Using jwt_authn filter in an environment behind a proxy.

[ScottGuymer]

I started here but could not find any solution applicable.

I want to be able to use jwt_authn filter in a situation where my envoy instance needs to fetch jwks values from a location that is outside the current network and only accessible via a proxy.

I can't seem to find any place within the filter itself to configure the use of any proxy. As I understand it the requests original from envoy itself and use the upstream cluster configuration to access the jwks endpoint. And I cant configure it in a route like I might do for any request originating outside of envoy and being routed by envoy.

I can seem to make sense of any way to configure a proxy from within the cluster configuration itself.

I think i am stuck and cant really make sense of if this is possible (and im just missing the configuration) or if its just not possible.

Snippets of config

Filter Config

- name: envoy.filters.http.jwt_authn
  typed_config:
    '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
    providers:
      oidc_provider:
        issuer: my.issuer
        audiences:
          - my-audience
        forward: 'true'
        remote_jwks:
          http_uri:
            uri: https://my.provider/jwks
            cluster: identity_provider
            timeout: 5s
          cache_duration:
            seconds: 300

cluster config

- name: identity_provider
  connect_timeout: 2s
  type: STRICT_DNS
  load_assignment:
    cluster_name: identity_provider
    endpoints:
      - lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: my.provider
                  port_value: 443

[qiwzhang]

jwt_authn filter is using Envoy http_async_client to call remote_jwks. Http_async_client is not using route config inside http_connection_manager. It is using the cluster directly. I don't see there is a way to config a http_proxy in cluster. So there is not way jwt_authn can fetch remote jwks via a http proxy.

[ScottGuymer]

Do you think it would be possible to configure the jwt filter to a cluster that loops back to envoy on another port that has a correct HTTP filter configuration to use a HTTP proxy?

jwt_authn

- name: envoy.filters.http.jwt_authn
  typed_config:
    '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
    providers:
      oidc_provider:
        issuer: my.issuer
        audiences:
          - my-audience
        forward: 'true'
        remote_jwks:
          http_uri:
            uri: https://my.provider/jwks
            cluster: localhost_jwks
            timeout: 5s
          cache_duration:
            seconds: 300

jwks cluster

clusters:
  - name: localhost_jwks
    connect_timeout: 1s
    type: logical_dns
    dns_lookup_family: V4_ONLY
    lb_policy: round_robin
    load_assignment:
      cluster_name: gateway
      endpoints:
        - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: localhost_jwks
                    port_value: 8181

router for proxy

static_resources:
  listeners:
    - address:
        socket_address:
          address: 0.0.0.0
          port_value: 8181
      filter_chains:
        - filters:
          - some config for proxy

[ScottGuymer]

I can see there is some mention of CONNECT in upstream_config for cluster config. But no idea how to configure it
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto.html

[qiwzhang]

The loop back approach should work. With a complete listener, Envoy should be able to route the remote_jwks request to a http proxy. -Wayne

…

On Mon, Jul 13, 2020 at 9:09 AM Scott Guymer ***@***.***> wrote: I can see there is some mention of CONNECT in upstream_config for cluster config. But no idea how to configure it https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto.html — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#12028 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACZ6TBZABTSFFLQE7HQPOFTR3MWSPANCNFSM4OWX7L6Q> .

[ScottGuymer]

Can you point me towards how I might configure a listener to use a HTTP proxy?

I have something like this. But cant figure out where i would put the proxy server IP and port

 - address:
    socket_address:
      address: 0.0.0.0
      port_value: 8888
  filter_chains:
    - filters:
        - name: envoy.http_connection_manager
          typed_config:
            '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
            codec_type: auto
            stat_prefix: ingress_http
            route_config:
              name: proxy_jwks
              virtual_hosts:
                - name: proxy
                  domains:
                    - '*'
                  routes:
                    - match:
                        prefix: /
                      route:
                        cluster: identity_provider
            http_filters:
              - name: envoy.router
                typed_config: {}
            upgrade_configs:
              - upgrade_type: CONNECT
                connect_config:
                  {}

[qiwzhang]

I believe it can be done, but I don't know how. Could you create a separate issue on how to config Envoy to use http proxy. The title in this issue is misleading.

…

On Tue, Jul 14, 2020 at 12:00 AM Scott Guymer ***@***.***> wrote: Can you point me towards how I might configure a listener to use a HTTP proxy? I have something like this. But cant figure out where i would put the proxy server IP and port - address: socket_address: address: 0.0.0.0 port_value: 8888 filter_chains: - filters: - name: envoy.http_connection_manager typed_config: ***@***.***': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager codec_type: auto stat_prefix: ingress_http route_config: name: proxy_jwks virtual_hosts: - name: proxy domains: - '*' routes: - match: prefix: / route: cluster: identity_provider http_filters: - name: envoy.router typed_config: {} upgrade_configs: - upgrade_type: CONNECT connect_config: {} — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#12028 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACZ6TB4SI62I43YASWS4QDDR3P7ANANCNFSM4OWX7L6Q> .

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically closed because it has not had activity in the last 37 days. If this issue is still valid, please ping a maintainer and ask them to label it as "help wanted". Thank you for your contributions.

[zhiyong-gayang]

Hi @ScottGuymer, did you figure out how to config the http proxy? I'm looking for the solution for the same issue.

[ScottGuymer]

Im afraid not. I cant actually recall what we did in the end.