OIDC SecurityPolicy: original authorization header removed about gateway HOT 8 OPEN

cc @zhaohuabing

from gateway.

@arkodg EnvoyPatchPolicy worked. It's just the Authorization header has been sanitized by the OAuth2 filter when the oauth2 filter is in the request path, and Envoy believes this is the right behavior :-)

  // Sanitize the Authorization header, since we have no way to validate its content. Also,
  // if token forwarding is enabled, this header will be set based on what is on the HMAC cookie
  // before forwarding the request upstream.
  headers.removeInline(authorization_handle.handle());

https://github.com/envoyproxy/envoy/blob/416cd425d50d3bc54c18ea134835a07ec21370d7/source/extensions/filters/http/oauth2/filter.cc#L292-L295

from gateway.

EG OIDC enables forward_bearer_token by default and overrides the authorization header if it exists. We can add an option to the API to opt it out. However, it's weird that the header is gone after setting forward_bearer_token to false with an EnvoyPatchPolicy.

from gateway.

@zhaohuabing any idea why the EnvoyPatchPolicy did not work

from gateway.

Ah nice find ! So filter ordering may be useful here ?

from gateway.

Filter ordering won't help here since the OAuth2 filter will remove this header no matter where it's in the chain.

@denniskniep I'm curious why you use both a JWT added by your "frontend application" and a SecurityPolicy with OIDC at the same time?

from gateway.

Thanks a lot for looking into this.

There are at least two reasons why I want to do this:

1. Upstream Application is not exposed/touched by external requests without being an legitimate authenticated user. That is especially interesting if there are unauthenticated RCE or other vulnerabilities for that application.
2. Security of upstream applications AuthenticationLayer is not fulfilling required level. i.e. no MFA possible

In my case its really a jwt which is added to the request by the frontend application.
Therefore I want to mention a scenario, which maybe makes more sense. Upstream application is using basic auth and one want to increase security, by adding authentication with an IDP. UX is not great due to double authentication (First OIDC, then Basic Auth). But technically the basic auth can not be executed, because the header is removed.

from gateway.

@denniskniep thanks for detailing your use case! I agree that MFA (two or more layers of authentication) is a valid scenario here. Let's open an issue in Envoy upstream to see if a knob can be added to opt this out.

from gateway.