Alibaba Cloud Service Mesh:Configure OIDC SSO in an ASM security policy

Procedure

This topic uses an IdP from Alibaba Cloud IDaaS as an example. If you use a self-managed OIDC service, see Integrate ASM with Keycloak to enable SSO for applications in the service mesh.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > ASMSecurityPolicy.

3. On the ASMSecurityPolicy page, click Create.

4. In the Create ASMSecurityPolicy dialog box, click OIDC Single Sign-On, and then click OK.

5. In the OIDC Config wizard, configure the parameters and click Next.

   The following table describes the parameters for this example.

   Parameter	Description
   ASMSecurityPolicyName	Set the name to test-oidc.
   Redirect address	You can select Use ingressgateway IP address or Customized Domain. In this example, select Use ingressgateway IP address, and then select http and ingressgateway.
   Callback Address	The redirect URI.
   OIDC Issuer URL	The URL that identifies and validates the OIDC provider.
   Client ID	The client ID provided by the IdP.
   Client Secret	The client secret provided by the IdP.
   Cookie Secret	A seed for secure cookies. Base64 encoding is supported.
   Cookie Expire	The cookie's validity duration. A value of 0 indicates that the cookie never expires.
   Cookie refresh interval	The interval at which the cookie is refreshed. A value of 0 disables refresh.
   Scopes	Specify the scopes to retrieve. The specified scopes must be supported by the issuer. For more information about scopes, see Integrate ASM with Alibaba Cloud IDaaS to enable SSO for applications in the service mesh.

   In this example, set Cookie expiration to 3600s, set Cookie refresh interval to 600s, and select openid and phone for Scopes.

6. In the Workload and Match Rules wizard, click Add Workload Group. In the New Workload Group dialog box, configure the parameters, click OK, and then click Submit.

   The following table describes the parameters for this example.

   Parameter	Description
   Workload Group Name	Set the name to test-policy.
   Workload List	By default, the gateway configured for the Redirect address in the previous step is selected and cannot be modified. To select a different workload, return to the OIDC Config wizard and modify the Redirect address information. Note If you selected Customized Domain for Redirect address in the OIDC Config wizard, perform the following steps: In the New Workload Group dialog box, click Add Workload, and select Gateway Scope. In the Select workloads section, select the target workload, click the icon to move it to the selected area, and then click OK.
   Match Rule List	The Match Mode has two options: Auth If Matched: Requires authentication for requests that match the specified rules. Bypass Auth If Matched: Requests that match the rules can be accessed without authentication. In this example, set Match Mode to Auth If Matched and Match Mode to Custom Matching Rules. Then, click Add Match Rule to add rules that require OIDC authentication for paths starting with /static and /api. Rule 1: Enable Path and set the value to /static/*. Rule 2: Enable Path and set the value to /api/*.

   After the policy is created, the Complete step shows that the ASM security policy was created successfully. You can click View YAML to view the created resources, or click Complete to return to the ASMSecurityPolicy page and view the new security policy.

7. Verify the OIDC SSO configuration.

   1. In a web browser, access the following URLs in order.

      http://${GATEWAY_ADDRESS}/productpage
      http://${GATEWAY_ADDRESS}/api/v1/products/1
      http://${GATEWAY_ADDRESS}/static/jquery.min.js

      The following results confirm that the OIDC SSO configuration is working:

      • Requests to paths that start with /productpage can be accessed without authentication. When you access the productpage of the BookInfo sample application, a summary of the book The Comedy of Errors is displayed.

      • Requests to paths that start with /api and /static require authentication. When accessing these paths, you are redirected to the Alibaba Cloud IDaaS logon page. You must enter your credentials in the Account, phone, or email and Password text boxes and then click Log On to authenticate.

   2. Modify the OIDC SSO configuration.

      1. On the ASMSecurityPolicy page, find the target OIDC security policy and click edit in the Operator column.

      2. In the OIDC Config wizard, click Next.

      3. In the Workload and Match Rules wizard, find the target workload group and click edit in the Operator column. Modify the configurations, click OK, and then click Submit.

         The following table describes the parameters for this example.

         Parameter	Description
         Match Mode	Select Bypass Auth If Matched.
         Matching Rules	Click Add Match Rule to configure the following rules. This configuration allows requests to paths starting with /productpage and /static to bypass OIDC authentication. Rule 1: Enable Path and set the value to /productpage. Rule 2: Enable Path and set the value to /static/*.

   3. To verify the changes, open a new incognito window in your browser and access the following URLs.

      http://${GATEWAY_ADDRESS}/productpage
      http://${GATEWAY_ADDRESS}/api/v1/products/1
      http://${GATEWAY_ADDRESS}/static/jquery.min.js

      The following results confirm the modified configuration is working.

      • Requests to paths that start with /productpage and /static can be accessed without authentication.

      • Requests to paths that start with /api require authentication.

Related documents

• For more information about OIDC application settings, such as API access, key rotation, IDaaS support for different OIDC modes, and configurations on the IDaaS and application sides, see Basic configurations, General instructions for single sign-on, OIDC SSO configurations, and OIDC id_token extension value specifications.

• After logging on to an application with IDaaS SSO, you can initiate a global logout from the application to end the main IDaaS session. This process is called Single Log-Out (SLO). For more information, see Single Log-Out (SLO).