Support BasicAuth and KeyAuth based authentication

[saltbo]

Description:

Support BasicAuth and KeyAuth based authentication

[optional Relevant Links:]

envoyproxy/envoy#15365

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[arkodg]

thinking out loud

• the user could represent the username password in the format used by htpasswd
  https://httpd.apache.org/docs/2.4/programs/htpasswd.html
• which can be stored in a k8s secret
• we could use SDS to pass this info over to Envoy
  https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/secret.proto#secrets-configuration-proto
• last step in Envoy involves allowing the request if the Authorization header matches with one of the user:passwd entries, @zhaohuabing @cpakulski any idea how we can achieve this one ?

and something similar could be done for API Key as well

[zhaohuabing]

@arkodg AFAIK, Envoy doesn't have built-in BasicAuth or API key support. But it may be accomplished by extensions such as lua, wasm, or External Authorization.

[zhaohuabing]

Basic Auth has been merged into Envoy. envoyproxy/envoy#30079. I plan to add it to the SecurityPolicy in the next release.

[arkodg]

@zhaohuabing can we reuse the same Envoy Filter for API key auth ?

[zhaohuabing]

@zhaohuabing can we reuse the same Envoy Filter for API key auth ?

The problem is, unlike HTTP Basic Auth, API key auth is much more flexible, the key can be in the header, path, or even body. I think we will need a dedicated envoy filter in Envoy if we want to support API key auth, we can follow the open API specs: https://swagger.io/docs/specification/authentication/api-keys/#:~:text=API%20keys%20are%20supposed%20to,mechanisms%20such%20as%20HTTPS%2FSSL.

[arkodg]

yeah nice, it would look a lot like from_headers in https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/jwt_authn/v3/config.proto#extensions-filters-http-jwt-authn-v3-jwtprovider