How to keep Authentication header with redirect using NGINX ingress annotations

Question

I have an nginx ingress controller for my kubernetes cluster. I have a need to add a permanent redirect to an ingress which I can successfully do with

nginx.ingress.kubernetes.io/permanent-redirect: "http://www.example.com"

This works great, except for the fact that path I'm redirecting is used for by users that send POST requests including an Authorization header.

My understanding is that by default (for security reasons) the header would get stripped out. However, I'm redirecting the post request from one server to another on the same domain.

Is there a way to add the necessary instructions to pass the Authorization header along with the redirect?

Thanks!

Answer 1

This is what I did to overcome the stripping of the Authorization header:

annotations:
  ... your other annotations
  nginx.ingress.kubernetes.io/configuration-snippet: |
    proxy_set_header Authorization $http_authorization;

This will force the setting of a new Authorization header that reads it's value from the actual authorization header.

I have not tried this with the external authorization though, only with basic auth.

Answer 2

You can use external authentication to point your original url as an auth-url

annotations:
    nginx.ingress.kubernetes.io/auth-url: https://original/user/passwd

Also take a look at this example

Hope this will help

Answer 3

Setting nginx.ingress.kubernetes.io/auth-response-headers annotation worked for me

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-response-headers: >-
      X-Auth-Request-Email,X-Auth-Request-Preferred-,X-Auth-Request-Access-Token,
      X-Auth-Request-Roles,X-Auth-Request-User,X-Auth-Request-Groups,X-Forwarded-Groups,
      Authorization
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    #nginx.ingress.kubernetes.io/auth-cache-key: $remote_user$http_authorization
    ingress.kubernetes.io/configuration-snippet: |
      auth_request_set $token $upstream_http_authorization;
      proxy_set_header Authorization $token;
      proxy_pass_header Authorization;
  name: external-auth-oauth2
  namespace: kubernetes-dashboard
spec:
  ingressClassName: nginx
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: kubernetes-dashboard
                port:
                  number: 443