Alibaba Cloud Service Mesh:Integrate Alibaba Cloud IDaaS with ASM for single sign-on

Concepts

Step 1: Create an IDaaS instance and a test user

1. Log on to the EIAM console and create an Alibaba Cloud IDaaS instance.

   Note

   An Alibaba Cloud IDaaS instance acts as a self-contained account system. Creating an instance is equivalent to creating an independent identity management system.

2. On the EIAM page, click the name of the Alibaba Cloud IDaaS instance.

3. In the left-side navigation pane, choose Account > Accounts and Orgs.

4. On the Account page, click the Account tab, and then click Create User.

5. In the Create User panel, enter the user information and click OK.

Step 2: Add and configure an OIDC application

Applications in your Alibaba Cloud IDaaS instance act as interfaces. The IDaaS instance can expose these interfaces in various ways to enable SSO. This guide uses an OIDC application to demonstrate the process.

1. In the left-side navigation pane of the EIAM console, click Application Management.

2. On the Application Management page, click Add Application.

3. On the Add Application page, click the Standard Protocols tab. In the OIDC card, click Add Application.

4. In the Add Application-OIDC dialog box, enter an Application Name and click Add.

5. On the OIDC Application details page, select Sign-In > SSO.

6. On the SSO configuration tab, set the Redirect URIs. Click Show Advanced Settings, select the user information to obtain in the scopes section, and then click Save.

   In the left-side navigation pane, click Applications. Select your target application, click the Sign-in tab, and go to the SSO subtab. Available scopes include openid, email, phone, and profile.

   Note

   In this example, the Redirect URI is set to http://{IP_address_of_the_ingress_gateway}/oauth2/callback. Replace {IP_address_of_the_ingress_gateway} with the actual IP address of your ingress gateway.

7. On the OIDC Application details page, select Sign-In > Authorize, and click Authorize.

8. In the Authorize dialog box, grant permissions to the user that you created in Step 1, and then click Confirm.

Step 3: Deploy and expose the test application

This guide uses the httpbin application for testing. This application helps inspect request details, which simplifies verifying the information obtained from the IdP after a successful login.

1. Use the following YAML to deploy the httpbin application to the default namespace of your ACK cluster.

   YAML content

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: httpbin
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: httpbin
     labels:
       app: httpbin
       service: httpbin
   spec:
     ports:
     - name: http
       port: 8000
       targetPort: 80
     selector:
       app: httpbin
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: httpbin
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: httpbin
         version: v1
     template:
       metadata:
         labels:
           app: httpbin
           version: v1
       spec:
         serviceAccountName: httpbin
         containers:
         - image: docker.io/kennethreitz/httpbin
           imagePullPolicy: IfNotPresent
           name: httpbin
           ports:
           - containerPort: 80

2. Use the following YAML to configure a Gateway resource for your ASM instance. For more information, see Manage Istio gateways.

   apiVersion: networking.istio.io/v1beta1
   kind: Gateway
   metadata:
     name: ingressgateway
     namespace: istio-system
   spec:
     selector:
       app: istio-ingressgateway
     servers:
       - hosts:
           - '*'
         port:
           name: http
           number: 80
           protocol: HTTP

3. Use the following YAML to apply a virtual service to your ASM instance. For more information, see Manage virtual services.

   This virtual service defines a default route to the httpbin application.

   apiVersion: networking.istio.io/v1beta1
   kind: VirtualService
   metadata:
     name: ingressgateway-vs
     namespace: istio-system
   spec:
     gateways:
       - ingressgateway
     hosts:
       - '*'
     http:
       - name: default
         route:
           - destination:
               host: httpbin.default.svc.cluster.local
               port:
                 number: 8000

4. After you configure the Gateway and virtual service, you can access the httpbin service by running the curl -I http://{IP_address_of_the_ingress_gateway}:80 command.

   Sample output:

   curl -I http://{IP_address_of_the_ingress_gateway}:80
   HTTP/1.1 200 OK
   server: istio-envoy
   date: Fri, 19 Aug 2022 07:39:58 GMT
   content-type: text/html; charset=utf-8
   content-length: 9593
   access-control-allow-origin: *
   access-control-allow-credentials: true
   x-envoy-upstream-service-time: 3

Step 4: Enable custom authorization and configure OIDC SSO

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > Custom Authorization Service. On the page that appears, click Define Custom Authorization Service.

3. On the Define External Authorization Service page, click the OIDC Authz and Authn Service tab, configure the parameters, and then click Create.

   Note

   Use the OIDC application information that you obtained in Step 2. You can use the IP address of the ingress gateway as the redirect URI for logins. For more information about cookie secrets, see Generating a Cookie Secret.

4. Use the KubeConfig of the data plane cluster to run the following command to obtain the domain name of the OIDC external authorization service.

   kubectl get svc -n istio-system|grep oauth2proxy|awk -F' ' '{print $1}'

5. Use the following YAML to create a virtual service that receives authentication requests from the ingress gateway.

   apiVersion: networking.istio.io/v1beta1
   kind: VirtualService
   metadata:
     name: oauth2-vs
     namespace: istio-system
   spec:
     gateways:
       - ingressgateway
     hosts:
       - '*'
     http:
       - match:
           - uri:
               prefix: /oauth2
         name: oauth2
         route:
           - destination:
               host: # The domain name of the external authorization service obtained in the previous step.
               port:
                 number: 4180

   Important

   To prevent conflicts, do not create other virtual services that match the /oauth2 path prefix.

Step 5: Create an authorization policy

1. On the details page of the ASM instance, choose Mesh Security Center > AuthorizationPolicy in the left-side navigation pane. On the page that appears, click Create from YAML.

2. On the Create page, select a Namespaces and a Scenario Template. Enter the following YAML, and then click Create.

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: oidc
     namespace: istio-system
   spec:
     action: CUSTOM
     provider:
       name: httpextauth-oidc  # The name of the custom authorization service created in the previous step.
     rules:
       - {}
     selector:
       matchLabels:
         istio: ingressgateway

   Note

   This authorization policy applies to all requests sent to the ingress gateway.

Step 6: Verify the result

1. In a web browser, go to http://{IP_address_of_the_ingress_gateway}:80.

   The OAuth2 Proxy login page appears, containing a Sign in with OpenID Connect button. This indicates that OAuth2 Proxy deployed and integrated successfully with OpenID Connect, and that SSO is active.

2. Click Sign in with OpenID Connect.

   Expected result: The Alibaba Cloud IDaaS login page appears. The page contains input fields for Account name, mobile number, or email and Password, and a Log On button. This confirms that the OIDC SSO configuration is working.

3. On the Alibaba Cloud IDaaS login page, enter the credentials for the test user that you created in Step 1 and click Log On.

   Expected result: After you log in successfully, the httpbin.org Swagger API documentation page appears for version 0.9.2. The page displays the service description, "A simple HTTP Request & Response Service," and lists API groups such as HTTP Methods, Auth, Status codes, and Request inspection. This confirms that the Alibaba Cloud IDaaS SSO configuration is valid.

4. Click Request inspection, then choose /headers > Try it out > Execute.

   Expected result: After you execute the request, the server returns a 200 OK status code. The response body includes an Authorization field that contains a Bearer JWT, which indicates that JWT authorization is working.

   {
     "headers": {
       "Accept": "application/json",
       "Accept-Encoding": "gzip, deflate",
       "Accept-Language": "zh-CN,zh;q=0.9",
       "Authorization": "Bearer eyJraWQiOiJLRVkxM3d0ekhLSmdEbkFmd1lQR0RqemM5RFUzTkwSNXd1S0wiLC3hbGciOiJSUzI1NiJ9.eyJzdWIiOiJlc2VyVyX29xemw3Z3FQb2lrb2xtNG9xY29mMndlcGhtIiwinRpi-joiand0X2FhYWFkYXZ2aG12Y2JpdDRnbDVsNGNudDR5d2FwZDI3cnFkd2Z0eDI3cnFkZTByc2FtcnFkd2Z0ZDI3cnFkZTByc2FtIixxx.xxxb51hcGktY24taGFuZ3pobxxx.xxxMuY29xxx.3yiL2xxx.Fx3R1bjI1b3NkbG16Nmd0cWZxM2oycHpwZWZx-L2FwcF9tbDV0emFwc2w3em1mbzUzd2xxx.xxxaGFzaCI6IkUxcm9oRnlpR2FZYmJnTS.xxxtudHZpIiwiYXRf-IrODYgMTg2IDkxNzEgMjQ5MS.xxx.xxx.BanFbeM28p\nYp-aiEymtvy-QC-6VjohuSSi.xxx\nE9c3RTMntC66D7fxTGME2x.xxx.Et\nrwPRUTM-2AF74y2NVFtpNdkxbLenyz1duwTpeGANmgLGxxxJrZvKyNxBjAV6TZjGrUVVNICbU1_sg",
       "...": "..."
     }
   }

5. Copy the JWT from the Bearer token in the previous step and parse it with a JWT debugger.

   For more information, see JWT.io.

   Expected result: The parsed JWT shows that the alg in the HEADER is RS256. The PAYLOAD contains standard OIDC ID Token claims, such as sub, jti, iss (which is the OIDC endpoint of your EIAM instance), iat, nbf, exp, aud, at_hash, c_hash, email, email_verified, phone_number, phone_number_verified, name, preferred_username, and updated_at. This confirms that the JWT contains the user information from Alibaba Cloud IDaaS and that ASM has successfully validated it.