<p>Hi guys im having a problem with setting up and external auth system on my local node minikube and istio . i have already set up two deployments on is helloworld and the other one is auther . what i want is to authorize all of the requests to /hello route by sending the request to /auther route which will connect to auther service and if specific headers are set (like jwt token in authorization) then return 200 status or 401 status if nothing is set .
i tried to use this config file which is using an envoy ext auth filter but nothing is working . although all the requests pass to /hello are getting 403 but its not sending any request to my auther service .
here is my config for envoy ext-auth filter :</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ext-auth
  # namespace: istio-system
  namespace: default
spec:
  workloadSelector:
    labels:
      app: helloworld
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          portNumber: 5000
          filterChain:
            filter:
              name: &quot;envoy.http_connection_manager&quot;
              subFilter:
                name: &quot;envoy.router&quot;
      patch:
        operation: INSERT_BEFORE
        value:
          #name: envoy.filters.http.ext_authz
          name: envoy.ext_authz
          typed_config:
            &quot;@type&quot;: type.googleapis.com/envoy.config.filter.http.ext_authz.v2.ExtAuthz
            http_service:
              server_uri:
                uri: http://auther.default.svc.cluster.local:3000
                cluster: outbound|3000||auther.default.svc.cluster.local
                timeout: 3s
              # authorizationRequest:
              #   allowedHeaders:
              #     patterns:
              #     - exact: &quot;cookie&quot;
</code></pre>

faramarz
<p>Your configuration applies to every sidecar, including the <code>auther</code>'s sidecar. So the forwarded traffic from the <code>helloworld</code> is denied as well.</p>
<p>Just set the filter to apply only on your gateway. Set the <code>context</code> to <code>GATEWAY</code> and set <code>allowedHeaders</code> for request and response, so authorized requests can pass.</p>
<p>Here an example configuration:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: authn-filter
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: &quot;envoy.http_connection_manager&quot;
              subFilter:
                name: &quot;envoy.router&quot;
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.ext_authz
          typed_config:
            &quot;@type&quot;: &quot;type.googleapis.com/envoy.config.filter.http.ext_authz.v2.ExtAuthz&quot;
            http_service:
              server_uri:
                uri: http://auther.default.svc.cluster.local
                cluster: outbound|4180||auther.default.svc.cluster.local
                timeout: 1.5s
              authorizationRequest:
                allowedHeaders:
                  patterns:
                    - exact: &quot;cookie&quot;
                    - exact: &quot;authorization&quot;
                    - ....
              authorizationResponse:
                allowedClientHeaders:
                  patterns:
                    - exact: &quot;set-cookie&quot;
                    - exact: &quot;authorization&quot;
                    - ....
                allowedUpstreamHeaders:
                  patterns:&quot;
                    - exact: &quot;set-cookie&quot;
                    - exact: &quot;authorization&quot;
                    - ....
</code></pre>
<p>Let me know if you need further assistence!</p>
