Skip to content

Commit 8d3eddc

Browse files
shashankramshashankram
authored
kgw/oauth: implement additional cookie and redirect settings (#13099)
Signed-off-by: Shashank Ram <[email protected]>
1 parent 2c9324b commit 8d3eddc

File tree

13 files changed

+621
-77
lines changed

13 files changed

+621
-77
lines changed

‎api/v1alpha1/kgateway/oauth2.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,21 @@ func (h HttpsUri) String() string {
1515
return string(h)
1616
}
1717

18+
// OAuth2CookieSameSite specifies the SameSite attribute for OAuth2 cookies
19+
// +kubebuilder:validation:Enum=Lax;Strict;None
20+
type OAuth2CookieSameSite string
21+
22+
const (
23+
// OAuth2CookieSameSiteLax specifies the Lax SameSite attribute for OAuth2 cookies
24+
OAuth2CookieSameSiteLax OAuth2CookieSameSite = "Lax"
25+
26+
// OAuth2CookieSameSiteStrict specifies the Strict SameSite attribute for OAuth2 cookies
27+
OAuth2CookieSameSiteStrict OAuth2CookieSameSite = "Strict"
28+
29+
// OAuth2CookieSameSiteNone specifies the None SameSite attribute for OAuth2 cookies
30+
OAuth2CookieSameSiteNone OAuth2CookieSameSite = "None"
31+
)
32+
1833
// OAuth2Provider specifies the configuration for OAuth2 extension provider.
1934
//
2035
// +kubebuilder:validation:XValidation:message="Either issuerURI, or both authorizationEndpoint and tokenEndpoint must be specified",rule="has(self.issuerURI) || (has(self.authorizationEndpoint) && has(self.tokenEndpoint))"
@@ -82,6 +97,39 @@ type OAuth2Provider struct {
8297
// Refer to https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout for more details.
8398
// +optional
8499
EndSessionEndpoint *HttpsUri `json:"endSessionEndpoint,omitempty"`
100+
101+
// Cookies specifies the configuration for the OAuth2 cookies.
102+
// +optional
103+
Cookies *OAuth2CookieConfig `json:"cookies,omitempty"`
104+
105+
// DenyRedirectMatcher specifies the matcher to match requests that should be denied redirects to the authorization endpoint.
106+
// Matching requests will receive a 401 Unauthorized response instead of being redirected.
107+
// This is useful for AJAX requests where redirects should be avoided.
108+
// +optional
109+
DenyRedirect *OAuth2DenyRedirectMatcher `json:"denyRedirect,omitempty"`
110+
}
111+
112+
type OAuth2CookieConfig struct {
113+
// CookieDomain specifies the domain to set on the access and ID token cookies.
114+
// If set, the cookies will be set for the specified domain and all its subdomains. This is useful when requests
115+
// to subdomains are not required to be re-authenticated after the user has logged into the parent domain.
116+
// If not set, the cookies will default to the host of the request, not including the subdomains.
117+
// +optional
118+
//
119+
// +kubebuilder:validation:MinLength=1
120+
// +kubebuilder:validation:MaxLength=253
121+
// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9]))*$`
122+
Domain *string `json:"domain,omitempty"`
123+
124+
// Names specifies the names of the cookies used to store the tokens.
125+
// If not set, the default names will be used.
126+
// +optional
127+
Names *OAuth2CookieNames `json:"names,omitempty"`
128+
129+
// SameSite specifies the SameSite attribute for the OAuth2 cookies.
130+
// If not set, the default is Lax.
131+
// +optional
132+
SameSite *OAuth2CookieSameSite `json:"sameSite,omitempty"`
85133
}
86134

87135
// OAuth2Credentials specifies the Oauth2 client credentials.
@@ -100,6 +148,30 @@ type OAuth2Credentials struct {
100148
ClientSecretRef corev1.LocalObjectReference `json:"clientSecretRef"`
101149
}
102150

151+
// OAuth2CookieNames specifies the names of the cookies used to store the tokens.
152+
type OAuth2CookieNames struct {
153+
// AccessToken specifies the name of the cookie used to store the access token.
154+
// +optional
155+
//
156+
// +kubebuilder:validation:MinLength=1
157+
AccessToken *string `json:"accessToken,omitempty"`
158+
159+
// IDToken specifies the name of the cookie used to store the ID token.
160+
// +optional
161+
//
162+
// +kubebuilder:validation:MinLength=1
163+
IDToken *string `json:"idToken,omitempty"`
164+
}
165+
166+
// OAuth2DenyRedirectMatcher specifies the matcher to match requests that should be denied redirects to the authorization endpoint.
167+
type OAuth2DenyRedirectMatcher struct {
168+
// Headers specifies the list of HTTP headers to match on requests that should be denied redirects.
169+
// +optional
170+
// +kubebuilder:validation:MinItems=1
171+
// +kubebuilder:validation:MaxItems=16
172+
Headers []gwv1.HTTPHeaderMatch `json:"headers,omitempty"`
173+
}
174+
103175
// OAuth2Policy specifies the OAuth2 policy to apply to requests.
104176
type OAuth2Policy struct {
105177
// ExtensionRef specifies the GatewayExtension that should be used for OAuth2.

‎api/v1alpha1/kgateway/zz_generated.deepcopy.go‎

Lines changed: 87 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎install/helm/kgateway-crds/templates/gateway.kgateway.dev_gatewayextensions.yaml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1126,6 +1126,46 @@ spec:
11261126
- message: Must have port for Service reference
11271127
rule: '(size(self.group) == 0 && self.kind == ''Service'') ?
11281128
has(self.port) : true'
1129+
cookies:
1130+
description: Cookies specifies the configuration for the OAuth2
1131+
cookies.
1132+
properties:
1133+
domain:
1134+
description: |-
1135+
CookieDomain specifies the domain to set on the access and ID token cookies.
1136+
If set, the cookies will be set for the specified domain and all its subdomains. This is useful when requests
1137+
to subdomains are not required to be re-authenticated after the user has logged into the parent domain.
1138+
If not set, the cookies will default to the host of the request, not including the subdomains.
1139+
maxLength: 253
1140+
minLength: 1
1141+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9]))*$
1142+
type: string
1143+
names:
1144+
description: |-
1145+
Names specifies the names of the cookies used to store the tokens.
1146+
If not set, the default names will be used.
1147+
properties:
1148+
accessToken:
1149+
description: AccessToken specifies the name of the cookie
1150+
used to store the access token.
1151+
minLength: 1
1152+
type: string
1153+
idToken:
1154+
description: IDToken specifies the name of the cookie
1155+
used to store the ID token.
1156+
minLength: 1
1157+
type: string
1158+
type: object
1159+
sameSite:
1160+
description: |-
1161+
SameSite specifies the SameSite attribute for the OAuth2 cookies.
1162+
If not set, the default is Lax.
1163+
enum:
1164+
- Lax
1165+
- Strict
1166+
- None
1167+
type: string
1168+
type: object
11291169
credentials:
11301170
description: Credentials specifies the Oauth2 client credentials
11311171
to use for authentication.
@@ -1157,6 +1197,71 @@ spec:
11571197
- clientID
11581198
- clientSecretRef
11591199
type: object
1200+
denyRedirect:
1201+
description: |-
1202+
DenyRedirectMatcher specifies the matcher to match requests that should be denied redirects to the authorization endpoint.
1203+
Matching requests will receive a 401 Unauthorized response instead of being redirected.
1204+
This is useful for AJAX requests where redirects should be avoided.
1205+
properties:
1206+
headers:
1207+
description: Headers specifies the list of HTTP headers to
1208+
match on requests that should be denied redirects.
1209+
items:
1210+
description: |-
1211+
HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request
1212+
headers.
1213+
properties:
1214+
name:
1215+
description: |-
1216+
Name is the name of the HTTP Header to be matched. Name matching MUST be
1217+
case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
1218+
1219+
If multiple entries specify equivalent header names, only the first
1220+
entry with an equivalent name MUST be considered for a match. Subsequent
1221+
entries with an equivalent header name MUST be ignored. Due to the
1222+
case-insensitivity of header names, "foo" and "Foo" are considered
1223+
equivalent.
1224+
1225+
When a header is repeated in an HTTP request, it is
1226+
implementation-specific behavior as to how this is represented.
1227+
Generally, proxies should follow the guidance from the RFC:
1228+
https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding
1229+
processing a repeated header, with special handling for "Set-Cookie".
1230+
maxLength: 256
1231+
minLength: 1
1232+
pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
1233+
type: string
1234+
type:
1235+
default: Exact
1236+
description: |-
1237+
Type specifies how to match against the value of the header.
1238+
1239+
Support: Core (Exact)
1240+
1241+
Support: Implementation-specific (RegularExpression)
1242+
1243+
Since RegularExpression HeaderMatchType has implementation-specific
1244+
conformance, implementations can support POSIX, PCRE or any other dialects
1245+
of regular expressions. Please read the implementation's documentation to
1246+
determine the supported dialect.
1247+
enum:
1248+
- Exact
1249+
- RegularExpression
1250+
type: string
1251+
value:
1252+
description: Value is the value of HTTP Header to be
1253+
matched.
1254+
maxLength: 4096
1255+
minLength: 1
1256+
type: string
1257+
required:
1258+
- name
1259+
- value
1260+
type: object
1261+
maxItems: 16
1262+
minItems: 1
1263+
type: array
1264+
type: object
11601265
endSessionEndpoint:
11611266
description: |-
11621267
EndSessionEndpoint specifies the URL that redirects a user's browser to in order to initiate a single logout

0 commit comments

Comments
 (0)