Answers: <p>I am not an expert (yet), but from what I understand, Istio allows you to check that someone (the principle of the call) is already authenticated/authorized.</p>
  <p>But that actual authentication needs to have been done previously.  You can use just about any Identity Provider to get the authentication done.  Once done, the JWT from the authentication is added as a header to the call that goes to your cluster via Istio.</p>
  <p>The <code>RequestAuthentication</code> and <code>AuthorizationPolicy</code> Istio resources can be setup to look at the JWT and validate that it is appropriately signed and that the needed claims are present.  (And fail the call with a 401 or 403 if they are not.)</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-06-03T05:25:35.657Z
Answers: I understand that I can use Identity Provider like OAuth or smth like that. But the requirement is that we should have our own database of users and be done manually without any providers. Users should be able to signup/signin/logout, the question is can we do that crud operations on users in Istio?
Answers: coolisuz
Answers: CC BY-SA 4.0
Answers: 2021-06-03T17:26:27.277Z
Answers: @SaidjamolIkramov - Sounds like your requirement is to "roll your own security".  This is really NOT advisable, as so many mistakes can be made.  If you are set on that path, then some frameworks (like .NET) have Basic Authentication support that can help get you past some of the pitfalls.  But either way, Istio does not have any features to help with user management.  It's only user level features are to validate a JWT's signing and the claims in the JWT.
Answers: Vaccano
Answers: CC BY-SA 4.0
Answers: 2021-06-02T18:25:59.137Z
Answers: 2021-06-02T18:25:59.137Z
Answers: Vaccano
Body: <p>As I am new to istio world. I am having difficulty understanding how that technology's auth system work.</p>
  <p>Let's say, I have a project that has 8 pods(services). I understand that authentication and authorization are covered in Istio Gateway using jwt. So that every request is verified. But users with different roles ex: [teacher, student, staff] need to have an endpoint to signup/signin/logout with username and password. Is there a way that Istio Gateway handles user creation saving it to db and generating jwt? Or do I have to make another Pod(service) dedicated to Auth and generate jwt from this pod? If so, how can I still set up jwt verification right from the gateway?</p>
  <p>Thank you for taking time and reading this)</p>
  
Tags: <docker><kubernetes><istio>
Title: How to setup custom authentication and authorization in Istio/K8?
UserDisplayName: coolisuz
ThreadText: # How to setup custom authentication and authorization in Istio/K8?
  
  (Asked by: username_0 on 2021-06-02)
  
  As I am new to istio world. I am having difficulty understanding how that technology's auth system work.
  
  Let's say, I have a project that has 8 pods(services). I understand that authentication and authorization are covered in Istio Gateway using jwt. So that every request is verified. But users with different roles ex: [teacher, student, staff] need to have an endpoint to signup/signin/logout with username and password. Is there a way that Istio Gateway handles user creation saving it to db and generating jwt? Or do I have to make another Pod(service) dedicated to Auth and generate jwt from this pod? If so, how can I still set up jwt verification right from the gateway?
  
  Thank you for taking time and reading this)
  
  **Tags:** docker, kubernetes, istio
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-06-02. Score: 2
  
  I am not an expert (yet), but from what I understand, Istio allows you to check that someone (the principle of the call) is already authenticated/authorized.
  
  But that actual authentication needs to have been done previously. You can use just about any Identity Provider to get the authentication done. Once done, the JWT from the authentication is added as a header to the call that goes to your cluster via Istio.
  
  The `RequestAuthentication` and `AuthorizationPolicy` Istio resources can be setup to look at the JWT and validate that it is appropriately signed and that the needed claims are present. (And fail the call with a 401 or 403 if they are not.)
  
  > **Comments:**
  > **username_0**: I understand that I can use Identity Provider like OAuth or smth like that. But the requirement is that we should have our own database of users and be done manually without any providers. Users should be able to signup/signin/logout, the question is can we do that crud operations on users in Istio?  
  > **username_1**: @SaidjamolIkramov - Sounds like your requirement is to "roll your own security".  This is really NOT advisable, as so many mistakes can be made.  If you are set on that path, then some frameworks (like .NET) have Basic Authentication support that can help get you past some of the pitfalls.  But either way, Istio does not have any features to help with user management.  It's only user level features are to validate a JWT's signing and the claims in the JWT.  
  
  ---
  
  