-
Notifications
You must be signed in to change notification settings - Fork 65
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
GitLab OIDC provider results in ext_authz_denied #62
Comments
Some additional info: Basing my distribution on https://github.com/arrikto/oidc-authservice/tree/master/e2e/manifests/authservice/base passes me through to the Kubeflow Dashboard without any authentication happening. The EnvoyFilter is still using the deprecated v2 though, so this might be the reason. |
After updating the EnvoyFilter to v3 as follows:
I now get the following error.
|
After some more debugging I noticed that $(NAMESPACE) wasn't being replaced by Kustomize correctly (since the path to those vars were changed in the EnvoyFilter above). As a result, the FilterHeadersStatus::StopIteration no longer occurs, but I am now back to:
|
Hi Karl! Thanks for updating on your progress. Could you please provide more info on what your browser sees? |
I am also seeing the same issue recently.We are running KF 1.3.1 with Dev OIDC.This is occurring intermittently. Does anyone found a solution. [2021-12-06T21:52:08.367Z] "GET /jupyter/api/namespaces/NS/notebooks HTTP/1.1" 403 UAEX ext_authz_error - "-" 0 0 9773 - "100.64.128.33,10.42.139.195" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36" "eb3375d8-12ce-9765-8d53-73eed360187d" "<CLUSTER_URL>t" "-" - - 10.42.139.220:8080 10.42.139.195:34142 - - |
We're also seeing this same issue several times. We are using KF1.3.1.
Found that when with 403 error, the authservice ip:8080 not response. While ip:8081 is responsing.
The authservice pod manifest as below:
@ryandawsonuk @yanniszark, could you please help to look on this. |
Hi all, I am facing the same issue, any progress? |
Is this a bug report or feature request?
Describe the bug
Following the instruction in the readme (and also piecing together examples for a few different repos) I am unable to get the OIDC authservice to work. (I am doing this with Kubeflow 1.3 and am using GitLab to test the functionality).
How to Reproduce
My understanding is that the following should work. However, I get an
ext_authz_denied
error in the Istio Ingressgateway logs.Expected behavior
I would expect the above to result in a successful authentication
Logs
authservice:
istio ingress gateway:
Environment:
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered: