it. `mkpasswd` can be found on Alpine Linux container. ## Configure Create a secret to our users: * `john` and password `admin` using insecure plain text password * `jane` and password `guest` using encrypted password ```console $ mkpasswd -m des ## a short, des encryption, syntax from Busybox on Alpine Linux Password: (type 'guest' and press Enter) E5BrlrQ5IXYK2 $ cat >auth <

401 Unauthorized

You need a valid user and password to access this content. ``` Send a valid user: ```console $ curl -i -u 'john:admin' 172.17.4.99:30876 -H 'Host: foo.bar' HTTP/1.1 200 OK Server: nginx/1.9.11 Date: Sun, 05 Mar 2017 19:22:33 GMT Content-Type: text/plain Transfer-Encoding: chunked CLIENT VALUES: client_address=10.2.18.5 command=GET real path=/ query=nil request_version=1.1 request_uri=http://foo.bar:8080/ ``` Using `jane:guest` user/passwd should have the same output.