Alibaba Cloud Service Mesh:Configure an ASM security policy to implement OIDC SSO

Procedure

In this example, an Alibaba Cloud IDaaS instance is used as the IdP to implement SSO to applications in ASM. If you use a self-managed OIDC IdP, see Integrate Keycloak with ASM to implement SSO.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > ASMSecurityPolicy.

3. On the ASMSecurityPolicy page, click Create.

4. In the Create ASMSecurityPolicy dialog box, click OIDC Single Sign-On and then click OK.

5. In the OIDC Config step of the configuration wizard, configure the parameters and click Next.

   The following table describes the parameters.

   Parameter	Description
   ASMSecurityPolicyName	The name of the ASM security policy. In this example, the name is set to test-oidc.
   Redirect address	The following options are provided: Use ingressgateway IP address and Customized Domain. In this example, Use ingressgateway IP address is selected. http and ingressgateway are selected.
   Callback Address	The redirect URL.
   OIDC Issuer URL	The URL used to identify and authenticate the OIDC issuer.
   Client ID	The client ID provided by the issuer.
   Client Secret	The client secret provided by the issuer.
   Cookie Secret	The seed string for the secure cookies, which can be Base64-encoded.
   Cookie Expire	The validity period of the cookie. The cookie expires after the period has elapsed. If you set this parameter to 0, the cookie does not expire.
   Cookie refresh interval	The interval at which the cookie is refreshed. If you set this parameter to 0, the cookie is not refreshed.
   Scopes	The types of user information that can be obtained. The specified scopes must be supported by the issuer. For more information about how to set Scopes, see Integrate Alibaba Cloud IDaaS with ASM to implement single sign-on.

   

6. In the Workload and Match Rules step of the configuration wizard, click Add Workload Group. In the New Workload Group dialog box, configure the parameters, click OK, and then click Submit.

   The following table describes how to configure the parameters in this example.

   Parameter	Description
   Workload Group Name	Set the parameter to test-policy.
   Workload List	The ingress gateway that you specified for the Redirect address parameter in the previous step is selected by default and cannot be changed. If you want to select other workloads, go back to the OIDC Config step and change the Redirect address setting. Note If you set the Redirect address parameter to Customized Domain in the OIDC Config step, perform the following steps: In the New Workload Group dialog box, click Add Workload and select Gateway Scope. In the Select workloads box, select the workload that you want to add, click the icon to add the selected workload to the selected box, and then click OK.
   Match Rule List	The following two match modes are available: Auth If Matched: Users must be authenticated before they can access the workload. Bypass Auth If Matched: Authentication is not required to access the workload. For this example, select Auth If Matched. Select Custom Matching Rules for Matching Rules. Then, click Add Match Rule and configure the following rules: The rules specify that requests to access resources in the paths that start with /static and /api require OIDC authentication. Rule 1: Turn on the Path switch and set the parameter to /static/*. Rule 2: Turn on the Path switch and set the parameter to /api/*.

   

   In the Complete step of the configuration wizard, the "ASMSecurityPolicy Creation successfully" message appears, indicating that the ASM security policy is created. You can click YAML to view the created resources, or click Complete to go back to the ASMSecurityPolicy page to view the created security policy.

7. Verify whether the OIDC SSO configuration takes effect.

   1. Open a browser and visit the following URLs:

      http://${IP address of the ingress gateway}/productpage
      http://${IP address of the ingress gateway}/api/v1/products/1
      http://${IP address of the ingress gateway}/static/jquery.min.js 

      The following results indicate that the OIDC SSO configuration takes effect:

      • The requests to access the paths that start with /productpage are allowed without authentication.

      • The requests to access the paths that start with /api and /static require authentication.

   2. Modify the OIDC SSO configuration.

      1. On the ASMSecurityPolicy page, find the OIDC SSO security policy that you want to modify and click Edit in the Actions column.

      2. In the OIDC Config step of the configuration wizard, click Next.

      3. In the Workload and Match Rules step, find the workload group that you want to modify and click Edit in the Operator column. Modify the parameter settings, click OK, and then click Submit.

         The following table describes how to modify the parameter settings in this example.

         Parameter	Description
         Match Mode	Select Bypass Auth If Matched.
         Matching Rules	Click Add Match Rule and configure the following rules: The rules specify that requests to access the paths that start with /productpage and /static are allowed without OIDC authentication. Rule 1: Turn on the Path switch and set the parameter to /productpage. Rule 2: Turn on the Path switch and set the parameter to /static/*.

   3. Open a browser in incognito mode and visit the following URLs:

      http://${IP address of the ingress gateway}/productpage
      http://${IP address of the ingress gateway}/api/v1/products/1
      http://${IP address of the ingress gateway}/static/jquery.min.js 

      The following results indicate that the new OIDC SSO configuration takes effect.

      • The requests to access the paths that start with /productpage and /static are allowed without authentication.

      • The request to access the path that starts with /api requires authentication.

References

• For more information about configuration items of OIDC applications, such as API operations, secret rotation, OIDC grant types supported by IDaaS, configurations in IDaaS, and configurations in applications, see General Config, Configure SSO, OIDC SSO Configuration, and Rules for OIDC id_token Extended Fields.

• When a user who has logged on to an application by using SSO powered by IDaaS wants to log out, the user can initiate a global logout on the application to terminate the application sessions as well as the primary IDaaS logon session. For more information, see SLO.