如何使用 oauth2_proxy 对 AAD (Azure Active Directory) 进行身份验证并获取访问令牌

Question

我正在尝试使用 Kubernetes 中使用的 \xc2\xa0 oauth2_proxy \xc2\xa0 对 AAD（Azure Active Directory）进行身份验证以获取访问令牌。

\n

首先，我正在努力让正确的身份验证流程发挥作用。

\n

其次，重定向到我的应用程序后，访问令牌不在oauth2_proxy中指定的请求标头中 \xc2\xa0documentation 中指定的请求标头中。

\n

Answer 1

以下是有关在 kubernetes 中使用oauth2_proxy对 Azure Active Directory (AAD) 进行身份验证的一些输入。

首先，您需要在 AAD 中创建一个应用程序并将其添加email到profileMicrosoft User.ReadGraph 的权限。

身份验证流程的默认行为是，登录 Microsoft 身份验证服务器后，您将被重定向到带有身份验证代码的网站根目录（例如https://exampler.com/）。您会期望访问令牌在那里可见 - 这是一个错误的假设。Access Token注入的url是https://exampler.com/oauth2！！！

下面是成功配置的 oauth2_proxt。

oauth2-proxy.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: oa2p
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: oauth2-proxy
  template:
    metadata:
      labels:
        k8s-app: oauth2-proxy
    spec:
      containers:
      - args:
        - --provider=oidc
        - --azure-tenant=88888888-aaaa-bbbb-cccc-121212121212
        - --email-domain=example.com
        - --http-address=0.0.0.0:4180
        - --set-authorization-header=true
        - --set-xauthrequest=true
        - --pass-access-token=true
        - --pass-authorization-header=true
        - --pass-user-headers=true
        - --pass-host-header=true
        - --skip-jwt-bearer-tokens=true
        - --oidc-issuer-url=https://login.microsoftonline.com/88888888-aaaa-bbbb-cccc-121212121212/v2.0
        env:
        - name: OAUTH2_PROXY_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy-secret
              key: OAUTH2_PROXY_CLIENT_ID
        - name: OAUTH2_PROXY_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy-secret
              key: OAUTH2_PROXY_CLIENT_SECRET
        - name: OAUTH2_PROXY_COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy-secret
              key: OAUTH2_PROXY_COOKIE_SECRET
        image: quay.io/oauth2-proxy/oauth2-proxy:v7.1.3
        imagePullPolicy: Always
        name: oauth2-proxy
        ports:
        - containerPort: 4180
          protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: oa2p
spec:
  ports:
  - name: http
    port: 4180
    protocol: TCP
    targetPort: 4180
  selector:
    k8s-app: oauth2-proxy

入口.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oa2p
  namespace: oa2p
  annotations:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/limit-rps: "1"
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
    nginx.ingress.kubernetes.io/auth-response-headers: "X-Auth-Request-Email,X-Auth-Request-Preferred-Username"
spec:
  tls:
  - hosts:
    - oa2p.example.com
    secretName: oa2p-tls
  rules:
    - host: oa2p.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: oa2p
                port:
                  number: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oa2p-proxy
  namespace: oa2p
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/limit-rps: "1"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
spec:
  tls:
  - hosts:
    - oa2p.example.com
    secretName: oa2p-tls
  rules:
    - host: oa2p.example.com
      http:
        paths:
          - path: /oauth2
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy
                port:
                  number: 4180