What happened?
I am using Pomerium to authenticate users to an application deployed in k8s cluster which doesn’t have Authentication support. We are using JumpCloud as SSO and following the example from the ArgoCD team I configured dex to talk to JumpCloud and Pomerium to receive the answer for authentication, something similar to FreeIPA with Dex | Pomerium, the difference being that we use JumpCloud and dex and Pomerium are being deployed to k8s cluster.
After successfully login in JumpCloud the page gets redirected to https://authenticate.myRootDomain/oauth2/callback and HTTP ERROR 405 appears.
What did you expect to happen?
I was expecting to be authorised or not into the page.
How’d it happen?
-
Navigated on https://myapp.myRootDomain
-
Page with Forbidden appears
-
Clicking on session details link gets you to JumpCloud login page(through dex), the login succeeds successfully.
-
After login you are being redirected to unsecure page https://authenticate.myRootDomain/oauth2/callback which is
-
Navigating at step 1 to https://myapp.myRootDomain/.pomerium/ skips you from step 2 and 3(forbidden part)
What’s your environment like?
- Chart version:latest
- Container image: v0.16.1
- Kubernetes version: 1.19
- Cloud provider: aws
- Other details:
Chart is being installed from pomerium-helm with default values except the following ones:
config:
rootDomain: myRootDomain
generateTLS: true
forceGenerateTLS: true
generateSigningKey: true
forceGenerateSigningKey: true
insecure: false
insecureProxy: false
authenticate:
idp:
provider: oidc
clientID: clientId
clientSecret: aaaaaaa
# (your dex url)
url: https://dex.myRootDomain
scopes: "openid,email"
ingress:
annotations:
cert-manager.io/cluster-issuer: letsencrypt
tls:
secretName: authenticate-myRootDomain-tls
ingressController:
enabled: true
## What's your config.yaml?
```config.yaml
autocert: false
dns_lookup_family: V4_ONLY
address: :443
grpc_address: :443
certificate_authority_file: "/pomerium/ca/ca.crt"
certificates:
authenticate_service_url: https://authenticate.myRootDomain
authorize_service_url: https://authorizeService.pomerium.svc.cluster.local
databroker_service_url: https://dataBrokerService.pomerium.svc.cluster.local
idp_provider: oidc
idp_scopes: openid email
idp_provider_url: https://dex.myRootDomain
idp_client_id: clientIdFromDex
idp_client_secret: clientSecretFromDex
routes:
What did you see in the logs?
Authenticate logs
{
"level":"info",
"syncer_id":"databroker",
"syncer_type":"type.googleapis.com/pomerium.config.Config",
"service":"authenticate",
"config_id":"ingress-controller",
"version":17,
"err_count":0,
"time":"2022-02-01T06:31:05Z",
"message":"set db config info"
}{
"level":"error",
"domain":"*",
"time":"2022-02-01T06:31:05Z",
"message":"cryptutil: no TLS certificate found for domain, using self-signed certificate"
}{
"level":"warn",
"syncer_id":"databroker",
"syncer_type":"type.googleapis.com/pomerium.config.Config",
"error":"invalid metrics address \"\": missing port in address",
"time":"2022-02-01T06:31:05Z",
"message":"metrics announce to service registry is disabled"
}{
"level":"info",
"syncer_id":"databroker",
"syncer_type":"type.googleapis.com/pomerium.config.Config",
"service":"authenticate",
"config":"databroker",
"checksum":"9c5ce85dbaf1b36",
"time":"2022-02-01T06:31:05Z",
"message":"config: updated config"
}{
"level":"info",
"syncer_id":"databroker",
"syncer_type":"type.googleapis.com/pomerium.config.Config",
"elapsed":225.302241,
"server_version":4077071779396492351,
"versions":[
17
],
"time":"2022-02-01T06:31:05Z",
"message":"UpdateRecords"
}{
"level":"info",
"service":"envoy",
"name":"upstream",
"time":"2022-02-01T06:31:05Z",
"message":"lds: add/update listener \\'https-ingress\\'"
}{
"level":"info",
"X-Forwarded-For":[
"10.20.1.44,10.20.1.5"
],
"X-Forwarded-Proto":[
"https"
],
"ip":"127.0.0.1",
"user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36",
"referer":"https://myApp.myRootDomain/",
"request-id":"203af9f2-24fe-4009-9a5e-0341ae04dc61",
"error":"Bad Request: internal/sessions: session is not found",
"time":"2022-02-01T06:35:29Z",
"message":"authenticate: session load error"
}{
"level":"info",
"service":"envoy",
"upstream-cluster":"pomerium-control-plane-http",
"method":"GET",
"authority":"authenticate.myRootDomain",
"path":"/.pomerium/",
"user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36",
"referer":"https://myApp.myRootDomain/",
"forwarded-for":"10.20.1.44,10.20.1.5",
"request-id":"203af9f2-24fe-4009-9a5e-0341ae04dc61",
"duration":69.204558,
"size":826,
"response-code":302,
"response-code-details":"via_upstream",
"time":"2022-02-01T06:35:29Z",
"message":"http-request"
}{
"level":"info",
"service":"envoy",
"upstream-cluster":"pomerium-control-plane-http",
"method":"POST",
"authority":"authenticate.myRootDomain",
"path":"/oauth2/callback",
"user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36",
"referer":"https://sso.jumpcloud.com/",
"forwarded-for":"10.20.1.44,10.20.1.5",
"request-id":"919e21aa-cd54-46d5-b429-96fcc3391dbf",
"duration":2.691711,
"size":0,
"response-code":405,
"response-code-details":"via_upstream",
"time":"2022-02-01T06:35:50Z",
"message":"http-request"
}
Authorizer logs:
{
"level":"warn",
"time":"2022-02-01T06:40:28Z",
"msg":"stapling OCSP",
"service":"autocert",
"error":"no OCSP stapling for [myRoorDomain authorize.myRootDomain authorizeService.pomerium.svc.cluster.local]: no OCSP server specified in certificate"
}{
"level":"info",
"service":"authorize",
"request-id":"69878def-f563-457e-b540-bf49ed90fd50",
"check-request-id":"93cb9c65-7fa4-445a-83d9-135103bda612",
"method":"GET",
"path":"/",
"host":"myApp.myRootDomain",
"query":"",
"allow":false,
"allow-why-false":[
"non-pomerium-route"
],
"deny":false,
"deny-why-false":[
"valid-client-certificate-or-none-required"
],
"user":"",
"email":"",
"databroker_server_version":4077071779396492351,
"databroker_record_version":27,
"time":"2022-02-01T06:42:11Z",
"message":"authorize check"
}{
"level":"info",
"service":"authorize",
"request-id":"5cac8c9a-0ac6-4c87-a34c-949cf1480e86",
"check-request-id":"d8fd3f06-e104-48cc-b6d5-fd215f020151",
"method":"GET",
"path":"/",
"host":"myApp.myRootDomain",
"query":"",
"allow":false,
"allow-why-false":[
"non-pomerium-route"
],
"deny":false,
"deny-why-false":[
"valid-client-certificate-or-none-required"
],
"user":"",
"email":"",
"databroker_server_version":4077071779396492351,
"databroker_record_version":27,
"time":"2022-02-01T06:42:44Z",
"message":"authorize check"
}{
"level":"info",
"service":"envoy",
"name":"main",
"time":"2022-02-01T06:45:29Z",
"message":"shutting down parent after drain"
}
Proxy logs
{
"level":"info",
"service":"envoy",
"upstream-cluster":"",
"method":"GET",
"authority":"myApp.myRootDomain",
"path":"/",
"user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36",
"referer":"",
"forwarded-for":"10.20.1.69",
"request-id":"d8fd3f06-e104-48cc-b6d5-fd215f020151",
"duration":4.911007,
"size":11832,
"response-code":403,
"response-code-details":"ext_authz_denied",
"time":"2022-02-01T06:42:44Z",
"message":"http-request"
}{
"level":"info",
"service":"envoy",
"upstream-cluster":"pomerium-pomerium-myAppDetails-pomerium-authenticate-authenticate-myRootDomainEscaped-7c9b38720e5aefc7",
"method":"GET",
"authority":"authenticate.myRootDomain",
"path":"/.pomerium/",
"user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36",
"referer":"https://myApp.myRootDomain/",
"forwarded-for":"10.20.3.11",
"request-id":"7ed0d674-55f4-4a30-839b-2953ff3b4487",
"duration":3.329464,
"size":742,
"response-code":302,
"response-code-details":"via_upstream",
"time":"2022-02-01T06:42:46Z",
"message":"http-request"
}{
"level":"info",
"service":"envoy",
"upstream-cluster":"pomerium-pomerium-myAppDetails-pomerium-authenticate-authenticate-myRootDomainEscaped-7c9b38720e5aefc7",
"method":"POST",
"authority":"authenticate.myRootDomain",
"path":"/oauth2/callback",
"user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36",
"referer":"https://sso.jumpcloud.com/",
"forwarded-for":"10.20.3.11",
"request-id":"845557fe-eb62-4b5d-8cf9-972a46da8e38",
"duration":11.615181,
"size":0,
"response-code":405,
"response-code-details":"via_upstream",
"time":"2022-02-01T06:43:03Z",
"message":"http-request"
}{
"level":"info",
"service":"envoy",
"name":"main",
"time":"2022-02-01T06:45:32Z",
"message":"shutting down parent after drain"
}
## Additional context
Add any other context about the problem here.
,
