<p><strong>Problem statement:</strong></p>
<p>My goal is to have istio with external authorization service (ideally HTTP, if not possible than GRPC would do as well). There is a requirement to be able to control what exact status code will be returned to client on authorization service. The latter requirement is the most problematic part.</p>
<p><strong>My research</strong></p>
<ul>
<li><p>I have read <a href="https://istio.io/latest/docs/tasks/security/authorization/authz-custom/" rel="nofollow noreferrer">istio documentation on external authorizer</a></p>
</li>
<li><p>I have made a prototype  with HTTP Auth service, but whatever non 200 status
code I return from Auth Service the client always receives 403
Forbidden</p>
</li>
<li><p>In mesh <a href="https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig-ExtensionProvider-EnvoyExternalAuthorizationHttpProvider" rel="nofollow noreferrer">config specification</a> I see the only possibility to set <strong>statusOnError</strong> but it will be used only in case auth service is unreachable and it can not be dynamically changed.</p>
</li>
<li><p>Also in <a href="https://www.envoyproxy.io/docs/envoy/v1.16.2/api-v3/service/auth/v3/external_auth.proto#service-auth-v3-deniedhttpresponse" rel="nofollow noreferrer">envoy documentation for GRPC service</a> I see possibility to set custom status</p>
<pre><code>HTTP attributes for a denied response.
{
   &quot;status&quot;: &quot;{...}&quot;,
   &quot;headers&quot;: [],
   &quot;body&quot;: &quot;...&quot;
 }
</code></pre>
</li>
</ul>
<p><strong>Questions:</strong></p>
<ol>
<li>Is having custom status possible only with GRPC auth service?</li>
<li>Is istio using envoy API-V3 or API-V2?</li>
<li>Any suggestion how to cook istio with external authorizer and custin status codes?</li>
</ol>

Ivan
<p>I made the GRPC Auth service prototype and found the answer. It is counter-intuitive but GRPC external auth service  is really more flexible than HTTP one. And it really allows to set arbitrary status code</p>
