<p>I am running a microservice based application, with a number of basic services and a Oauth token service using IdentityServer4. I would like to carry out token introspection with the identity service from the ingress controller directly, which I believe seems to be supported (<a href="https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/</a>) - and then check if the user is permitted access based on their role at the application layer in the various services.</p>
<p>I have valuable information in my introspection response that I want passed down to my different services (role, username, email etc) from my ingress controller after the introspection is complete. The documentation around using oauth in ingress-nginx is quite lacking. I am wondering if anyone is aware of if this is supported and if so how I go about implementing it.</p>

FlanGorge
<p>I looked at the same thing recently for NGINX and Kong and came to this conclusion:</p>
<ul>
<li>Use a generic ingress / load balancer first</li>
<li>Followed by a reverse proxy / API Gateway for certain routes</li>
<li>Followed by the actual back end API</li>
</ul>
<p>You will be able to customize the second layer however you like, eg customize the nginx.conf file and add LUA plugins.</p>
<p>But the first layer tends to use its own nginx templates that are very different to the default ones. A new instance of the ingress template is spun up whenever you expose a new Kubermetes service. In effect an ingress is a different server role to a reverse proxy, and is not meant to be customised in the same way.</p>
<p>At Curity we do quite a bit of OAuth related work and I would recommend achieving your goals in the following manner:</p>
<ul>
<li>Leave the ingress alone</li>
<li>Do the introspection in a reverse proxy layer after the ingress, so that you can add your introspection (and any other) logic via LUA scripting. OpenResty and Kong Open Source are both good choices.</li>
<li>We call this the <a href="https://curity.io/resources/learn/phantom-token-pattern/" rel="nofollow noreferrer">phantom token pattern</a></li>
<li>Here is an example <a href="https://curity.io/resources/learn/integration-kong-open-source/" rel="nofollow noreferrer">LUA Implementation</a> that you can plug in - and note that result caching is an important part of the solution to ensure good performance</li>
</ul>
