0

As I am new to istio world. I am having difficulty understanding how that technology's auth system work.

Let's say, I have a project that has 8 pods(services). I understand that authentication and authorization are covered in Istio Gateway using jwt. So that every request is verified. But users with different roles ex: [teacher, student, staff] need to have an endpoint to signup/signin/logout with username and password. Is there a way that Istio Gateway handles user creation saving it to db and generating jwt? Or do I have to make another Pod(service) dedicated to Auth and generate jwt from this pod? If so, how can I still set up jwt verification right from the gateway?

Thank you for taking time and reading this)

Improve this question

1 Answer 1

Reset to default
2

I am not an expert (yet), but from what I understand, Istio allows you to check that someone (the principle of the call) is already authenticated/authorized.

But that actual authentication needs to have been done previously. You can use just about any Identity Provider to get the authentication done. Once done, the JWT from the authentication is added as a header to the call that goes to your cluster via Istio.

The RequestAuthentication and AuthorizationPolicy Istio resources can be setup to look at the JWT and validate that it is appropriately signed and that the needed claims are present. (And fail the call with a 401 or 403 if they are not.)

Improve this answer
2
  • I understand that I can use Identity Provider like OAuth or smth like that. But the requirement is that we should have our own database of users and be done manually without any providers. Users should be able to signup/signin/logout, the question is can we do that crud operations on users in Istio?
    – coolisuz
    Commented Jun 3, 2021 at 5:25
  • @SaidjamolIkramov - Sounds like your requirement is to "roll your own security". This is really NOT advisable, as so many mistakes can be made. If you are set on that path, then some frameworks (like .NET) have Basic Authentication support that can help get you past some of the pitfalls. But either way, Istio does not have any features to help with user management. It's only user level features are to validate a JWT's signing and the claims in the JWT.
    – Vaccano
    Commented Jun 3, 2021 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.