diff --git a/docs/user-guides/README.md b/docs/user-guides/README.md new file mode 100644 index 00000000..c59d7fff --- /dev/null +++ b/docs/user-guides/README.md @@ -0,0 +1,33 @@ +# AuthConfig Consumers +Authorino's `AuthConfig` is a custom resource that defines authentication and authorization policies. Many tools and frameworks act +as consumers of `AuthConfig` by automatically generating and managing these resources on behalf of users. Since these consumers +follow the same specification, the general concepts and steps outlined in the user guides are applicable. +However, some details—such as resource names and specific API fields—may differ based on the consuming framework. + +This section provides guidance for users working with tools that act as consumers of `AuthConfig`, allowing them to leverage the +same principles outlined in the user guides, regardless of the framework they are using. + +## Kuadrant +[Kuadrant](https://kuadrant.io/) provides API security and access control capabilities through its own custom resource: `AuthPolicy`. +`AuthPolicy` is designed specifically for use with the Kubernetes [Gateway API](https://gateway-api.sigs.k8s.io/), allowing users +to define authentication and authorization rules directly in their network policy configurations. + +Rather than defining `AuthConfig` resources directly, users can define an `AuthPolicy`, and Kuadrant will automatically +generate the corresponding `AuthConfig` for Authorino to consume. + +### Key Details About `AuthPolicy` as an `AuthConfig` Consumer + +- **Same Specification**: The spec schema of `AuthPolicy` is effectively the same as `AuthConfig`. +- **Automatic Hostname Handling**: Unlike `AuthConfig`, `AuthPolicy` does not explicitly define `spec.host`. Instead, hostnames are +inferred from the Kubernetes network object in `spec.targetRef` and the route selectors in the policy. +- **Authorino Integration**: Kuadrant translates `AuthPolicy` into an `AuthConfig`, which is then processed by Authorino to enforce +authentication and authorization. + +### Authorino Features Not Available via Kuadrant +Some Authorino-specific features may not be available when using Authorino through Kuadrant: + +- [Sharding](./sharding.md) +- [Host Override via Context Extension](./host-override.md) + +For more details on enforcing authentication and authorization with Kuadrant, see the +[Kuadrant Auth documentation](https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth/). diff --git a/docs/user-guides/anonymous-access.md b/docs/user-guides/anonymous-access.md index a0667e6d..dae63e2a 100644 --- a/docs/user-guides/anonymous-access.md +++ b/docs/user-guides/anonymous-access.md @@ -29,23 +29,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) @@ -108,18 +91,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -112,18 +95,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.

-

At step ❻, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -126,18 +109,6 @@ Create an Authorino `AuthConfig` custom resource declaring the auth rules to be An annotation `auth-data/username` will be read from the Kubernetes API Key secret and passed as dynamic metadata `{ "ext_auth_data": { "username": «annotations.auth-data/username» } }`. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.

-

At step ❻, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -232,18 +215,6 @@ EOF Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- Store the shared token for Authorino to authenticate with the SpiceDB instance in a Service: ```sh diff --git a/docs/user-guides/caching.md b/docs/user-guides/caching.md index a7f74900..61ebaed0 100644 --- a/docs/user-guides/caching.md +++ b/docs/user-guides/caching.md @@ -47,23 +47,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) @@ -134,18 +117,6 @@ In both cases, the path of the HTTP request is used as cache key. I.e., whenever The cached values will be visible in the response returned by the Talker API in `x-authz-data` header injected by Authorino. This way, we can tell when an existing value in the cache was used and when a new one was generated and stored. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -114,18 +97,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❹.

-

At steps ❹ and ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -159,18 +142,6 @@ EOF Create the config: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl -n edge apply -f -<&1 >/dev/null & ### Create the `AuthConfig` - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl -n internal apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.

-

At step ❻, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -327,18 +310,6 @@ kubectl apply -f https://raw.githubusercontent.com/Kuadrant/authorino-examples/m Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -120,18 +103,6 @@ In this example, we will implement a geofence policy for the API, using OPA and The implementation relies on the [`X-Forwarded-For`](https://datatracker.ietf.org/doc/html/rfc7239) HTTP header to read the client's IP address. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant, you can skip step ❸. You may already have Authorino installed and running as well. In this case, skip also step ❺. If you even have your workload cluster configured, with sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, go straight to step ❼.

-

At step ❼, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - - ## ❶ Create the namespace ```sh @@ -108,18 +91,6 @@ Authorino does not know about the `talker-api.127.0.0.1.nip.io` host, hence the Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl -n hello-world apply -f https://raw.githubusercontent.com/kuadrant/authorino-examples/main/hello-world/authconfig.yaml # authconfig.authorino.kuadrant.io/talker-api-protection created diff --git a/docs/user-guides/host-override.md b/docs/user-guides/host-override.md index e285f311..2d92c02a 100644 --- a/docs/user-guides/host-override.md +++ b/docs/user-guides/host-override.md @@ -4,17 +4,6 @@ By default, Authorino uses the host information of the HTTP request ([`Attribute Overriding the host attribute of the HTTP request can be useful to support use cases such as of **path prefix-based lookup** and **wildcard subdomains lookup**. - - - - - - -
- ⚠️ Important: - This feature may not be available to users of Authorino via Kuadrant. -
-
In this guide: diff --git a/docs/user-guides/http-basic-authentication.md b/docs/user-guides/http-basic-authentication.md index 1d312cf4..00c244ce 100644 --- a/docs/user-guides/http-basic-authentication.md +++ b/docs/user-guides/http-basic-authentication.md @@ -36,23 +36,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) @@ -117,18 +100,6 @@ Create an Authorino `AuthConfig` custom resource declaring the auth rules to be The config uses API Key secrets to store base64-encoded `username:password` HTTP "Basic" authentication credentials. The config also specifies an Access Control List (ACL) by which only user `john` is authorized to consume the `/bye` endpoint of the API. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -118,18 +101,6 @@ The following defines a JSON object to be injected as an added HTTP header into 2. a dynamic value `request-time`, from Envoy-supplied contextual data present in the Authorization JSON; and 3. a greeting message `geeting-message` that interpolates a dynamic value read from an annotation of the Kubernetes `Secret` resource that represents the API key used to authenticate into a static string. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -128,18 +111,6 @@ The `email_verified` claim is a property of the identity added to the JWT by the The implementation relies on the [`X-Forwarded-For`](https://datatracker.ietf.org/doc/html/rfc7239) HTTP header to read the client's IP address. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -<&1 >/dev/null & The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) @@ -136,18 +119,6 @@ In cases of asynchronous user-managed permission control, the first request to t Whenever an RPT with proper permissions is obtained by Authorino, the RPT is supplied back to the API consumer, so it can be used in subsequent requests thus skipping new negotiations of UMA tickets. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -116,18 +99,6 @@ Create an Authorino `AuthConfig` custom resource declaring the auth rules to be The `AuthConfig` below sets all Kubernetes service accounts as trusted users of the API, and relies on the Kubernetes RBAC to enforce authorization using Kubernetes SubjectAccessReview API for non-resource endpoints: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -115,18 +98,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.

-

At step ❻, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -336,18 +319,6 @@ kubectl port-forward deployment/envoy 8443:8443 2>&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -155,18 +138,6 @@ EOF Create the Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -121,18 +104,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -130,18 +113,6 @@ In this example, the Keycloak realm defines a few users and 2 realm roles: 'memb | /resources/{id} | DELETE | admin | | /admin[/*] | * | admin | - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- Apply the AuthConfig: ```sh diff --git a/docs/user-guides/oidc-user-info.md b/docs/user-guides/oidc-user-info.md index 475fcf52..1ab88070 100644 --- a/docs/user-guides/oidc-user-info.md +++ b/docs/user-guides/oidc-user-info.md @@ -44,23 +44,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) @@ -123,18 +106,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -121,18 +104,6 @@ The implementation relies on the [`X-Forwarded-For`](https://datatracker.ietf.or [^5]: You can also set [`use_remote_address: true`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-use-remote-address) in the Envoy route configuration, so the proxy will append its IP address instead of run in transparent mode. This setting will also ensure real remote address of the client connection passed in the [`x-envoy-external-address`](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#config-http-conn-man-headers-x-envoy-external-address) HTTP header, which can be used to simplify the read-only policy in remote environment. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -121,18 +104,6 @@ In this example, `member` users can authenticate supplying the API key in any of `admin` API keys are only accepted in the (default) HTTP header `Authorization: Bearer `. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -125,18 +108,6 @@ This example of resource-level authorization leverages part of Keycloak's User-M The Keycloak server also provides the identities. The `sub` claim of the Keycloak-issued ID tokens must match the owner of the requested resource, identified by the URI of the request. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- Create a required secret that will be used by Authorino to initiate the authentication with the UMA registry. ```sh diff --git a/docs/user-guides/sharding.md b/docs/user-guides/sharding.md index 7b30e1ae..a130feae 100644 --- a/docs/user-guides/sharding.md +++ b/docs/user-guides/sharding.md @@ -7,17 +7,6 @@ By default, Authorino will watch events related to all `AuthConfig` custom resou - multiple environments (e.g. staging, production) inside of a same cluster/namespace; - providing managed instances of Authorino that all watch CRs cluster-wide, yet dedicated to organizations allowed to create and operate their own `AuthConfig`s across multiple namespaces. - - - - - - -
- ⚠️ Important: - This feature may not be available to users of Authorino via Kuadrant. -
-
Authorino capabilities featured in this guide: diff --git a/docs/user-guides/token-normalization.md b/docs/user-guides/token-normalization.md index b79ea9ef..ad7bf267 100644 --- a/docs/user-guides/token-normalization.md +++ b/docs/user-guides/token-normalization.md @@ -49,23 +49,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) @@ -134,18 +117,6 @@ The config trusts access tokens issued by a Keycloak realm as well as API keys l Without normalizing identity claims from these two different sources, the policy would have to handle the differences of data formats with additional ifs-and-elses. Instead, the config here uses the `identity.extendedProperties` option to ensure a custom `roles` (Array) claim is always present in the identity object. In the case of Keycloak ID tokens, the value is extracted from the `realm_access.roles` claim; for API key-resolved objects, the custom claim is set to the static value `["admin"]`. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - Using Kuadrant - - - - - -

If you are a user of Kuadrant you may already have Authorino installed and running. In this case, skip straight to step ❸.

-

At step ❺, alternatively to creating an AuthConfig custom resource, you may create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

- - - - -
## ❶ Install the Authorino Operator (cluster admin required) @@ -259,18 +242,6 @@ kubectl create namespace myapp ### With a valid `AuthConfig` - - - - - - -
- Kuadrant users – - For this and other example AuthConfigs below, if you create a Kuadrant AuthPolicy instead, the output of the commands shall differ. The requested AuthPolicy may be initially accepted, but its state will turn ready or not ready depending on whether the corresponding AuthConfig requested by Kuadrant is accepted or rejected, according to the validating webhook rules. Check the state of the resources to confirm. - For more, see Kuadrant auth. -
- ```sh kubectl -n myapp apply -f -<