Request-Level Authentication and Authorization With Istio and Keycloak

curl -L https://istio.io/downloadIstio | sh -

sudo cp istio-1.17.2/bin/istioctl /usr/local/bin/

  istioctl install --set profile=demo -y

  ✔ Istio core installed

 ✔ Istiod installed

 ✔ Ingress gateways installed

 ✔ Egress gateways installed

 ✔ Installation comple                                                                             Making this installation the default for injection and validation.

  Thank you for installing Istio 1.17.  Please take a few minutes to tell us about your install/upgrade      experience!  https://forms.gle/hMHGiwZHPU7UQRWe9

  istioctl verify-install

git clone https://github.com/infracloudio/istio-keycloak.git

cd istio-keycloak

kubectl apply -f app/database.yaml

 kubectl get pods -w

 NAME                           READY   STATUS              RESTARTS   AGE

book-info-db-598c7d9f5-m5l57   0/1     ContainerCreating   0          14s

book-info-db-598c7d9f5-m5l57   1/1     Running             0          25s

kubectl apply -f app/app.yaml

kubectl get pods

NAME                           READY   STATUS    RESTARTS     AGE

 book-info-747f77b58-s9r88      2/2     Running   0         59s

book-info-db-598c7d9f5-m5l57   1/1     Running   0            2m39s

kubectl apply -f istio-manifests/ingressGateway.yaml

 kubectl apply -f istio-manifests/virtualService.yaml

LB_IP=$(kubectl get svc istio-ingressgateway -o=jsonpath='{.status.loadBalancer.ingress[0].ip}' -n istio-system)

curl -X GET -H “host: book-info.test.io” http://$LB_IP/getbooks

 [ ]

curl -X POST -H "host: book-info.test.io" -d '{"isbn": 9781982156909, "title": "The Comedy of Errors", "synopsis": "The authoritative edition of The Comedy of Errors from The Folger Shakespeare Library, the trusted and widely used Shakespeare series for students and general readers", "authorname": "William Shakespeare", "price": 10.39}' "http://$LB_IP/addbook"

{

     "isbn": 9781982156909,

    "title": "The Comedy of Errors", 

    "synopsis": "The authoritative edition of The Comedy of Errors from The Folger Shakespeare Library, the trusted and widely used Shakespeare series for students and general readers",

    "authorname": "William Shakespeare",

    "price": 10.39

}

[

    {

        "isbn": 9781982156909,

        "title": "The Comedy of Errors",

        "synopsis": "The authoritative edition of The Comedy of Errors from The Folger Shakespeare Library, the trusted and widely used Shakespeare series for students and general readers",

        "authorname": "William Shakespeare",

        "price": 10.39

    }

]

kubectl create -f https://raw.githubusercontent.com/keycloak/keycloak-quickstarts/latest/kubernetes-examples/keycloak.yaml

kubectl get pods -l app=keycloak -w

NAME                       READY   STATUS              RESTARTS   AGE

keycloak-5bc5c7fbf-jjq29   0/1     ContainerCreating   0          19s

keycloak-5bc5c7fbf-jjq29   0/1     Running             0          29s

kubectl get svc -l app=keycloak -o=jsonpath='{.items[0].status.loadBalancer.ingress[0].ip}'

Create Oauth Client

• From the top-left corner, select the realm ‘Istio’ which we just created.
• Click on Clients and then Create a Client.
• Select OpenID Connect as the client type and give Istio as the Client ID. Add Istio as the Name for the client and click next.

• On the second page, let the default setting as it is and click on next.

• On the third page, similarly, don’t change the default setting and press the Save button.

Roles and User Creation

We will be creating two roles: one for normal users who can only view book details and another one for admin users who can view and add books. Similarly, we will create two users, one normal user with a user role assigned, and another one will be our admin user with an admin role assigned.

Create Roles

• From the left pane, select the Realm roles and click on Create role. Enter the Role name as admin, and click on Create.

• Similarly, create a role for a normal user as well with the Role name as the user.

Create Users

• From the left pane, select the Users and click on Add User. Enter the username as book-admin. You can leave the rest of the value as it is and click on Create.

• Similarly, create another user with a username as book-user.

Set Password for Users

Once both users are created, we will set passwords for them.

• From the left pane, select Users and click on the book-admin user. From the top menu, click on Credentials and click on Set password. Enter a strong password and confirm it. Turn off the Temporary, and finally, click on the Save button.

• Similarly, you can set the password for the book-user user.

Role Assignments

• From the left pane, select Users and click on the book-admin user. From the top menu, select Role Mapping and click on Assign role. Check the admin role from the list which we have created recently and click on assign.

• Similarly, you can assign a user role to a book-user user.

Get the Required Endpoints

We need endpoints to generate JWT tokens and JWT verification. These endpoints would look like the following.

Token Generation URL:

 http://:8080/realms/Istio/protocol/openid-connect/token

Token Verification URL:

 http://:8080/realms/Istio/protocol/openid-connect/certs

That’s it. We have successfully set up the Keycloak for implementing request level authentication and authorization for our demo app.

Istio Request-Level Authentication and Authorization

We have a sample book-info app running and configured Keycloak for issuing JWT tokens. Now. we can use Istio’s RequestAuthentication and Authorization policies to validate the JWT tokens and authorize the access requests.

Enable Request Authentication

First, we get the load balancer IP of the Keycloak service.

Shell

Keycloak_IP=$(kubectl get svc -l app=keycloak -o=jsonpath='{.items[0].status.loadBalancer.ingress[0].ip}')

LB_IP=$(kubectl get svc istio-ingressgateway -o=jsonpath='{.status.loadBalancer.ingress[0].ip}' -n istio-system)

Then we will be creating a RequestAuthentication for validating JWT tokens from Keycloak. You can find all Kubernetes manifests that we are using in this repo.

Now create a RequestAuthentication for validating JWT tokens using Keycloak as the issuer.

Shell

kubectl apply -f - <<>

apiVersion: security.istio.io/v1beta1

kind: RequestAuthentication

metadata:

  name: book-info-request-authentication

spec:

  selector:

     matchLabels:

      app: book-info

  jwtRules:

   - issuer: "http://$Keycloak_IP:8080/realms/Istio"

     jwks_Uri: "http://$Keycloak_IP:8080/realms/Istio/protocol/openid-connect/certs"

EOF

Now we will try to access the book-info application’s getbooksendpoint.

Shell

curl -X GET -H "host: book-info.test.io" http://$LB_IP/getbooks

[

    {

        "isbn": 9781982156909,

        "title": "The Comedy of Errors",

        "synopsis": "The authoritative edition of The Comedy of Errors from The Folger Shakespeare Library, the trusted and widely used Shakespeare series for students and general readers",

        "authorname": "William Shakespeare",

        "price": 10.39

    }

]

We are still able to access the endpoint without a JWT token despite enabling request authentication for the book-info app. This is happening because we have not yet created an authorization policy to restrict access to authenticated requests only.

So, next, we will create an authorization policy.

Shell

kubectl apply -f - <<>

apiVersion: security.istio.io/v1beta1

kind: AuthorizationPolicy

metadata:

  name: book-info-auth

spec:

  selector:

    matchLabels:

       app: book-info

  rules:

   - from:

     - source:

         requestPrincipals: ["*"]

EOF

We will try accessing getbooks endpoint.

Shell

curl -X GET -H "host: book-info.test.io" http://$LB_IP/getbooks

RBAC: access denied

This time requests get denied. Now only requests with valid JWT will be allowed to access the endpoints.

Now, let’s try generating the JWT using the book-user user’s credentials by calling the token generation endpoint.

Shell

curl -X POST -d "client_id=Istio" -d "username=book-user" -d "password=user123" -d "grant_type=password" "http://$Keycloak_IP:8080/realms/Istio/protocol/openid-connect/token"

{"access_token":"*****","expires_in":300,"refresh_expires_in":1800,"refresh_token":"*****","token_type":"Bearer","not-before-policy":0,"session_state":"382dd7d6-a440-43fc-b9f8-13f4dc84fe3f","scope":"profile email"}

Copy the access token and use it as an authorization bearer while calling getbooks endpoint.

Shell

curl -X GET -H "host: book-info.test.io" -H "Authorization: Bearer *****” http://$LB_IP/getbooks

[

    {

        "isbn": 9781982156909,

        "title": "The Comedy of Errors",

        "synopsis": "The authoritative edition of The Comedy of Errors from The Folger Shakespeare Library, the trusted and widely used Shakespeare series for students and general readers",

        "authorname": "William Shakespeare",

        "price": 10.39

    }

]

This time we are able to access the getbooks endpoint. Similarly, you can try generating a token for book-admin user and try accessing the getbooks endpoint.

Now, let’s try adding a new book using addbook endpoint.

Shell

curl -X POST -d '{"isbn": 123456789123, "title": "Test Book 1", "synopsis": "This is test book 1", "authorname": "test-author1", "price": 10.39}' "http://$LB_IP/addbook"

 RBAC: access denied

Adding a new book failed because access is denied. Now we will generate a token for book-user and try adding the book.

Shell

curl -X POST -d "client_id=Istio" -d "username=book-user" -d "password=user123" -d "grant_type=password" "http://$Keycloak_IP:8080/realms/Istio/protocol/openid-connect/token"

{"access_token":"*****","expires_in":300,"refresh_expires_in":1800,"refresh_token":"*****","token_type":"Bearer","not-before-policy":0,"session_state":"ccbf94e1-b3c1-4260-8ade-cb0d778b8235","scope":"profile email"}

Shell

curl -X POST -H "Authorization: Bearer *****" -d '{"isbn": 123456789123, "title": "Test Book 1", "synopsis": "This is test book 1", "authorname": "test-author1", "price": 10.39}' "http://$LB_IP/addbook"

     "isbn": 123456789123,

    "title": "Test Book 1",

    "synopsis": "This is test book 1",

    "authorname": "test-author1",

    "price": 10.39

}

As you can see, we are able to add books. Similarly, you can add books using a book-admin user.

The Issue With the Current Setup

In our current setup, both book-user and book-admin users are able to add books, but only book-admin should be allowed to add books. While book-user should only be allowed to view books and not be allowed to add books.

We can restrict access of a particular endpoint to a particular user/role by extracting the role from raw JWT claim data and using conditions in the authorization policy. Now let's see how we can control the finer-grained access using Istio authorization policies.

We will modify the authorization policy to allow only book-admin users to access /addbook endpoint and allow all users to access /getbooks endpoint.

Shell

kubectl apply -f - <<>

apiVersion: security.istio.io/v1beta1

 kind: AuthorizationPolicy

metadata:

   name: book-info-auth

 spec:

   selector:

     matchLabels:

       app: book-info

   rules:

  - to:

     - operation:

        methods: ["GET"]

        paths: ["/bookdetails"]

   - from:

     - source:

         requestPrincipals: ["*"]

     to:

     - operation:

         methods: ["GET"]

         paths: ["/getbooks", "/getbookbytitle*"]

  - from:

     - source:

         requestPrincipals: ["*"]

    to:

    - operation:

        methods: ["POST"]

        paths: ["/addbook*"]

    when:

    - key: request.auth.claims[realm_access][roles]

      values: ["admin"]

EOF

authorizationpolicy.security.istio.io/book-info-auth configured

Now we will try adding a new book with a book-user user.

Shell

curl -X POST -d "client_id=Istio" -d "username=book-user" -d "password=user123" -d "grant_type=password" "http://$Keycloak_IP:8080/realms/Istio/protocol/openid-connect/token"

{"access_token":"*****","expires_in":300,"refresh_expires_in":1800,"refresh_token":"*****","token_type":"Bearer","not-before-policy":0,"session_state":"9fb6bcc9-57b9-4eda-8052-71daeb887b92","scope":"profile email"}

Shell

curl -X POST -H "Authorization: Bearer *****" -d '{"isbn": 123456789125, "title": "Test Book 3", "synopsis": "This is test book 3", "authorname": "test-author3", "price": 10.39}' "http://$LB_IP/addbook”

RBAC: access denied

This time we are not allowed to add books using book-user since we have allowed only users with admin roles to add books.

Now we will check adding a book with the admin-user user.

Shell

curl -X POST -d "client_id=Istio" -d "username=book-admin" -d "password=admin123" -d "grant_type=password" "http://$Keycloak_IP:8080/realms/Istio/protocol/openid-connect/token"

{"access_token":"*****","expires_in":300,"refresh_expires_in":1800,"refresh_token":"*****","token_type":"Bearer","not-before-policy":0,"session_state":"a9d5398a-1e7d-4cbb-a4bf-8b7bdd70f75e","scope":"profile email"}

Shell

curl -X POST -H "Authorization: Bearer *****" -d '{"isbn": 123456789125, "title": "Test Book 3", "synopsis": "This is test book 3", "authorname": "test-author3", "price": 10.39}' "http://$LB_IP/addbook”

{

    "isbn": 123456789125,

    "title": "Test Book 3",

    "synopsis": "This is test book 3",

    "authorname": "test-author3",

    "price": 10.39

}

We can add books with a book-admin user since we allow only users with admin roles to add books, and we have already assigned a book-admin user an admin role in Keycloak. Also, both users can view the books since we have allowed anyone with a valid JWT token to access the /getbooks endpoint.

This Istio feature of request authentication and authorization, along with Keycloak, offers a fantastic request-level authentication and authorization mechanism for your application — which is missing in native Kubernetes.

Best Practices and Considerations for Request-Level Authentication and Authorization

Securing your application from unauthorized access is an essential requirement; however, implementing it requires substantial effort. If you are planning to do it, these best practices and considerations for request-level authentication and authorization would help you:

• Always secure endpoints in your application using SSL or TLS certificates. TLS secures your application by encrypting the messages in transit, as only the receiver has the key to decrypt it.
• Choose an authentication provider that suits your requirements, and always use OAuth2 with OpenID Connect for request-level authentication.
• Make sure you are using different permissions/roles for different API endpoints. You can create a set of permissions and roles in your authentication provider and use them for fine-grained access control of your application API endpoints.
• Decide when to use request-level authentication and authorization. You don’t need to authenticate and authorize each request. Your application may contain some API endpoints, which require public access, like /healthz or /ping or /public, so carefully choose which endpoints you want to protect.

Summary

Securing your applications by using proper authentication and authorization is an important task. During the application development phase, developers invest a good amount of time to build a good authentication and authorization mechanism for their application. However, using tools like Istio and Keycloak takes that burden out of the developer's shoulder, and this authentication and authorization mechanism can be configured at the infrastructure level.

In this blog post, we learned how Istio simplifies request-level authentication and authorization using Keycloak. However, things can be complex in the real world, where your application might have hundreds of services running in different clusters and accessed by thousands or millions of users. That’s it, folks! I hope you found this blog informative.

We Provide consulting, implementation, and management services on DevOps, DevSecOps, DataOps, Cloud, Automated Ops, Microservices, Infrastructure, and Security

Services offered by us: https://www.zippyops.com/services

Our Products: https://www.zippyops.com/products

Our Solutions: https://www.zippyops.com/solutions

For Demo, videos check out YouTube Playlist: https://www.youtube.com/watch?v=4FYvPooN_Tg&list=PLCJ3JpanNyCfXlHahZhYgJH9-rV6ouPro

If this seems interesting, please email us at [email protected] for a call.

Relevant Blogs: