Source
r/aws•
rdkls

Kubernetes ALB Ingress Controller & OIDC from Google Workspaces

containers

I’m setting up ALB Ingress controller with OIDC Auth from Google Workspaces as IdP, using e.g.

auth-idp-oidc

annotation.

It’s working well, except I can’t see how to limit access to only my org’s domain; it seems any google account (e.g. my personal one) can auth and access since the issuer is just `https://accounts.google.com\`

Do I need to do this in GCP “Oauth consent screen” setting User Type = Internal?

This may not be an option for us, since we need public users to be able to auth, for public-facing app, but some internal services accessed only by staff (currently done with Google IAP)

The goal is replace functionality of GCP IAP. Perhaps I'll need to run a proxy container to perform the OIDC & validate claims?

Posted Aug 15, 2022, 10:56 AM UTC

23
AutoModeratorMOD•

Try this search for more information on this topic.

^Comments, ^questions ^or ^suggestions ^regarding ^this ^autoresponse? ^Please ^send ^them ^here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2
mariusmitrofan•

Not 100% sure, but I think you can limit the scope within your GCP project settings for the auth api.

If that's not the possibility, then you need to validate the claims.

2
earl_of_angus•

What I do for this is have two separate google cloud projects for auth - one that does oidc for domain users with internal = true and another for public / production traffic. I don't know ALB ingress well enough to know if that's possible to setup on a single controller or if you'd require two separate ALBs each controlling a separate class of ingress.

2