<p>I have a couple of web apps running on Kubernetes. To match the requests I use NGINX ingress.
Currently, all applications are validating the token from our Identity Provider (I use Keycloak on dev and planning Azure Active Directory for Production) separately.</p>
<p>Is it possible to do the validation on the Ingress level?</p>
<p>For example, the user tries to enter the page. The Ingress check for a valid token and redirect if necessary to the IP. If the user is successfully logged in, the ingress controller provides the token to the app.</p>

<p>Nginx ingress provides ability to plugin external OAUTH authentication provider via auth-url and auth-signin annotations.</p>

<pre><code>metadata:
  name: application
  annotations:
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
</code></pre>

<p>An <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/examples/auth/oauth-external-auth/README.md" rel="nofollow noreferrer">example</a> of protecting kubernetes dashboard with external auth provider.</p>

<p>Refer to docs for more details <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/" rel="nofollow noreferrer">here</a></p>
