Traefik Forward Auth
Yet another minimal modification of a great minimal forward authentication service that provides OAuth/SSO login and authentication for the traefik reverse proxy/load balancer.
Why?
The original traefik-forward-auth provides the forwarding of authentication between an Identity Provider like keycloak and the ForwardAuth middleware of traefik.
The modification of this project is to add minimal authorization functionality. The traefik-forward-auth is configured with a REQUIRED_ROLE and access to the resource is only granted if the access token issued by the Identity Provider contains a claim with that particular role.
Configuration
... of traefik-forward-auth
In the examples directory the ymls to deploy a whoami service (at GitHub, at Docker Hub) and the related ymls to deploy and configure the traefik-forward-auth service.
The only relevant modification to the original advanced separate pod example is the configuration parameter REQUIRED_ROLE.
... of the Identity Provider
Copyright
2018 Thom Seddon 2023 Wolfgang Hottgenroth