<p>I'm looking to do 3 legged oauth on istio+kubernetes. I did not find a way to route unauthenticated requests to an authentication proxy service which performs the authentication and route the traffic back to the target service. I've done this with <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md" rel="nofollow noreferrer">nginx</a> kubernetes ingress controller using the following annotations -</p>

<pre>
nginx.ingress.kubernetes.io/auth-url //Auth url that requests will be forwarded to
nginx.ingress.kubernetes.io/auth-signin //Sign in page the request is routed to when the above returns 401
</pre>

<p>I did not find equivalent ones in Istio. I've checked the <a href="https://istio.io/docs/reference/config/istio.authentication.v1alpha1/" rel="nofollow noreferrer">documentation</a> and it says it supports custom auth in addition to jwt, however I did not find any such support.</p>

<p>Answering my own question.
At this point I've figured out the only way to do this is via <a href="https://istio.io/docs/reference/config/istio.networking.v1alpha3/#EnvoyFilter" rel="nofollow noreferrer">EnvoyFilter</a> on istio. This allows us to write a custom <a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/lua_filter" rel="nofollow noreferrer">lua filter</a> to to route unauthenticated requests to an oauth proxy which can perform 3-legged oauth flow.</p>

<p>The request control flow is</p>

<blockquote>
  <p>client --> ingress gateway --> istio-proxy sidecar --> envoy filter --> target</p>
</blockquote>

<p>The filter is capable of making http calls and manipulate headers, which fits this requirement.</p>

<p>Edit:
Details about it are <a href="https://medium.com/@suman_ganta/openid-authentication-with-istio-a32838adb492" rel="nofollow noreferrer">here</a>.</p>
