Add AuthN using opa-envoy plugin. (Using Envoy Ext Auth )

[vinaykonanki]

Hi, I’m planning to add AuthN using opa-envoy plugin. (Using Envoy Ext Auth )

Here is my setup:
Installed Envoy on Mac and configured with envoy-jwt.yaml (attached)
Created basic rego file called envoy.rego (attached)
Created config.yaml (attached) and started the opa-envoy docker image with the following configuration

❯ docker run -v $PWD:/policy -p 9191:8181 openpolicyagent/opa:latest-envoy \ run --server --log-level debug --config-file=/policy/config.yaml /policy

From POSTMAN, when I directly POST localhost:9191/v1/data/envoy/authz with bearer token as per https://play.openpolicyagent.org/p/glYw20NVU5 the policy is evaluating correctly and returning expected results.

But when I do curl Enovy http://localhost:10000/ with bearer token. It is returning 403 reason is that the policy is not getting evaluated correctly. Looking at the output log on the OPA

{"client_addr":"172.17.0.1:58676","level":"info","msg":"Received request.","req_body":"\u0000\u0000\u0000\u0004\ufffd\n\ufffd\t\n\u0013\n\u0011\n\u000f\u0012\t127.0.0.1\u0018\ufffd\ufffd\u0003\u0012\u0012\n\u0010\n\u000e\u0012\t127.0.0.1\u0018\ufffdN\"\ufffd\t\n\u000c\u0008\ufffd\ufffd\ufffd\ufffd\u0006\u0010\ufffdű\ufffd\u0002\u0012\ufffd\u0008\n\u001415697976258520025584\u0012\u0003GET\u001a\u000f\n\u0007:scheme\u0012\u0004http\u001a5\n\rpostman-token\u0012$f499a4ff-1d17-42a6-aec6-49b98a86cebb\u001a#\n\nuser-agent\u0012\u0015PostmanRuntime/7.28.4\u001a\u001d\n\n:authority\u0012\u000flocalhost:10000\u001a\r\n\u0006accept\u0012\u0003*/*\u001a4\n\u000cx-request-id\u0012$34d60fc4-d516-4c08-ba58-79e1d29d5a33\u001a\u000e\n\u0007:method\u0012\u0003GET\u001a\ufffd\u0005\n\rauthorization\u0012\ufffd\u0005Bearer eeyJhbGciOiJSUzI1NiJ9.XBhbnlfbmFtZSI6IlZNd2FyZSwgSW5jLiIsImNsaWVudF9pZCI6ImVzcC1hcGktdG9rZW4iLCJ0b2tlbl9uYW1lIjoicnVud2F5IiwiaWF0IjoxNjMyMDc3MzQzLCJleHAiOjE2MzIwNzkxNDN9.K9bBCHGkRnrlQGhP0ZT2fIqxxSLQVeWiLgbUeIQxaI2n8k_cPD5lAkxZUekg4hPvwcI26WO2kkTD0PmoA5bmrD7CNUs0_FhlC_jOGnXjysQrbZ9g0GOxkYOiaqDMYw_N5j6NAulsl0P25TRTJ3JxO_rSoMAgzpsjYxrKZYQCtbUZJAue2tGwp9PT0T1bt85aPxfM2obYXCs7W0nJdAkz9zxmG-Ck-RhmkZpTANFKjIFQ7TaFBd5kugeYbrfpTT9TEMbRmgFKE1Wj4eWMMVxttV89inNdD5ErzsQulFJ9Z1i2oafEiE2SJva5NEDxSMJHlkKDcg0aY1vKaiTZC9kfPw \u001a\n\n\u0005:path\u0012\u0001/\u001a\u0019\n\u0011x-forwarded-proto\u0012\u0004http\u001a\u0019\n\rcache-control\u0012\u0008no-cache\u001a$\n\u000faccept-encoding\u0012\u0011gzip, deflate, br\"\u0001/*\u000flocalhost:100002\u0004httpR\u0008HTTP/1.1Z\u0000","req_id":1,"req_method":"POST","req_params":{},"req_path":"/envoy.service.auth.v3.Authorization/Check","time":"2021-09-19T18:53:48Z"} {"client_addr":"172.17.0.1:58676","level":"info","msg":"Sent response.","req_id":1,"req_method":"POST","req_path":"/envoy.service.auth.v3.Authorization/Check","resp_body":"404 page not found\n","resp_bytes":19,"resp_duration":0.355398,"resp_status":404,"time":"2021-09-19T18:53:48Z"}

Questions:

1. Not sure why the input is not coming in the format as provided in the playground example.
2. If you see, the response the req_path is /envoy.service.auth.v3.Authorization/Check which obviously returns 404 as its an invalid url for OPA. Why is it not going to /envoy/authn/allow as mentioned in config.yaml
3. Is there any config that I need to take care of so that the envoy will send the input that is expected and pointing to the correct req_path

Slack Discussion: https://openpolicyagent.slack.com/archives/C7Y04PF50/p1632079303030900

[vinaykonanki]

Thanks Stephan Renatus for the help. I was able to successfully set up opa-envoy plugin using V3 API.

envoy-config.yaml

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 10000
    filter_chains:
      - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: service
              codec_type: AUTO
              route_config:
                virtual_hosts:
                - name: all_domains
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      cluster: service
              http_filters:
              - name: envoy.filters.http.ext_authz
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
                  transport_api_version: V3
                  failure_mode_allow: false
                  grpc_service:
                    envoy_grpc:
                      cluster_name: opa-envoy
                    timeout: 0.5s
                  with_request_body:
                    allow_partial_message: true
                    max_request_bytes: 8192
                    pack_as_bytes: true
              - name: envoy.filters.http.router
  clusters:
    - name: opa-envoy
      # This timeout controls the initial TCP handshake timeout - not the timeout for the
      # entire request.
      connect_timeout: 1.25s
      type: LOGICAL_DNS
      lb_policy: ROUND_ROBIN
      http2_protocol_options: {}
      load_assignment:
        cluster_name: opa-envoy
        endpoints:
        - lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: 127.0.0.1
                  port_value: 9191
    - name: service
      connect_timeout: 5s
      load_assignment:
        cluster_name: service
        endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: 127.0.0.1
                    port_value: 5000
admin:
  access_log_path: "/dev/null"
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 8001

OPA-config.yaml

services:
  - name: controller
    url: https://www.openpolicyagent.org
# bundles:
#   envoy/authz:
#     service: controller
plugins:
  envoy_ext_authz_grpc:
    addr: :9191
    path: envoy/authz/allow
    dry-run: false
    enable-reflection: true

Running OPA Docker image as follows

❯ docker run -v $PWD:/policy  -p 8081:8181 -p 9191:9191 openpolicyagent/opa:latest-envoy \  
    run --server --log-level debug --config-file=/policy/OPA-config.yaml /policy

[ashutosh-narkar]

When you run the opa-envoy plugin you can interact with the server using the grpcurl tool. For example:

 $ grpcurl -plaintext -d '
  {
    "attributes": {
      "request": {
        "http": {
          "method": "GET",
          "path": "/api/v1/products"
        }
      }
    }
  }' localhost:9191 envoy.service.auth.v3.Authorization/Check