<p><strong>Goal</strong></p>
<p>I want to use keycloak as oauth/oidc provider for my minikube cluster.</p>
<p><strong>Problem</strong></p>
<p>I am confused with the available documentation.</p>
<p>According to this <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication" rel="noreferrer">documentation</a> ngnix-ingress can handle external authentication with annotations</p>
<ul>
<li>nginx.ingress.kubernetes.io/auth-method</li>
<li>nginx.ingress.kubernetes.io/auth-signin</li>
</ul>
<p>But it is not clear from the doc what kind of authentication is used here. Is it OAUTH/BASIC/ SAML ???</p>
<p>I have not found any variables to provide oauth CLIENTID for ingress for example.</p>
<p><strong>Additional findings</strong></p>
<p>I also have found this project <a href="https://github.com/oauth2-proxy/oauth2-proxy" rel="noreferrer">https://github.com/oauth2-proxy/oauth2-proxy</a>
which seems to be what I need and provides following design</p>
<p>user -&gt; ngnix-ingress -&gt; oauth2-proxy -&gt; keycloak</p>
<p><strong>Questions:</strong></p>
<ol>
<li>Do I have to use oauth2-proxy to achieve keycloak oauth?</li>
<li>Am I right that ngnix-ingress does not have functionality for direct connection to keycloak?</li>
<li>Is there any clear documentation about what exactly nginx.ingress.kubernetes.io/auth-method and nginx.ingress.kubernetes.io/auth-signin are doing?</li>
<li>Is there any right way/documentation for building <strong>user -&gt; ngnix-ingress -&gt; oauth2-proxy -&gt; keycloak</strong> integration?</li>
</ol>

<p>The nginx ingress controller documents provide an <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/" rel="noreferrer">example</a> of <code>auth-url</code> and <code>auth-signin</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>...  
metadata:  
  name:  application  
  annotations:  
    nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;  
    nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$escaped_request_uri&quot;  
  ...
</code></pre>
<p>Please be aware of that this functionality works only with two ingress objects:</p>
<blockquote>
<p>This functionality is enabled by deploying multiple Ingress objects
for a single host. One Ingress object has no special annotations and
handles authentication.</p>
<p>Other Ingress objects can then be annotated in such a way that require
the user to authenticate against the first Ingress's endpoint, and can
redirect  <code>401</code>s to the same endpoint.</p>
</blockquote>
<p>This <a href="https://docs.syseleven.de/metakube/de/tutorials/setup-ingress-auth-to-use-keycloak-oauth" rel="noreferrer">document</a> shows a good example how those two ingress objects are used in order to have this functionality.</p>
<p>So the first ingress here points to <code>/oauth2</code> path which is then defined in separate ingress object since this one does not have auth configured for itself.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;
    nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$escaped_request_uri&quot;
  name: external-auth-oauth2
  namespace: MYNAMESPACE
spec:
  rules:
  - host: foo.bar.com
</code></pre>
<p>The second ingress as mentioned earlier defines the <code>/oauth2</code> path under the same domain and points to your ouauth2 proxy deployment which also answers one of your question that you</p>
<p>The second ingress objects defines the  <em>/oauth2</em>  path under the same domain and points to the oauth2-proxy deployment:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: oauth2-proxy
  namespace: MYNAMESPACE
  annotations:
    cert-manager.io/cluster-issuer: designate-clusterissuer-prod
    kubernetes.io/ingress.class: nginx
spec:
  rules:
  - host: foo.bar.com
    http:
      paths:
      - backend:
          serviceName: oauth2-proxy
          servicePort: 80
        path: /oauth2
</code></pre>
<blockquote>
<p>Is there any clear documentation about what exactly nginx.ingress.kubernetes.io/auth-method and
nginx.ingress.kubernetes.io/auth-signin are doing?</p>
</blockquote>
<p>The <code>auth-method</code> annotation specifies the HTTP method to use while
<code>auth-signin</code> specifies the location of the error page. Please have a look at valid nginx controllers methods <a href="https://github.com/kubernetes/ingress-nginx/blob/14345ebcfe82521437580c5d63a1e5b4cadedd73/internal/ingress/annotations/authreq/main.go#L96" rel="noreferrer">here</a>.</p>
<p><strong>Couple of points to know/consider:</strong></p>
<ol>
<li><p>What is the main goal:</p>
<p>-- <a href="https://medium.com/@mrbobbytables/kubernetes-day-2-operations-authn-authz-with-oidc-and-a-little-help-from-keycloak-de4ea1bdbbe" rel="noreferrer">authentication to kubernetes</a> cluster using OIDC and keycloak?</p>
<p>-- using dex: <a href="https://dexidp.io/docs/kubernetes/" rel="noreferrer">https://dexidp.io/docs/kubernetes/</a></p>
<p>-- minikube <a href="https://minikube.sigs.k8s.io/docs/tutorials/openid_connect_auth/" rel="noreferrer">openid authentication</a>:</p>
</li>
<li><p><a href="https://www.keycloak.org/docs/latest/securing_apps/" rel="noreferrer">Securing</a> Applications and Services using keycloak</p>
<p>Keycloak supports both OpenID Connect (an extension to OAuth 2.0) and SAML 2.0. When securing clients and services the first thing you need to decide is which of the two you are going to use. If you want you can also choose to secure some with OpenID Connect and others with SAML.</p>
<p>To secure clients and services you are also going to need an adapter or library for the protocol you’ve selected. Keycloak comes with its own adapters for selected platforms, but it is also possible to use generic <a href="https://www.keycloak.org/docs/latest/securing_apps/#openid-connect-2" rel="noreferrer">OpenID</a> Connect Relying Party and SAML Service Provider libraries.</p>
<p>In most cases Keycloak recommends using OIDC. For example, OIDC is also more suited for HTML5/JavaScript applications because it is easier to implement on the client side than SAML.</p>
<p>Please also have look at the <a href="https://www.openshift.com/blog/adding-authentication-to-your-kubernetes-web-applications-with-keycloak" rel="noreferrer">adding authentication</a> to your Kubernetes Web applications with Keycloak document.</p>
</li>
</ol>
