From 386a5275797c393787e5075432d7b55cb04fe36d Mon Sep 17 00:00:00 2001 From: Gopika Bhardwaj Date: Mon, 4 May 2026 08:49:09 -0700 Subject: [PATCH] Adding SSO --- deploy/kubernetes/ingress.yaml | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/deploy/kubernetes/ingress.yaml b/deploy/kubernetes/ingress.yaml index 6c3e17e..44e0262 100644 --- a/deploy/kubernetes/ingress.yaml +++ b/deploy/kubernetes/ingress.yaml @@ -3,17 +3,25 @@ kind: Ingress metadata: name: lume-visualizations annotations: - nginx.ingress.kubernetes.io/whitelist-source-range: "71.198.255.25,134.79.0.0/16,172.16.0.0/12,208.45.173.162,216.46.165.69,172.27.8.0/24" + # Vouch Proxy authentication + nginx.ingress.kubernetes.io/auth-signin: "https://vouch.slac.stanford.edu/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err" + nginx.ingress.kubernetes.io/auth-url: https://vouch.slac.stanford.edu/validate + nginx.ingress.kubernetes.io/auth-response-headers: 'X-Vouch-User, X-Vouch-Idp-Claims-Name, X-Vouch-IdP-AccessToken, X-Vouch-IdP-RefreshToken, X-Vouch-IdP-IdToken, X-Vouch-Token' + nginx.ingress.kubernetes.io/auth-snippet: | + auth_request_set $auth_resp_jwt $upstream_http_x_vouch_IdToken; + auth_request_set $auth_resp_err $upstream_http_x_vouch_err; + auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount; + nginx.ingress.kubernetes.io/configuration-snippet: | + proxy_set_header Remote-Name $http_x_vouch_idp_claims_name; + proxy_set_header Remote-User $http_x_vouch_idp_claims_name; + + #nginx.ingress.kubernetes.io/whitelist-source-range: "71.198.255.25,134.79.0.0/16,172.16.0.0/12,208.45.173.162,216.46.165.69,172.27.8.0/24" nginx.ingress.kubernetes.io/proxy-body-size: 2g nginx.ingress.kubernetes.io/client-max-body-size: 2g nginx.ingress.kubernetes.io/proxy-read-timeout: "3900" nginx.ingress.kubernetes.io/proxy-send-timeout: "3900" nginx.ingress.kubernetes.io/proxy-request-buffering: "off" - # WebSocket support: nginx-ingress handles Upgrade/Connection headers - # automatically via its built-in $http_upgrade / $connection_upgrade map. - # Routing: per-worker paths (/live-monitor/wN) go directly to each - # worker pod. The base path (/live-monitor) goes to the allocator which - # redirects to an available worker. + spec: ingressClassName: nginx rules: