Passwordless authentication with WebAuthn, Keycloak and Istio

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=${ISTIO_VERSION} TARGET_ARCH=x86_64 sh -

cd istio-${ISTIO_VERSION}

cat <<EOF > my-config.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: default
  hub: docker.io/istio
  tag: ${ISTIO_VERSION}
  revision: 1-15-4
  meshConfig:
    accessLogFile: /dev/stdout
    extensionProviders:
    - name: "webauthn"
      envoyExtAuthzHttp:
        service: "oauth2-proxy.oauth.svc.cluster.local"
        port: 80
        includeHeadersInCheck:
        - x-user
        - authorization
        - cookie
        headersToUpstreamOnAllow:
        - authorization
        - x-auth-request-user
        - x-auth-request-email
        - x-auth-request-preferred-username
EOF

./bin/istioctl install -f my-config.yaml -y

cd ..

kubectl create ns httpbin
kubectl label ns httpbin istio.io/rev=1-15-4
kubectl run httpbin --image=kennethreitz/httpbin -n httpbin --env="GUNICORN_CMD_ARGS=--capture-output --error-logfile - --access-logfile - --access-logformat '%(h)s %(t)s %(r)s %(s)s Host: %({Host}i)s'" --port 80 -l "app=httpbin"
kubectl expose po/httpbin --port=8000 --target-port=80 -n httpbin

# Deploy Keycloak
k create ns oauth
k -n oauth apply -f https://raw.githubusercontent.com/keycloak/keycloak-quickstarts/20.0.2/kubernetes-examples/keycloak.yaml

# Import the pre-configured "corp-users" realm
KEYCLOAK_POD=$(kubectl get pods -n oauth -l app=keycloak -o jsonpath='{.items[0].metadata.name}')
cat ${KEYCLOAK_REALM}-realm.json | k exec -i ${KEYCLOAK_POD} -n oauth -- tee /tmp/corp.json > /dev/null
k exec -n oauth -ti ${KEYCLOAK_POD} bash
> cd /opt/keycloak/bin/
> ./kc.sh import --file /tmp/corp.json
# disregard the error messages
> exit

# Open the Keycloak admin UI
KEYCLOAK_IP=$(kubectl get svc keycloak -n oauth -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
open "http://${KEYCLOAK_IP}:8080/admin/master/console/#/realms"
# login with admin/admin

provider: google
extraArgs:
  - "--service-type-filter=LoadBalancer"
  - "--google-project=${GCP_PROJECT}"
env:
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: /etc/secrets/service-account/credentials.json
extraVolumeMounts:
  - name: google-service-account
    mountPath: /etc/secrets/service-account/
extraVolumes:
  - name: google-service-account
    secret:
      secretName: external-dns
sources:
  - service
  - istio-virtualservice
policy: upsert-only
registry: txt
txtOwnerId: "external-dns-local-kind"
domainFilters:
  - "${BASE_DN}"
logLevel: debug

# TLS gateway
# Create a new secret with the wildcard cert
# Secret must be in the same namespace as the gateway pod
export path_to_cert=".../certs"
kubectl create secret tls wildcard-tls --key ${path_to_cert}/wildcard-bco-runlocal-dev.key --cert ${path_to_cert}/wildcard-bco-runlocal-dev.crt -n istio-system

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: tls-gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: wildcard-tls
    hosts:
    - "*.${BASE_DN}"
EOF

# Expose keycloak with Istio, over TLS
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: keycloak
  namespace: oauth
spec:
  gateways:
  - default/tls-gateway
  hosts:
  - "${KEYCLOAK_DN}"
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: keycloak.oauth.svc.cluster.local
        port:
          number: 8080
EOF

# check the DNS record was created by external-dns

# Deploy Redis
k run redis --image redis -n oauth
k expose po redis -n oauth --port 6379

# OAuth2-proxy Helm values
cat <<EOF > oauth2-proxy-values.yaml
# Oauth client configuration specifics
config:
  # OAuth client ID
  clientID: "gloo"
  # OAuth client secret
  clientSecret: "MsQLofFupVbCi6iYMYJ2qrVn6rR8e2jN"
  # Create a new secret with the following command
  # openssl rand -base64 32 | head -c 32 | base64
  # Use an existing secret for OAuth2 credentials (see secret.yaml for required fields)
  # Example:
  # existingSecret: secret
  cookieSecret: "DV0Y+mXgqT4Duitw16amd8TZjl/bQVou"
  # The name of the cookie that oauth2-proxy will create
  # If left empty, it will default to the release name
  cookieName: ""
  # Default configuration, to be overridden
  configFile: |-
    provider = "oidc"
    provider_display_name = "KEYCLOAK"
    oidc_issuer_url = "https://${KEYCLOAK_DN}/realms/${KEYCLOAK_REALM}"
    login_url = "https://${KEYCLOAK_DN}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth"
    redeem_url = "https://${KEYCLOAK_DN}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token"
    profile_url = "https://${KEYCLOAK_DN}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/userinfo"
    validate_url = "https://${KEYCLOAK_DN}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/userinfo"
    ssl_insecure_skip_verify = true
    skip_provider_button = true
    email_domains = ["*"]
    insecure_oidc_allow_unverified_email = true
    scope = "email profile openid"
    oidc_extra_audiences = ["gloo"]
    cookie_secure = true
    pass_host_header = true
    pass_user_headers = true
    standard_logging = true
    auth_logging = true
    request_logging = true
    upstreams = ["static://200"]
    set_xauthrequest = true
    set_authorization_header = true # oddly pass the id_token as Authorization header
sessionStorage:
  # Can be one of the supported session storage cookie|redis
  type: redis
  redis:
    # Name of the Kubernetes secret containing the redis & redis sentinel password values (see also "sessionStorage.redis.passwordKey")
    existingSecret: ""
    # Redis password value. Applicable for all Redis configurations. Taken from redis subchart secret if not set. "sessionStorage.redis.existingSecret" takes precedence
    password: ""
    # Key of the Kubernetes secret data containing the redis password value
    passwordKey: "redis-password"
    # Can be one of standalone|cluster|sentinel
    clientType: "standalone"
    standalone:
      connectionUrl: "redis://redis.oauth.svc.cluster.local:6379"
EOF

helm upgrade -i oauth2-proxy oauth2-proxy/oauth2-proxy --create-namespace -n oauth -f oauth2-proxy-values.yaml

# Expose HTTPBIN and Oauth2-proxy with Istio, over TLS
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: httpbin
  namespace: httpbin
spec:
  gateways:
  - default/tls-gateway
  hosts:
  - "${APIGW_DN}"
  http:
  - match: # route requests starting with /oauth2 to oauth2-proxy
    - uri:
        prefix: /oauth2/*
    route:
    - destination:
        host: oauth2-proxy.oauth.svc.cluster.local
        port:
          number: 80
  - match: # route other requests to the httpbin service
    - uri:
        prefix: /
    route:
    - destination:
        host: httpbin.httpbin.svc.cluster.local
        port:
          number: 8000
EOF

# AuthzPolicy
k apply -f - <<EOF
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: webauthn
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway # apply to the Istio Ingress Gateway pod
  action: CUSTOM
  provider:
    name: "webauthn"
  rules:
  - to:
    - operation:
        hosts: ["${APIGW_DN}"] # only for the API domain
EOF

# Double check the request comes with a JWT that was signed by our IdP (and JWT is not expired)
k apply -f - <<EOF
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: check-jwt-from-idp
  namespace: httpbin
spec:
  selector:
    matchLabels:
      app: httpbin # apply to the httpbin service
  jwtRules:
  - issuer: "https://${KEYCLOAK_DN}/realms/corp-users"
    jwksUri: "https://${KEYCLOAK_DN}/realms/corp-users/protocol/openid-connect/certs"
EOF
# only allow requests from the Istio Ingress Gateway
k apply -f - <<EOF
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: check-req-from-gateway
  namespace: httpbin
spec:
  selector:
    matchLabels:
      app: httpbin # apply to the httpbin service
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"]
EOF