<p>following the previous question on Stack Overflow at this <a href="https://stackoverflow.com/questions/64590283/external-oauth-authentication-with-nginx-in-kubernetes">link</a>, after successful authentication (at Github.com) i get <em>404 page not found</em> on my browser.</p>
<p>The Ingress configuration below (used by nginx-ingress controller):</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  namespace: nginx-ingress
  annotations:
     nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;
     nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$request_uri&quot;
spec:
  ingressClassName: nginx
  rules:
  - host: site.example.com
    http:
      paths:
      - path: /v1                                               
        backend:
          serviceName: web-service
          servicePort: 8080
      - path: /
        backend:
          serviceName: oauth2-proxy
          servicePort: 4180
  tls:
  - hosts:
    - site.example.com
    secretName: example-tls
</code></pre>
<hr />
<pre><code>$ kubectl get ing -n nginx-ingress
  NAME      CLASS   HOSTS              ADDRESS   PORTS     
  ingress   nginx   site.example.com             80, 443   
</code></pre>
<ul>
<li>browser sends GET to <a href="https://site.example.com/" rel="nofollow noreferrer">https://site.example.com/</a>,</li>
<li>browser is redirected to Github login page,</li>
<li>After successful login, browser is redirected to <a href="https://site.example.com/" rel="nofollow noreferrer">https://site.example.com/</a>,</li>
<li>browser sends GET to <a href="https://site.example.com/" rel="nofollow noreferrer">https://site.example.com/</a> with cookie _oauth2_proxy filled</li>
<li>the response is <em>404 page not found</em></li>
</ul>
<p>The node.js web application i'm trying to access to via oauth2 has been built with two paths (/ and /v1). Web application is behind Service <em>web-service</em>.</p>
<p>OAuth2 Github application configuration:</p>
<pre><code>Homepage URL
https://site.example.com/

Authorization callback URL
https://site.example.com/oauth2/callback
</code></pre>
<p>OAuth2 deployment and service:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: nginx-ingress
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: oauth2-proxy
  template:
    metadata:
      labels:
        k8s-app: oauth2-proxy
    spec:
      containers:
      - args:
        - --provider=github
        - --email-domain=*
        - --upstream=file:///dev/null
        - --http-address=0.0.0.0:4180
        # Register a new application
        # https://github.com/settings/applications/new
        env:
        - name: OAUTH2_PROXY_CLIENT_ID
          value: 32066******52
        - name: OAUTH2_PROXY_CLIENT_SECRET
          value: ff2b0a***************9bd
        - name: OAUTH2_PROXY_COOKIE_SECRET
          value: deSF_t******03-HQ==
        image: quay.io/oauth2-proxy/oauth2-proxy:latest
        imagePullPolicy: Always
        name: oauth2-proxy
        ports:
        - containerPort: 4180
          protocol: TCP
</code></pre>
<hr />
<pre><code>apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: nginx-ingress
spec:
  ports:
  - name: http
    port: 4180
    protocol: TCP
    targetPort: 4180
  selector:
    k8s-app: oauth2-proxy
</code></pre>
<p>Logs from oauth2-proxy container:</p>
<pre><code>[2020/11/10 19:47:27] [logger.go:508] Error loading cookied session: cookie &quot;_oauth2_proxy&quot; not present, removing session
10.44.0.2:51854 - - [2020/11/10 19:47:27] site.example.com GET - &quot;/&quot; HTTP/1.1 &quot;Mozilla/5.0
[2020/11/10 19:47:27] [logger.go:508] Error loading cookied session: cookie &quot;_oauth2_proxy&quot; not present, removing session
10.44.0.2:51858 - - [2020/11/10 19:47:27] site.example.com GET - &quot;/favicon.ico&quot; HTTP/1.1 &quot;Mozilla/5.0 ....
10.44.0.2:51864 - - [2020/11/10 19:47:28] site.example.com GET - &quot;/oauth2/start?rd=%2F&quot; HTTP/1.1 &quot;Mozilla/5.0 ....
10.44.0.2:52004 - marco.***81@gmail.com [2020/11/10 19:48:33] [AuthSuccess] Authenticated via OAuth2: Session{email:marco.***81@gmail.com user:mafi81 PreferredUsername: token:true created:2020-11-10 19:48:32.494549621 +0000 UTC m=+137.822819581}
10.44.0.2:52004 - - [2020/11/10 19:48:32] site.example.com GET - &quot;/oauth2/callback?code=da9c3af9d8f35728d2d1&amp;state=e3280edf2430c507cd74f3d4655500c1%3A%2F&quot; HTTP/1.1 &quot;Mozilla/5.0 ...
10.44.0.2:52012 - marco.****81@gmail.com [2020/11/10 19:48:33] site.example.com GET - &quot;/&quot; HTTP/1.1 &quot;Mozilla/5.0 ....
10.44.0.2:52014 - marco.****81@gmail.com [2020/11/10 19:48:33] site.example.com GET - &quot;/favicon.ico&quot; HTTP/1.1 &quot;Mozilla/5.0 .... Chrome/86.0.4240.193 Safari/537.36&quot; 404 19 0.000
</code></pre>
<p>Testing environment:</p>
<ul>
<li>VirtualBox with kubeadm v1.19.3</li>
<li>NGINX Ingress controller Version=1.9.0.</li>
</ul>
<p>I'm not still confident with paths configuration under Ingress resource.
Any suggestion on how to go ahead with troubleshoot would be great.</p>
<p><strong>UPDATE</strong>:</p>
<p>Following the Matt's answer, giving the right way to test the authentication, here is the new environment:</p>
<pre><code>NGINX Ingress controller
  Release:       v0.41.2
  Build:         d8a93551e6e5798fc4af3eb910cef62ecddc8938
  Repository:    https://github.com/kubernetes/ingress-nginx
  nginx version: nginx/1.19.4

OAuth2 Pod
  image: quay.io/oauth2-proxy/oauth2-proxy
</code></pre>
<p>Ingress manifest:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  namespace: web
  annotations:
     nginx.ingress.kubernetes.io/auth-response-headers: Authorization
     nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.web.svc.cluster.local:4180/oauth2/auth
     nginx.ingress.kubernetes.io/auth-signin: https://site.example.com/oauth2/start?rd=$request_uri
     nginx.ingress.kubernetes.io/configuration-snippet: |
       auth_request_set $name_upstream_1 $upstream_cookie__oauth2_proxy_1;

       access_by_lua_block {
         if ngx.var.name_upstream_1 ~= &quot;&quot; then
           ngx.header[&quot;Set-Cookie&quot;] = &quot;_oauth2_proxy_1=&quot; ..  ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match(&quot;(; .*)&quot;)
         end
       }

spec:
  ingressClassName: nginx-oauth
  rules:
  - host: site.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: web-service
          servicePort: 8080
</code></pre>
<hr />
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: oauth2-proxy
  namespace: web

spec:
  ingressClassName: nginx-oauth

  rules:
  - host: site.example.com
    http:
      paths:
      - backend:
          serviceName: oauth2-proxy
          servicePort: 4180
        path: /oauth2

  tls:
  - hosts:
    - site.example.com
    secretName: tls
</code></pre>
<p>Note that i had to change one annotation to get it working:</p>
<ul>
<li>auth-url: http://oauth2- proxy.web.svc.cluster.local:4180/oauth2/auth  (this solves resolution failure)</li>
</ul>

Marco_81
<p>According to <a href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive" rel="nofollow noreferrer">oauth-proxy documentation</a> you MUST use <a href="https://kubernetes.github.io/ingress-nginx/deploy/" rel="nofollow noreferrer">kubernetes/ingress-nginx</a>.</p>
<p>Here you can read more about <a href="https://github.com/nginxinc/kubernetes-ingress/blob/master/docs/nginx-ingress-controllers.md" rel="nofollow noreferrer">differences between nginxinc/kubernetes-ingress and kubernetes/ingress-nginx Ingress Controllers</a>.</p>
<p>In oath2-proxy docs (mentioned earlier) you can find the following:</p>
<blockquote>
<p>When you use ingress-nginx in Kubernetes, you MUST use kubernetes/ingress-nginx (which includes the Lua module) and the following configuration snippet for your Ingress. Variables set with auth_request_set are not set-able in plain nginx config when the location is processed via proxy_pass and then may only be processed by Lua. Note that nginxinc/kubernetes-ingress does not include the Lua module.</p>
<pre><code>nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
  auth_request_set $name_upstream_1 $upstream_cookie_name_1;

  access_by_lua_block {
    if ngx.var.name_upstream_1 ~= &quot;&quot; then
      ngx.header[&quot;Set-Cookie&quot;] = &quot;name_1=&quot; .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match(&quot;(; .*)&quot;)
    end
  }
</code></pre>
</blockquote>
<p>So if we can trust documentation, your authentication won't work because you are using wrong nginx controller and you are missing annotations.</p>
