Using the OAuth2 filter for SSO

Ambassador Edge Stack adds native support for configuring single sign-on with OAuth and OIDC authentication schemes for single sign-on with an external identity provider (IdP). Ambassador Edge Stack has been tested with Keycloak, Auth0, Okta, and UAA although other OAuth/OIDC-compliant identity providers should work. Please contact us on Slack if you have questions about IdPs not listed below.

1. Configure an OAuth2 filter

First, configure an OAuth2 filter for your identity provider. For information on how to configure your IdP, see the IdP configuration section below.

If you have multiple domains that should all share the same single-sign-on authentication, you can list more than one protectedOrigin -- just make sure that the first one listed is the one your IdP is configured to redirect back to.

You can also tell Ambassador Edge Stack that subdomains of an origin are OK too. For example, to have domain1.example.com shares authentication information with domain2.example.com, with all subdomains of domain2 included:

Save the configuration to a file and apply it to the cluster: kubectl apply -f oauth-filter.yaml.

2. Create a FilterPolicy

Once we have a properly configured OAuth2 filter, create a FilterPolicy that applies the filter.

Save the configuration to a file and apply it to the cluster: kubectl apply -f httpbin-filter-policy.yaml. For more information about filters and filter policies, consult the filter reference.

IdP configuration

You will need to configure your IdP to handle authentication requests. The way to do this varies by IdP.

• Auth0
• Azure AD
• Google
• Keycloak
• Okta
• OneLogin
• Salesforce
• UAA

Configure authentication across multiple domains (optional)

Ambassador Edge Stack supports authentication for multiple domains where each domain is issued its own access token. For example, imagine you're hosting both domain1.example.com and domain2.example.com on the same cluster. With multi-domain support, users will receive separate authentication tokens for domain1 and domain2.

To configure multi-domain access, you will need to create another authentication endpoint with your IdP and create another Filter for the new domain.

Example:

Create a separate FilterPolicy that specifies which specific filters are applied to particular hosts or URLs.

Further reading

The filter reference covers the specifics of filters and filter policies in much more detail.