Implement OIDC single sign-on on an ASM gateway - Alibaba Cloud Service Mesh

OpenID Connect (OIDC) is an identity authentication and authorization protocol built on OAuth 2.0, primarily used for single sign-on (SSO). By configuring OIDC single sign-on on an ASM gateway, you can use an identity provider like Alibaba Cloud IDaaS or any other OIDC-compliant service to enable users to log in once and access multiple applications without modifying the applications themselves. This approach enhances security and simplifies application development and management.

Prerequisites

An application is deployed in the cluster that is added to the ASM instance.
Sidecar injection is enabled for the namespace. For more information, see Configure sidecar injection policies.
An ASM ingress gateway has been created and its address has been obtained. For more information, see Create an ingress gateway and Obtain the address of an ingress gateway.
An identity provider (IdP) is configured. For more information, see Integrate ASM with Alibaba Cloud IDaaS to enable single sign-on for applications in the mesh in Step 1 and Step 2.

After configuring the IdP, obtain the following information for use in Step 5.
```
redirect uri: http://${gateway address}/oauth2/callback
issuer: https://eiam-api-cn-hangzhou.aliyuncs.com/v2/idaas_tbn25osdlmz6gtqfq3j2pz****/app_ml5tzapsl7zmfo53wb3nwk****/oidc
client id: ********
client secret: *********
```

Procedure

This topic uses Alibaba Cloud IDaaS as an example of an IdP. If you use a self-managed OIDC service, see Integrate Keycloak with ASM to implement single sign-on for applications in the mesh.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
On the Ingress Gateway page, click the name of the target gateway.
In the left-side navigation pane of the gateway overview page, choose Gateway Security > OIDC Single Sign-On.

In the OIDC Config wizard, turn on the Enable gateway OIDC Single Sign-On switch, configure the parameters, and then click Next.

Parameter	Description
Redirect address	In this example, Use ingressgateway IP address and the http protocol are selected.
Callback Address	The redirect URL.
OIDC Issuer URL	The URL that identifies and validates the OpenID Connect provider.
Client ID	The client ID provided by the issuer.
Client Secret	The client secret provided by the issuer.
Cookie Secret	A seed used to generate secure cookies (Base64 encoding is supported).
Cookie Expire	The lifetime of the cookie. A value of 0 means the cookie session never expires.
Cookie refresh interval	The interval at which the cookie is refreshed. Set this parameter to 0 to disable refresh.
Scopes	The scopes to request. The specified scopes must be supported by the issuer.

Turn on the Enable gateway OIDC Single Sign-On switch and configure the parameters as described in the table. Set Cookie Expire to 3600 s, Cookie refresh interval to 60 s, and select openid for Scopes.

In the Matching Rules wizard, configure the parameters and click Submit.

Parameter

Description

Match Mode

In this example, Auth If Matched is selected. The following list describes the options.

Auth If Matched: The selected requests require authentication.
Bypass Auth If Matched: The selected requests can bypass authentication.

Add Match Rule

Turn on the Path switch and set the value to /productpage. This configuration requires requests to the /productpage path to be authenticated through OIDC.

After the configuration is created, the Complete wizard displays a success message and the generated Service Mesh security resources. You can click View YAML to view the resource details.

In a browser, access http://${ASM gateway address}/productpage to verify that the OIDC single sign-on configuration is effective.

Replace ${ASM gateway address} with the address of your ingress gateway. You are redirected to the Alibaba Cloud IDaaS login page. This redirection confirms that the OIDC single sign-on configuration is effective. On the login page, enter your Username, mobile number, or email and Password, and click Log In. After logging in, you can access the page.

FAQ

Application behavior with gateway OIDC

After you enable OIDC on the gateway, your application does not need to handle any logic related to IdP authentication or authorization. A header with the key Authorization is added to the request when it passes through the gateway. This header contains a JSON Web Token (JWT) from the IdP. The JWT payload includes the required user information and has already been validated by the gateway, so your application does not need to validate it again. Your application can parse this header from the request to obtain user information.

Meaning of the OIDC session cookie

No. The cookie records the session state on the gateway and is not relevant to the application. Your application only needs to parse the JWT from the request header.

Obtaining extended IdP information

This process is specific to your identity provider. For Alibaba Cloud IDaaS, see Manage account fields.

Logging out of a session

Logging out involves two steps:

Log out of the IdP session by using the method that your IdP provides. Typically, an IdP provides a logout URI that you can call to terminate the session.
Clear the session cookie set by the gateway on the client. You can do this by calling the /oauth2/sign_out path, which causes the gateway to automatically clear the corresponding cookie.

Starting from ASM v1.18.147, you can configure the IdP logout endpoint directly on the gateway. You can specify the endpoint on the OIDC configuration page and set the rule to bypass authentication for the /oauth2/sign_out path. After the configuration is complete, accessing /oauth2/sign_out in a browser clears the cookie and redirects you to the configured logout endpoint. For more information about how to log out from Alibaba Cloud IDaaS, see Single Logout (SLO).

Alibaba Cloud Service Mesh:Configure OIDC SSO on an ASM gateway