Authorization Code Flow ExtAuth tutorial

[barchw]

Description
Write down a tutorial describing how to set oauth2-proxy + extAuth to expose a workload with the Authorization Code OAuth2.0 flow. Tutorial should allow automated access to secured endpoint using redirects when accessing from a browser.
It might also include additional security considerations, for example JWT claim based authorization.

Reasons

• Authorization Code flow is the most secure out of user facing OAuth2.0 flows
• APIGateway support for authentication and authorization with OIDC complaint authorization servers (SAP CIS, GitHub, etc.)

DoD:

• Provide tutorial.
• Tutorial links to previous tutorials.
• Authentication only flow (no additional JWT restrictions)
• Authentication + authorization flow (extAuth + JWT restrictions)

Attachments

• Configuration for oauth2-proxy for Authorization Code flow is described in Goat internal knowledge-hub