<p>I am trying to protect front end applications with the IBM App Identity and Access Adapter for Istio. There are two steps to follow once the service is in place:</p>

<ol>
<li>Create the OidcConfig (this is the default configuration provided in their example):</li>
</ol>

<pre><code>kind: OidcConfig
metadata:
    name: hello-oidc
    namespace: my-namespace
spec:
    discoveryUrl: https://dev-b37sro-t.auth0.com/.well-known/openid-configuration
    clientId: E3LjLlomDnaPTc0b83eZa1gT0oGDNLko
    clientSecret: randomlyGeneratedClientSecret(not revealing this one)
</code></pre>

<ol start="2">
<li>Create the OidcPolicy (their example configuration again):</li>
</ol>

<pre><code>apiVersion: "security.cloud.ibm.com/v1"
kind: Policy
metadata:
  name:  oidcsamplepolicy
  namespace: my-namespace
spec:
  targets:
    -
      serviceName: helloworld
      paths:
        - exact: /hello
          method: ALL
          policies:
            - policyType: oidc
              config: hello-oidc
              redirectUri: http://helloworld.my-namespace.my-project-host/hello
</code></pre>

<p>I am using Auth0 as identity issuer, so I generate a new application (helloworld from Istio 1.4.0) and get the parameters needed in the previous configurations from there.</p>

<p>For some reason, when I apply the OidcConfig and the Policy in my Kubernetes Cluster/Namespace/Service, it doesn't seem to make any effect. I am still able to access the application from the web browser without any authentication required.</p>

<p>These are the links I followed for the implementation:</p>

<p><a href="https://www.ibm.com/cloud/blog/using-istio-to-secure-your-multicloud-kubernetes-applications-with-zero-code-change" rel="nofollow noreferrer">https://www.ibm.com/cloud/blog/using-istio-to-secure-your-multicloud-kubernetes-applications-with-zero-code-change</a></p>

<p><a href="https://github.com/ibm-cloud-security/app-identity-and-access-adapter" rel="nofollow noreferrer">https://github.com/ibm-cloud-security/app-identity-and-access-adapter</a></p>

Nora
<p>Did you set <code>global.disablePolicyChecks</code> to <code>false</code> and did you enable mixer during Istio install?</p>

<p>Mixer is disabled by default now.</p>

<p>See <a href="https://istio.io/docs/reference/config/installation-options/#mixer-options" rel="nofollow noreferrer">https://istio.io/docs/reference/config/installation-options/#mixer-options</a></p>

<p>Update: </p>

<p>I was just able to resolve this issue on my setup by doing the following:</p>

<p>First check the status of <code>disablePolicyCheck</code>:</p>

<pre><code>kubectl -n istio-system get cm istio -o jsonpath="{@.data.mesh}" | grep disablePolicyChecks
</code></pre>

<p>If this returns <code>disablePolicyChecks: true</code> run</p>

<pre><code>istioctl manifest apply --set values.global.disablePolicyChecks=false \
 --set values.mixer.policy.enabled=true \
 --set values.pilot.policy.enabled=true
</code></pre>

<p>Running the following should show the value of <code>disablePolicyChecks</code> as <code>false</code></p>

<pre><code>kubectl -n istio-system get cm istio -o jsonpath="{@.data.mesh}" | grep disablePolicyChecks
</code></pre>
