OAuth

This extension may be referenced by the qualified name envoy.filters.http.oauth2

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.

Tip

This extension extends and can be used with the following extension category:

OAuth configuration overview.

extensions.filters.http.oauth2.v3.OAuth2Credentials

[extensions.filters.http.oauth2.v3.OAuth2Credentials proto]

  1. {
  2.   "client_id": "...",
  3.   "token_secret": "{...}",
  4.   "hmac_secret": "{...}"
  5. }

client_id

(string, REQUIRED) The client_id to be used in the authorize calls. This value will be URL encoded when sent to the OAuth server.

token_secret

(extensions.transport_sockets.tls.v3.SdsSecretConfig, REQUIRED) The secret used to retrieve the access token. This value will be URL encoded when sent to the OAuth server.

hmac_secret

(extensions.transport_sockets.tls.v3.SdsSecretConfig, REQUIRED) If present, the secret token will be a HMAC using the provided secret.

Configures how the secret token should be created.

extensions.filters.http.oauth2.v3.OAuth2Config

[extensions.filters.http.oauth2.v3.OAuth2Config proto]

OAuth config

  1. {
  2.   "token_endpoint": "{...}",
  3.   "authorization_endpoint": "...",
  4.   "credentials": "{...}",
  5.   "redirect_uri": "...",
  6.   "redirect_path_matcher": "{...}",
  7.   "signout_path": "{...}",
  8.   "forward_bearer_token": "...",
  9.   "pass_through_matcher": [],
  10.   "auth_scopes": [],
  11.   "resources": []
  12. }

token_endpoint

(config.core.v3.HttpUri) Endpoint on the authorization server to retrieve the access token from.

authorization_endpoint

(string, REQUIRED) The endpoint redirect to for authorization in response to unauthorized requests.

credentials

(extensions.filters.http.oauth2.v3.OAuth2Credentials, REQUIRED) Credentials used for OAuth.

redirect_uri

(string, REQUIRED) The redirect URI passed to the authorization endpoint. Supports header formatting tokens. For more information, including details on header value syntax, see the documentation on custom request headers.

This URI should not contain any query parameters.

redirect_path_matcher

(type.matcher.v3.PathMatcher, REQUIRED) Matching criteria used to determine whether a path appears to be the result of a redirect from the authorization server.

signout_path

(type.matcher.v3.PathMatcher, REQUIRED) The path to sign a user out, clearing their credential cookies.

forward_bearer_token

(bool) Forward the OAuth token as a Bearer to upstream web service.

pass_through_matcher

(repeated config.route.v3.HeaderMatcher) Any request that matches any of the provided matchers will be passed through without OAuth validation.

auth_scopes

(repeated string) Optional list of OAuth scopes to be claimed in the authorization request. If not specified, defaults to “user” scope. OAuth RFC https://tools.ietf.org/html/rfc6749#section-3.3

resources

(repeated string) Optional resource parameter for authorization request RFC: https://tools.ietf.org/html/rfc8707

extensions.filters.http.oauth2.v3.OAuth2

[extensions.filters.http.oauth2.v3.OAuth2 proto]

Filter config.

  1. {
  2.   "config": "{...}"
  3. }

config

(extensions.filters.http.oauth2.v3.OAuth2Config) Leave this empty to disable OAuth2 for a specific route, using per filter config.