在Istio Ingress Gateway上实现SSO
kubectl edit svc istio-ingressgateway -n istio-system
更改端口为 80
kubectl edit svc keycloak -nkeycloak
更改为8080
添加域
添加客户端
Keycloak上的Access Type共有三类：
◼ confidential：适用于需要执行浏览器登录的应用，客户端会通过client secret来获取access token , 多用于服务端渲染的web系统场景中；
◼ public：适用于需要执行浏览器登录的应用，多运用于使用vue和react实现的前端项目；
◼ bearer-only：适用于不需要执行浏览器登录的应用，只允许携带bearer token访问，多运用于RESTful API的使用场景；
添加*
多出凭据
root@master01:/opt/istio-in-practise/Security/05-JWT-and-Keycloak# cat 01-deploy-oauth2.yaml apiVersion: v1 kind: Namespace metadata: name: oauth2-proxy labels: istio-injection: enabled --- apiVersion: v1 kind: Secret metadata: name: oauth2-proxy namespace: oauth2-proxy stringData: # change this to your Keycloak Realm Client Id OAUTH2_PROXY_CLIENT_ID: ingress-gateway # change this to your Keycloak Client Secret OAUTH2_PROXY_CLIENT_SECRET: QdbO5qR5OPNcHdedX6GFZSxlOmqKDKkm # Generate by command: openssl rand -base64 32 | tr -- '+/' '-_' OAUTH2_PROXY_COOKIE_SECRET: vEBMxbw7NXfaUIJR4klhdvB678GUPxWTd7tR9hq2m8w= --- apiVersion: v1 kind: Service metadata: name: oauth2-proxy namespace: oauth2-proxy spec: selector: app: oauth2-proxy ports: - name: http port: 4180 --- apiVersion: apps/v1 kind: Deployment metadata: name: oauth2-proxy namespace: oauth2-proxy spec: selector: matchLabels: app: oauth2-proxy template: metadata: labels: app: oauth2-proxy spec: containers: - name: oauth2-proxy image: quay.io/oauth2-proxy/oauth2-proxy:v7.2.1 args: - --provider=oidc - --oidc-issuer-url=http://keycloak.keycloak.svc.cluster.local:8080/auth/realms/istio - --profile-url=http://keycloak.keycloak.svc.cluster.local:8080/auth/realms/istio/protocol/openid-connect/userinfo - --validate-url=http://keycloak.keycloak.svc.cluster.local:8080/auth/realms/istio/protocol/openid-connect/userinfo - --set-authorization-header=true - --http-address=0.0.0.0:4180 - --pass-host-header=true - --reverse-proxy=true - --auth-logging=true - --cookie-httponly=true - --cookie-refresh=4m - --cookie-secure=false - --email-domain="*" - --pass-access-token=true - --pass-authorization-header=true - --request-logging=true - --set-xauthrequest=true - --silence-ping-logging=true - --skip-provider-button=true - --skip-auth-strip-headers=false - --ssl-insecure-skip-verify=true - --standard-logging=true - --upstream="static://200" - --whitelist-domain=".magedu.com,.cluster.local" env: - name: OAUTH2_PROXY_CLIENT_ID valueFrom: secretKeyRef: name: oauth2-proxy key: OAUTH2_PROXY_CLIENT_ID - name: OAUTH2_PROXY_CLIENT_SECRET valueFrom: secretKeyRef: name: oauth2-proxy key: OAUTH2_PROXY_CLIENT_SECRET - name: OAUTH2_PROXY_COOKIE_SECRET valueFrom: secretKeyRef: name: oauth2-proxy key: OAUTH2_PROXY_COOKIE_SECRET resources: requests: cpu: 10m memory: 100Mi ports: - containerPort: 4180 protocol: TCP readinessProbe: periodSeconds: 3 httpGet: path: /ping port: 4180
root@master01:/opt/istio-in-practise/Security/05-JWT-and-Keycloak# kubectl get deploy -noauth2-proxy NAME READY UP-TO-DATE AVAILABLE AGE oauth2-proxy 1/1 1 1 71s
root@master01:/opt/istio-in-practise/Security/05-JWT-and-Keycloak# kubectl get svc -noauth2-proxy NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE oauth2-proxy ClusterIP 10.100.183.155 <none> 4180/TCP 3m7s
root@master01:/opt/istio-in-practise/Security/05-JWT-and-Keycloak# cat 02-istio-operator-update.yaml apiVersion: install.istio.io/v1alpha1 kind: IstioOperator spec: profile: demo meshConfig: extensionProviders: - name: oauth2-proxy #和下面配置同名 envoyExtAuthzHttp: service: oauth2-proxy.oauth2-proxy.svc.cluster.local port: 4180 timeout: 1.5s includeHeadersInCheck: ["authorization", "cookie"] headersToUpstreamOnAllow: ["x-forwarded-access-token", "authorization", "path", "x-auth-request-user", "x-auth-request-email", "x-auth-request-access-token"] headersToDownstreamOnDeny: ["content-type", "set-cookie"]
root@master01:/opt/istio-in-practise/Security/05-JWT-and-Keycloak# istioctl install -f 02-istio-operator-update.yaml
root@master01:/opt/istio-in-practise/Security/05-JWT-and-Keycloak# cat 03-ext-auth-ingress-gateway.yaml apiVersion: security.istio.io/v1beta1 kind: RequestAuthentication metadata: name: istio-ingressgateway namespace: istio-system spec: selector: matchLabels: app: istio-ingressgateway jwtRules: - issuer: http://keycloak.keycloak.svc.cluster.local:8080/auth/realms/istio jwksUri: http://keycloak.keycloak.svc.cluster.local:8080/auth/realms/istio/protocol/openid-connect/certs #audiences: ["ingress-gateway","istio-ingress-gateway"] # Forward JWT to Envoy Sidecar #forwardOriginalToken: true # - issuer: http://keycloak.magedu.com:8080/auth/realms/istio # jwksUri: http://keycloak.magedu.com:8080/auth/realms/istio/protocol/openid-connect/certs --- apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: ext-authz-oauth2-proxy namespace: istio-system spec: selector: matchLabels: app: istio-ingressgateway action: CUSTOM provider: # Extension provider configured when we installed Istio name: oauth2-proxy #和上面配置同名 rules: - to: - operation: hosts: ["kiali.magedu.com"] notPaths: ["/auth/*"]
自动跳转为
新建用户
新建密码
############
Set Password
root@client /# curl -s --data "username=kiali&password=magedu.com&grant_type=password&client_id=ingress-gateway&client_secret=jMK4wOOQfGlsDuuhUJ3p5KXsGoQfjQUl" http://keycloak.keycloak.svc.cluster.local:8080/auth/realms/istio/protocol/openid-connect/token {"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJzX1N6TGw0bEJkOXdEOTl3ZklWeHVCSFI3Y0hWMUt5bk1QUXRTaWI1UEdZIn0.eyJleHAiOjE2NDQ5Mzg1MjQsImlhdCI6MTY0NDkzODIyNCwianRpIjoiMzg3YTllOTctOTA4MC00MDY5LWI2MjctNTIwOWIwN2Q0MDZiIiwiaXNzIjoiaHR0cDovL2tleWNsb2FrLmtleWNsb2FrLnN2Yy5jbHVzdGVyLmxvY2FsOjgwODAvYXV0aC9yZWFsbXMvaXN0aW8iLCJhdWQiOlsiaW5ncmVzcy1nYXRld2F5IiwiYWNjb3VudCJdLCJzdWIiOiI4ODQ5Y2NlNi1kN2Y1LTRhODItYjQ0ZS1kZWU3NGNkNDg4ZWYiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJpbmdyZXNzLWdhdGV3YXkiLCJzZXNzaW9uX3N0YXRlIjoiMzlkMjdmYzgtMmVlOS00Yzk1LTg5NDUtNjE5MDBmYjEzNWZhIiwiYWNyIjoiMSIsInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIiwiZGVmYXVsdC1yb2xlcy1pc3RpbyJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoiZW1haWwgcHJvZmlsZSIsInNpZCI6IjM5ZDI3ZmM4LTJlZTktNGM5NS04OTQ1LTYxOTAwZmIxMzVmYSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJuYW1lIjoia2lhbGkgTWFnZUVkdSIsInByZWZlcnJlZF91c2VybmFtZSI6ImtpYWxpIiwiZ2l2ZW5fbmFtZSI6ImtpYWxpIiwiZmFtaWx5X25hbWUiOiJNYWdlRWR1IiwiZW1haWwiOiI4MTQ3MTI0NzVAcXEuY29tIn0.QibbO0bqKZ19M4xMqCt0zgmh_qumB0-5gDFphqJ7oOHP1izO3r10gS_HreUCDff3J3U6ZCLIB-v-pFO3eiBFUlIdN1Eo_vmdd12X6W85cPiciFBpZgWYjsebIwGLr0wd8WrJpqzO7st3XqMSrOxjBXnP3fu9LrHfUOKn9JdJbCH57Q0UjydBOmRRtvffZVRcchBoQ7B8Pw9j7vObkWuU2p9BQxE-Csegd9KP3Uv2m_oKVJsP6YeWT_DzFT0-6AR1Rq-A3If5yI-aNzmZHCvAT_-imEP1XWv9blSxItQMe2Z-Av04P4vhMS0gHNaQ1mHs0fRcQn9R1wmlNMizOaiZ0Q","expires_in":300,"refresh_expires_in":1800,"refresh_token":"eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmNzc4YTQxYi01NDU3LTQzZDUtYmIwZC0wZmMzOGY1MzdlMzIifQ.eyJleHAiOjE2NDQ5NDAwMjQsImlhdCI6MTY0NDkzODIyNCwianRpIjoiNDUwOTlmNTQtYzI1ZC00MzE0LTkyNDgtMDBlNzRjZmExMThhIiwiaXNzIjoiaHR0cDovL2tleWNsb2FrLmtleWNsb2FrLnN2Yy5jbHVzdGVyLmxvY2FsOjgwODAvYXV0aC9yZWFsbXMvaXN0aW8iLCJhdWQiOiJodHRwOi8va2V5Y2xvYWsua2V5Y2xvYWsuc3ZjLmNsdXN0ZXIubG9jYWw6ODA4MC9hdXRoL3JlYWxtcy9pc3RpbyIsInN1YiI6Ijg4NDljY2U2LWQ3ZjUtNGE4Mi1iNDRlLWRlZTc0Y2Q0ODhlZiIsInR5cCI6IlJlZnJlc2giLCJhenAiOiJpbmdyZXNzLWdhdGV3YXkiLCJzZXNzaW9uX3N0YXRlIjoiMzlkMjdmYzgtMmVlOS00Yzk1LTg5NDUtNjE5MDBmYjEzNWZhIiwic2NvcGUiOiJlbWFpbCBwcm9maWxlIiwic2lkIjoiMzlkMjdmYzgtMmVlOS00Yzk1LTg5NDUtNjE5MDBmYjEzNWZhIn0.T7XRrK-cg0ViLKxkRCFRZolvfqXCoXJCC59QALBIJ6o","token_type":"Bearer","not-before-policy":0,"session_state":"39d27fc8-2ee9-4c95-8945-61900fb135fa","scope":"email profile"}
