<p>Having trouble setting up external authentication for a web application behind nginx ingress. When i try to access the URL <a href="https://site.example.com" rel="nofollow noreferrer">https://site.example.com</a> from external i get no redirection to Github login, and direct access to web application happens.</p>
<p>Running Pods for my environment:</p>
<pre><code>NAME                              READY   STATUS   
nginx-ingress-68df4dfc4f-wpj5t    1/1     Running  
oauth2-proxy-6675d4b57c-cspw8     1/1     Running   
web-deployment-7d4bd85b46-blxb8   1/1     Running   
web-deployment-7d4bd85b46-nqjgl   1/1     Running   
</code></pre>
<p>Active Services:</p>
<pre><code>NAME            TYPE           CLUSTER-IP       EXTERNAL-IP    PORT(S)                      
nginx-ingress   LoadBalancer   10.96.156.157    192.168.1.82   80:31613/TCP,443:32437/TCP   
oauth2-proxy    ClusterIP      10.100.101.251   &lt;none&gt;         4180/TCP                     
web-service     ClusterIP      10.108.237.188   &lt;none&gt;         8080/TCP                     
</code></pre>
<p>Two Ingress resources:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  namespace: nginx-ingress
  annotations:
     kubernetes.io/ingress.class: nginx
     nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;
     nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$request_uri&quot;
  labels:
    app: webapp
spec:
  rules:
  - host: site.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: web-service
          servicePort: 8080
  tls:
  - hosts:
    - site.example.com
    secretName: example-tls
</code></pre>
<hr />
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: oauth2-proxy
  namespace: nginx-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
  labels:
    app: oauth2-proxy
spec:
  rules:
  - host: site.example.com
    http:
      paths:
      - backend:
          serviceName: oauth2-proxy
          servicePort: 4180
        path: /oauth2

  tls:
  - hosts:
    - site.example.com
    secretName: example-tls
</code></pre>
<p>Ingress output:</p>
<pre><code>NAME           CLASS    HOSTS              ADDRESS        PORTS     
ingress        &lt;none&gt;   site.example.com   192.168.1.82   80, 443   
oauth2-proxy   &lt;none&gt;   site.example.com                  80, 443   
</code></pre>
<p>I see these errors in Ingress oauth2-proxy events:</p>
<pre><code>Events:
  Type     Reason    Age   From                      Message
  ----     ------    ----  ----                      -------
  Warning  Rejected  54m   nginx-ingress-controller  All hosts are taken by other resources
</code></pre>
<p>Oauth2-proxy built from deployment <a href="https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/auth/oauth-external-auth/oauth2-proxy.yaml" rel="nofollow noreferrer">here</a> with Client ID, Client Secret and SECRET according to the OAuth app created in my Github account.</p>
<p>No logs found in oauth2-proxy logs, i suppose because it's not invoked in the process.</p>
<p><strong>UPDATE</strong>:</p>
<p>This question was incomplete, i forgot to mention the NGINX image empolyed (NGINX 1.9.0 from <a href="https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/" rel="nofollow noreferrer">installation guide</a>).</p>
<p>Changing the image with the below:</p>
<pre><code>NGINX Ingress controller
Release: v0.41.2
Build: d8a93551e6e5798fc4af3eb910cef62ecddc8938
Repository: https://github.com/kubernetes/ingress-nginx
nginx version: nginx/1.19.4
</code></pre>
<p>the error disappears. In brief both Ingress configuration, the one from my question and the other from the answer are working.</p>

Marco_81
<p>In your configuration, you are using 2 <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress</a>. As you described you <code>oauth2-proxy Ingress</code>, in <code>Event</code> section you can find information:</p>
<blockquote>
<p>All hosts are taken by other resources</p>
</blockquote>
<p>Issue you have encounter here is called <a href="https://docs.nginx.com/nginx-ingress-controller/configuration/handling-host-collisions/" rel="nofollow noreferrer">Host Collisions</a>. It occured as in your both <code>Ingress</code> you have used:</p>
<pre><code>spec:
  rules:
  - host: site.example.com
</code></pre>
<p>In that kind of situation, <code>Ingress</code> is using default algorith called <a href="https://docs.nginx.com/nginx-ingress-controller/configuration/handling-host-collisions/#choosing-the-winner" rel="nofollow noreferrer">Choosing the Winner</a>.</p>
<blockquote>
<p>If multiple resources contend for the same host, the <code>Ingress Controller</code> will pick the winner based on the <code>creationTimestamp</code> of the resources: the oldest resource will win.</p>
</blockquote>
<p>As fast solution for your issue is to create one <code>Ingress</code> with 2 paths.</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  namespace: nginx-ingress
  annotations:
     kubernetes.io/ingress.class: nginx
     nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;
     nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$request_uri&quot;
spec:
  rules:
  - host: site.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: web-service
          servicePort: 8080
      - path: /oauth2
        backend:
          serviceName: oauth2-proxy
          servicePort: 4180      
  tls:
  - hosts:
    - site.example.com
    secretName: example-tls
</code></pre>
<p>Another way to resolve this issue is to use <a href="https://docs.nginx.com/nginx-ingress-controller/configuration/handling-host-collisions/#merging-configuration-for-the-same-host" rel="nofollow noreferrer">Merging Configuration for the Same Host</a>, however it shouldn't be applied in this scenario.</p>
<p>As last thing, you can follow official Nginx Ingress tutorial - <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/" rel="nofollow noreferrer">External OAUTH Authentication</a></p>
