Configure OIDC authentication using an OIDC discovery URL
#2921 aperta il 9 dic 2022
Metriche repository
- Star
- (4317 stelle)
- Metriche merge PR
- (Metriche PR in attesa)
Descrizione
Is your feature request related to a problem? No, this is an enhancement.
Describe the solution you'd like
Being able to use a single OpenID Connect Discovery endpoint in the alb.ingress.kubernetes.io/auth-idp-oidc annotation, instead of having to specify multiple OIDC configuration fields.
This would greatly simplify configuration of OIDC authentication when using an IdP that supports discovery (e.g. Keycloak, Okta, etc).
Currently the annotation has to specify a number of fields, this is the example from the docs:
alb.ingress.kubernetes.io/auth-idp-oidc: '{"issuer":"https://example.com","authorizationEndpoint":"https://authorization.example.com","tokenEndpoint":"https://token.example.com","userInfoEndpoint":"https://userinfo.example.com","secretName":"my-k8s-secret"}'
This could be simplified, for example:
alb.ingress.kubernetes.io/auth-idp-oidc: '{"discoveryEndpoint":"https://authorization.example.com","secretName":"my-k8s-secret"}'
The issuer, authorizationEndpoint, tokenEndpoint, and userInfoEndpoint can all be retrieved from the JSON object served by the discovery endpoint.
Describe alternatives you've considered Not applicable? I currently use the annotation as documented, this would be a further enhancement.
References https://swagger.io/docs/specification/authentication/openid-connect-discovery/ https://openid.net/specs/openid-connect-discovery-1_0.html