Auth0 integration with Istio

Kubernetes & Istio are the best entry points for our services. However, we have not yet explored authentication from Istio yet. In this blog, I would demonstrate Authentication & authorisation with Auth0. Most of the time I am following documented steps from Auth0 team only.

Create Cluster

Below command would create latest version of EKS cluster.

eksctl create cluster -f ekscluster.yml

# cat ekscluster.yml
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
  name: auth
  region: eu-north-1
  version: "1.22"nodeGroups:
  - name: ng-1
    instanceType: m5.large
    desiredCapacity: 10
    volumeSize: 80
    ssh:
      allow: true # will use ~/.ssh/id_rsa.pub as the default ssh key
  - name: ng-2
    instanceType: m5.large
    desiredCapacity: 2
    volumeSize: 100
    ssh:
      publicKeyPath: ~/.ssh/id_rsa.pub

Setup Istio

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.14.0 TARGET_ARCH=x86_64 sh -
export PATH="$PATH:/Users/nirav/git/localscript/auth-configuration/istio-1.14.0/bin"
istioctl install --set profile=demo -y
kubectl get pods -n istio-system
kubectl get svc -n istio-system -l istio=ingressgateway

Setup Bookinfo environment

kubectl create ns demo
kubectl label namespace demo istio-injection=enabled
kubens demo
kubectl apply -f platform/kube/bookinfo.yaml
kubectl apply -f networking/bookinfo-gateway.yaml
kubectl apply -f networking/bookinfo-virtualservice.yaml

Setup Auth0 Account

This step requires to login to Auth0 website & create api with simple user generation. For this example I have followed all the steps with screenshot mentioned in auth0 document.

Setup Auth rules

kubectl apply -f security/auth0-authn.yaml
kubectl apply -f security/app-credentials.yaml
kubectl apply -f policies/*

Demo

Damn!! It is so Easy

Introducing authentication to the service is too easy. I never thought I could be able to add an entire authentication demo in 2 days!

Code

Below policy tells that AuthorizationPolicy applies to the pods with details label. If the user has permission “read:book-details”, only send the request further.

apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
  name: "details-policy"
  namespace: demo
spec:
  action: ALLOW
selector:
  matchLabels:
    app: details
rules:
 - when:
  - key: request.auth.claims[permissions]
    values: ["read:book-details"]

Reference:

Authenticating and Authorizing end-users with Istio and Auth0

Security

RequestAuthentication

Authorization Policy

Large Scale Security Policy Performance Tests