<p>I'm trying to authenticate against AAD (Azure Active Directory) with <a href="https://oauth2-proxy.github.io/" rel="nofollow noreferrer">oauth2_proxy</a> used in Kubernetes to obtain Access Token.</p>
<p>First of all, I'm struggling to get the correct authentication flow to work.</p>
<p>Second, after being redirected to my application, Access Token is not in the request headers specified in <a href="https://oauth2-proxy.github.io/oauth2-proxy/docs/features/endpoints" rel="nofollow noreferrer">oauth2_proxy</a> documentation.</p>

Lukasz Dynowski
<p>Here is some input on authentication against Azure Active Directory (AAD) using <a href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview" rel="nofollow noreferrer">oauth2_proxy</a> in kubernetes.</p>
<p>First you need to create an application in AAD and add it <code>email</code>, <code>profile</code> and <code>User.Read</code> permissions to Microsoft Graph.</p>
<p>The default behavior of authentication flow, is that after login against Microsoft authentication server, you will be redirected to root of website with authentication code (e.g. <code>https://exampler.com/</code>). You would expect the Access Token to be visible there -this is a faulty assumption. The url that Access Token is injected into is <code>https://exampler.com/oauth2</code> !!!</p>
<p>Successful configuration of oauth2_proxt that worked is below.</p>
<p><strong>oauth2-proxy.yaml</strong></p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: oa2p
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: oauth2-proxy
  template:
    metadata:
      labels:
        k8s-app: oauth2-proxy
    spec:
      containers:
      - args:
        - --provider=oidc
        - --azure-tenant=88888888-aaaa-bbbb-cccc-121212121212
        - --email-domain=example.com
        - --http-address=0.0.0.0:4180
        - --set-authorization-header=true
        - --set-xauthrequest=true
        - --pass-access-token=true
        - --pass-authorization-header=true
        - --pass-user-headers=true
        - --pass-host-header=true
        - --skip-jwt-bearer-tokens=true
        - --oidc-issuer-url=https://login.microsoftonline.com/88888888-aaaa-bbbb-cccc-121212121212/v2.0
        env:
        - name: OAUTH2_PROXY_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy-secret
              key: OAUTH2_PROXY_CLIENT_ID
        - name: OAUTH2_PROXY_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy-secret
              key: OAUTH2_PROXY_CLIENT_SECRET
        - name: OAUTH2_PROXY_COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-proxy-secret
              key: OAUTH2_PROXY_COOKIE_SECRET
        image: quay.io/oauth2-proxy/oauth2-proxy:v7.1.3
        imagePullPolicy: Always
        name: oauth2-proxy
        ports:
        - containerPort: 4180
          protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: oa2p
spec:
  ports:
  - name: http
    port: 4180
    protocol: TCP
    targetPort: 4180
  selector:
    k8s-app: oauth2-proxy
</code></pre>
<p><strong>ingress.yaml</strong></p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oa2p
  namespace: oa2p
  annotations:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/limit-rps: &quot;1&quot;
    nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;
    nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$escaped_request_uri&quot;
    nginx.ingress.kubernetes.io/auth-response-headers: &quot;X-Auth-Request-Email,X-Auth-Request-Preferred-Username&quot;
spec:
  tls:
  - hosts:
    - oa2p.example.com
    secretName: oa2p-tls
  rules:
    - host: oa2p.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: oa2p
                port:
                  number: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oa2p-proxy
  namespace: oa2p
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/limit-rps: &quot;1&quot;
    nginx.ingress.kubernetes.io/proxy-buffer-size: &quot;8k&quot;
spec:
  tls:
  - hosts:
    - oa2p.example.com
    secretName: oa2p-tls
  rules:
    - host: oa2p.example.com
      http:
        paths:
          - path: /oauth2
            pathType: Prefix
            backend:
              service:
                name: oauth2-proxy
                port:
                  number: 4180
</code></pre>
