oauth2-proxy | reverse proxy that provides authentication | OAuth library

So here is the deal. I am using Kubernetes and I want to protect the applications inside of the cluster. Therefore I added an oauth2-proxy and, in case the user is not logged in, it is redirected to GitHub. After the login is done, the user is redirected to the app (Login Diagram). For now, I have two dummy deployments of an echo-http server (echo1 and echo2) and Jenkins. I am doing everything locally with minikube, so please don't mind the domain names.

In Jenkins, I installed the Github OAuth plugin and configured it as said in the multiple posts I found (e.g., Jenkins GitHub OAuth). Also created the GitHub OAuth application and set the callback. Since I want to have SSO for multiple applications besides Jenkins, I set the call back to https://auth.int.example.com/oauth2/callback instead of https://jenkins.int.example.com/securityRealm/finishLogin. Therefore, after login on the GitHub, I get redirected to the Jenkins webpage but as a guest. If I try to log in, I end up in an error. I used Helm to setup the oauth2-proxy (k8s-at-home/oauth2-proxy)

Am I missing something?

These are the ingress configuration of the oauth2-proxy and ingress controller that I am using.

Nginx Ingress

following the previous question on Stack Overflow at this link, after successful authentication (at Github.com) i get 404 page not found on my browser.

The Ingress configuration below (used by nginx-ingress controller):

I am trying to use Keycloak with Oauth2 to secure kubernetes-dashboard. I found several post about this error, but none was specific for my problem. maybe i just miss a simple step ..

so far i followed this guide: https://jamesveitch.com/homelab/02.idam/02.keycloak/

Keycloak is installed at the kubernetes cluster within the namespace keycloak. Kubernetes-dashboard is installed within the namespace kubernetes-dashboard.

Keycloak is reachable under auth.mydomain.com and the dashboard should be reachbale under dashboard.mydomain.com.

I have created a user "test" and assigned a group kubernetes-admin which i would use to grant access to the dashboard.

I configured Keycloak like this:

1. Created a new realm "dev"
2. Created a User test and a group kubernetes-admin
3. Created a new client "dashboard"
   • Access Type: confidential
   • Service Account enabled: on
   • Valid Redirect Url: https://dashboard.mydomain.com/oauth/callback
   • Created a Mapper for groups (Type: Group Membership, TokenClaimName:groups)

For Clusterbinding of kubernetes-admin i use this yaml:

Calling an URL which is proxied by the oauth2 proxy. The oauth2 proxy should perform an authorization code flow in case no authentication is available. In case there is already an authentication available, the access token should be set to the Authorization Header in the request which is forwarded to the upstream.

According to the documentation I'd expect that, when setting --pass-authorization-header the token which is requested should be added to the authorization header.

I also experimented with --pass-access-token which should set an X-Forwarded-Access-Token header. I couldn't see this header at my service either.

Could someone explain to me what I'm doing wrong?

I am trying to convert docker-compose.yaml Keycloak to Char values, I'm stuck with this a bit:

Docker-compose config looks like this:

I have installed helm on a GKE Cluster. Installation is fine

I am running an app in a kubernetes service on Azure and have had it set up with an NGINX ingress controller and a public IP address with a FQDN. This was all working fine.
I then wanted to add security through using the oauth2-proxy for third party sign-in. I would like to keep my setup to one ingress-controller and one oauth2_proxy per namespace, with multiple apps running together. As Azure does not support the use of sub-domains for this I have been using paths to route to the correct app. I've seen examples, like this, on how to use one oauth2_proxy for multiple sub-domains but is it possible to get it working with multiple paths instead?

Setup
This is the current working setup with only one app, located on root /. I would like to switch to an app specific path and the ability to run multiple apps on different paths. eg. /my-app, /another-app etc.

oauth2-proxy-config.yaml

I am attempting to protect a service's status page with an oauth2_proxy, using Azure AD as the external auth provider. Currently if I browse to the public url of the app (https://sub.domain.com/service/hangfire) I got a 504 gateway timeout, where it should be directing me to authenticate.

I had been mostly following this guide for reference: https://msazure.club/protect-kubernetes-webapps-with-azure-active-directory-aad-authentication/

If I disable the annotations that direct the authentication, I can get to the public status page without a problem. If I browse to https://sub.domain.com/oauth2, I get a prompt to authenticate with my provider, which I would expect. I am not sure where the issue lies in the ingress config but I was unable to find any similar cases to this online, stackoverflow or otherwise.

In this case, everything (oauth deployment, service, and ingress rules) lives in a 'dev' namespace except the actual ingress deployment, which lives in its own namespace. I don't suspect this makes a difference, but SSL termination is handled by a gateway outside the cluster.

oauth2 deployment:

I want to use Azure Active Directory as an external oauth2 provider to protect my services on the ingress level. In the past, I used basic ouath and everything worked like expected. But nginx provides the extern ouath methode which sounds much more confortable!

For that I created an SP: