User Account and Authentication Service (UAA)

IMPORTANT: Ambassador Edge Stack requires the IdP to return a JWT signed by the RS256 algorithm (asymmetric key). Cloud Foundry's UAA defaults to symmetric key encryption which Ambassador Edge Stack cannot read.

  1. When configuring UAA, you will need to provide your own asymmetric key in a file called uaa.yml. For example:

    jwt:
    token:
    signing-key: |
    -----BEGIN RSA PRIVATE KEY-----
    MIIEpAIBAAKCAQEA7Z1HBM6QFqnIJ1UA3NWnYMuubt4XlfbP1/GopTWUmchKataM
    ...
    ...
    QSbJdIbUBwL8BcrfNw4ebp1DgTI9F45Re+evky0A82aL0/BvBHu8og==
    -----END RSA PRIVATE KEY-----
  2. Create an OIDC Client:

    uaac client add ambassador --name ambassador-client --scope openid --authorized_grant_types authorization_code,refresh_token --redirect_uri {AMBASSADOR_URL}/.ambassador/oauth2/redirection-endpoint --secret CLIENT_SECRET

    Note: Change the value of {AMBASSADOR_URL} with the IP or DNS of your Ambassador load balancer.

Configure Filter and FilterPolicy

Configure your OAuth Filter and FilterPolicy with the following:

Use the clientID (ambassador) and secret (CLIENT_SECRET) from Step 2 to configure the OAuth Filter.

---
apiVersion: getambassador.io/v2
kind: Filter
metadata:
name: uaa_filter
namespace: default
spec:
OAuth2:
authorizationURL: {UAA_DOMAIN}
audience: {UAA_DOMAIN}
clientID: ambassador
secret: CLIENT_SECRET
protectedOrigins:
- origin: https://datawire-ambassador.com

Note: The authorizationURL and audience are the same for UAA configuration.

---
apiVersion: getambassador.io/v2
kind: FilterPolicy
metadata:
name: httpbin-policy
namespace: default
spec:
rules:
- host: "*"
path: /httpbin/ip
filters:
- name: uaa_filter ## Enter the Filter name from above
arguments:
scopes:
- "openid"

Note: The scopes field was set when creating the client in Step 2. You can add any scopes you would like when creating the client.

Questions?

We’re here to help. If you have questions, join our Slack or contact us.