external-auth with oauth2-proxy stopped working

[krogon-dp]

Introduced with this change #1189 in version nginx 0.9-beta.12 breaks oauth2-proxy external authentication feature (https://github.com/kubernetes/ingress/tree/master/examples/auth/external-auth/nginx).

OAuth2-proxy after successfull authorization redirects again to login page. Details in below issue from their project: bitly/oauth2_proxy#456

[aledbf]

@krogon-dp please test quay.io/aledbf/nginx-ingress-controller:0.236

[fengmao]

same problem here, and quay.io/aledbf/nginx-ingress-controller:0.236 fails with error unknown flag: --nginx-configmap

[aledbf]

@fengmao that flag is deprecated. Please use --configmap

[fengmao]

use helm, it seems need to change helm's nginx-ingress template file, thanks

[fengmao]

@aledbf changed image to quay.io/aledbf/nginx-ingress-controller:0.236 and fix nginx-configmap with --configmap, but get this error

-------------------------------------------------------------------------------
W0930 00:51:45.916212      13 queue.go:113] requeuing default/oauth2-proxy, err
-------------------------------------------------------------------------------
Error: exit status 1
2017/09/30 00:51:45 [emerg] 49#49: unknown "location" variable
nginx: [emerg] unknown "location" variable
nginx: configuration file /tmp/nginx-cfg456472324 test failed

-------------------------------------------------------------------------------

[kinghrothgar]

I am currently having this issue using quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.10.1 and an image using the latest release of oauth2_proxy (v2.2).

My ingress annotations for the service I am trying to auth:

    nginx.ingress.kubernetes.io/auth-signin: https://hello.levenlabs.com/oauth2/sign_in
    nginx.ingress.kubernetes.io/auth-url: http://hello-oauth2-proxy.production.svc.cluster.local:4180/oauth2/auth

I tried to follow the conversation here bitly/oauth2_proxy#456, but all the oauth2_proxy PRs I can find connected this issue (which there are many....) are either closed or still open. Any pointers on how to fix this issue?

[aledbf]

@kinghrothgar this works fine if the auth-signin and auth-url are on the same host than the ingress rule.

[kinghrothgar]

That's the first thing I tried. That is broken because ingress-nginx tries to use an IPv6 address which doesn't work on GCE:

72.196.96.97 - [72.196.96.97] - - [25/Jan/2018:00:01:51 +0000] "GET / HTTP/1.1" 403 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36" 0 0.065 [external-authentication] 104.27.183.226:443 0 0.064 403
72.196.96.97 - [72.196.96.97] - - [25/Jan/2018:00:01:51 +0000] "GET / HTTP/1.1" 403 197 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36" 751 0.065 [external-authentication] - - - -
2018/01/25 00:01:51 [error] 62#62: *3558 connect() to [2400:cb00:2048:1::681b:b6e2]:443 failed (101: Network is unreachable) while connecting to upstream, client: 72.196.96.97, server: hello.levenlabs.com, request: "GET /favicon.ico HTTP/1.1", subrequest: "/_external-auth-Lw", upstream: "https://[2400:cb00:2048:1::681b:b6e2]:443/oauth2/auth", host: "hello.levenlabs.com", referrer: "https://hello.levenlabs.com/"
2018/01/25 00:01:51 [warn] 62#62: *3558 upstream server temporarily disabled while connecting to upstream, client: 72.196.96.97, server: hello.levenlabs.com, request: "GET /favicon.ico HTTP/1.1", subrequest: "/_external-auth-Lw", upstream: "https://[2400:cb00:2048:1::681b:b6e2]:443/oauth2/auth", host: "hello.levenlabs.com", referrer: "https://hello.levenlabs.com/"
72.196.96.97 - [72.196.96.97] - - [25/Jan/2018:00:01:51 +0000] "GET /favicon.ico HTTP/1.1" 403 0 "https://hello.levenlabs.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36" 0 0.073 [external-authentication] [2400:cb00:2048:1::681b:b6e2]:443, 104.27.182.226:443 0, 0 0.000, 0.073 502, 403
72.196.96.97 - [72.196.96.97] - - [25/Jan/2018:00:01:51 +0000] "GET /favicon.ico HTTP/1.1" 403 197 "https://hello.levenlabs.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36" 697 0.073 [external-authentication] - - - -