Add no_jwt_patterns to auth.proto #345
Conversation
googlebot
added
the
cla: yes
|
@qiwzhang: The following test failed, say
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
| // But some requests are OK without JWT, such as OPTIONS for CORS, | ||
| // or some paths for health checking. | ||
| // If a request matches any of no_jwt_patterns, it is OK without JWT. | ||
| repeated Pattern no_jwt_patterns = 3; |
There was a problem hiding this comment.
This becomes another specialized URL map, and you also put the business logic with the map. There are too much business logic connected together here.
Why EndUser is mentioned in the proto spec? Why the auth is not a service account, or a mobile device, or a IoT, or a delegated service, or impersonation? I think we should have an abstraction here. The URL map produce an operation id, and the operation id maps to authentication requirements. The concept of JWT or end user should not be the top level concept.
There was a problem hiding this comment.
We will address some of your concerns with this issue
#344
There was a problem hiding this comment.
EndUserAuthenticationPolicy can be renamed to auth filter config with #344. There was some previous discussion about treating this matching as authZ problem and handling in the mixer. But that can be inefficient as we end up unconditionally trying to validate all JWT for a host regardless of the path/method. Could an attribute match condition similar to the quotaspec make sense here, or should it be specialized for specific attributes (e.g. api.operation)?
The top-level AuthenticationPolicy (see #335) possibly ought to support this mapping of auth requirements to particular sets of operations (or entire service or maybe even namespace). @diemtvu
There was a problem hiding this comment.
If I understand correctly, this is aligned with the SelectCriteria discussed here, though I haven't fully fleshed out all details. However, our intention is to have that in the AuthN policy.
There was a problem hiding this comment.
We should be careful about which level of config we are talking here. This is NOT user level config. This is low-level component level config. Specifically this is the config for Envoy auth filter defined here: https://github.com/istio/proxy/blob/master/src/envoy/auth/config.proto
Auth filter will be upstreamed to Envoy. It should not depended on any Istio proto files. That config proto is just copied from this proto file. So this proto file is the low level Envoy filter config for Mixer Filter and Auth filter.
There was a problem hiding this comment.
We can depend on core protos in data-plane-api. If there is no good match, then we can start a discussion to add another core proto. There's value in consolidating proto definitions, instead of copying them from place to place.
There was a problem hiding this comment.
I am a bit confused by the structure of this proto. Pattern matching is a common way for software, and it should looks like this way for most people:
match xxx:
action
This proto puts the pattern matching inside the action, which is counter intuitive.
Pattern matching on request should be a common function across Envoy and Istio. I strongly prefer we define it in a central place. JWT rule essentially an action that produces the request auth attributes.
…tion scenarios (istio#345) Signed-off-by: Yaroslav Skopets <[email protected]>
If a request doesn't have JWT, it will be rejected.
But some requests are OK without JWT, such as OPTIONS for CORS,
or some paths for health checking.
This auth config change allow users to specify these pattern.