ai-gpu-kubeflow/oauth2_proxy.cfg at main · drai-inn/ai-gpu-kubeflow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
provider = "oidc"
oidc_issuer_url = "https://kubeflow.test.drai.auckland.ac.nz/dex"
scope = "profile email groups openid"
email_domains = [ "*" ]
insecure_oidc_allow_unverified_email = "true"

# serve a static HTTP 200 upstream on for authentication success
# we are using oauth2-proxy as an ExtAuthz to "check" each request, not pass it on
upstreams = [ "static://200" ]

# skip authentication for these paths
# TODO: not sure the oauth2/callback is needed, didn't seem to help but was mentioned in a ticket with a similar issue
skip_auth_routes = [
  "^/dex/",
  "^/oauth2/callback",
]

# requests to paths matching these regex patterns will receive a 401 Unauthorized response
# when not authenticated, instead of being redirected to the login page with a 302,
# this prevents background requests being redirected to the login page,
# and the accumulation of CSRF cookies
api_routes = [
  # Generic
  # NOTE: included because most background requests contain these paths
  "/api/",
  "/apis/",

  # Kubeflow Pipelines
  # NOTE: included because KFP UI makes MANY background requests to these paths but because they are
  #       not `application/json` requests, oauth2-proxy will redirect them to the login page
  "^/ml_metadata",
]

# OIDC Discovery has to be skipped and login url has to be provided directly
# in order to enable relative auth redirect. Using OIDC Discovery would set
# the redirect location to http://dex.auth.svc.cluster.local:5556 in the example
# installation. This address is usually not available through the Web Browser.
# If you have a setup where dex has it's url as other than the in-cluster
# service, this is optional.
skip_oidc_discovery = true
login_url = "/dex/auth"
redeem_url = "https://kubeflow.test.drai.auckland.ac.nz/dex/token"
oidc_jwks_url = "https://kubeflow.test.drai.auckland.ac.nz/dex/keys"
#redeem_url = "http://dex.auth.svc.cluster.local:5556/dex/token"
#oidc_jwks_url = "http://dex.auth.svc.cluster.local:5556/dex/keys"

# if `false`, a sign-in page is displayed before starting the login flow
# prevents background requests starting their own login flow on token expiry,
# which can lead to many CSRF cookies, potentially exceeding the cookie limit
skip_provider_button = false

# style the sign-in page
provider_display_name = "DRAI Keycloak"
custom_sign_in_logo = "/custom-theme/kubeflow-logo.svg"
banner = "-"
footer = "-"

# oauth2-proxy sends "force" by default, which causes dex to always prompt for login
# https://github.com/dexidp/dex/pull/3086
prompt = "none"

# set Authorization Bearer response header. This is needed in order to
# forward the Authorization Bearer token to Istio and enable authorization
# based on JWT.
set_authorization_header = true

# set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and
# X-Auth-Request-Preferred-Username. This is optional for Kubeflow but you
# may have other services that use standard auth headers.
set_xauthrequest = true

cookie_name = "oauth2_proxy_kubeflow"

# Dex default cookie expiration is 24h.
# If set to 168h (default oauth2-proxy), Istio will not be able to use the JWT after 24h,
# but oauth2-proxy will still consider the cookie valid.
# It's possible to configure the JWT Refresh Token to enable longer login session.
cookie_expire = "24h"
cookie_refresh = 0

code_challenge_method = "S256"

redirect_url = "/oauth2/callback"
relative_redirect_url = true