如何使用 oauth2_proxy 对 AAD（Azure Active Directory）进行身份验证并获取访问令牌

Question

我正在尝试使用 Kubernetes 中使用的 oauth2_proxy 对 AAD（Azure Active Directory）进行身份验证以获取访问令牌。

首先，我正在努力让正确的身份验证流程正常工作。

其次，在被重定向到我的应用程序后，访问令牌不在oauth2_proxy 文档中指定的请求标头中。

Answer 1

这里是关于使用 oauth2_proxy 和 kubernetes 对 Azure Active Directory (AAD) 进行身份验证的一些输入。

首先您需要在 AAD 中创建一个应用程序，并将其 email、profile 和 User.Read 权限添加到 Microsoft Graph。

身份验证流程的默认行为是，在登录微软身份验证服务器后，您将被重定向到带有身份验证代码的网站根目录（例如https://exampler.com/）。您会期望访问令牌在那里可见 - 这是一个错误的假设。 Access Token注入的url是https://exampler.com/oauth2!!!

成功的 oauth2_proxt 配置如下。

oauth2-proxy.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: oa2p
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: oauth2-proxy
  template:
    metadata:
      labels:
        k8s-app: oauth2-proxy
    spec:
      containers:
      - args:
        - --provider=oidc
        - --azure-tenant=88888888-aaaa-bbbb-cccc-121212121212
        - --email-domain=example.com
        - --http-address=0.0.0.0:4180
        - --set-authorization-header=true
        - --set-xauthrequest=true
        - --pass-access-token=true
        - --pass-authorization-header=true
        - --pass-user-headers=true
        - --pass-host-header=true
        - --skip-jwt-bearer-tokens=true
        - --oidc-issuer-url=https://login.microsoftonline.com/88888888-aaaa-bbbb-cccc-121212121212/v2.0
        env:
        - name: OAUTH2_PROXY_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy-secret
              key: OAUTH2_PROXY_CLIENT_ID
        - name: OAUTH2_PROXY_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy-secret
              key: OAUTH2_PROXY_CLIENT_SECRET
        - name: OAUTH2_PROXY_COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy-secret
              key: OAUTH2_PROXY_COOKIE_SECRET
        image: quay.io/oauth2-proxy/oauth2-proxy:v7.1.3
        imagePullPolicy: Always
        name: oauth2-proxy
        ports:
        - containerPort: 4180
          protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: oa2p
spec:
  ports:
  - name: http
    port: 4180
    protocol: TCP
    targetPort: 4180
  selector:
    k8s-app: oauth2-proxy

ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oa2p
  namespace: oa2p
  annotations:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/limit-rps: "1"
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
    nginx.ingress.kubernetes.io/auth-response-headers: "X-Auth-Request-Email,X-Auth-Request-Preferred-Username"
spec:
  tls:
  - hosts:
    - oa2p.example.com
    secretName: oa2p-tls
  rules:
    - host: oa2p.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: oa2p
                port:
                  number: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oa2p-proxy
  namespace: oa2p
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/limit-rps: "1"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
spec:
  tls:
  - hosts:
    - oa2p.example.com
    secretName: oa2p-tls
  rules:
    - host: oa2p.example.com
      http:
        paths:
          - path: /oauth2
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy
                port:
                  number: 4180