第18章：IDaaS 集成模式与实践 — 网关、BFF 与 Sidecar 架构模式 | IDaaS Book

# docker-compose.yaml
services:
  oauth2-proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5
    command:
      - --provider=oidc
      - --oidc-issuer-url=https://idp.example.com/realms/myrealm
      - --client-id=my-app
      - --client-secret=xxx
      - --cookie-secret=generate-a-random-secret
      - --upstream=http://my-app:8080
      - --http-address=0.0.0.0:4180
    ports:
      - "4180:4180"

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: myapp-oidc
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: myapp
  oidc:
    provider:
      issuer: "https://idp.example.com/realms/myrealm"
    clientID: "my-app"
    clientSecret:
      name: "myapp-oidc-secret"   # Secret 的密钥名必须是 client-secret
    redirectURL: "https://app.example.com/myapp/oauth2/callback"

// BFF 服务示例 (Node.js + Express)
app.get('/api/proxy/*', async (req, res) => {
  const accessToken = req.session.accessToken;
  
  if (!accessToken || isExpired(accessToken)) {
    const newToken = await refreshAccessToken(req.session.refreshToken);
    req.session.accessToken = newToken.access_token;
    req.session.refreshToken = newToken.refresh_token;
  }
  
  const backendPath = req.path.replace('/api/proxy', '');
  const response = await fetch(`https://backend-api${backendPath}`, {
    headers: { Authorization: `Bearer ${req.session.accessToken}` }
  });
  
  res.json(await response.json());
});

app.get('/callback', async (req, res) => {
  const { code } = req.query;
  const tokens = await exchangeCode(code, codeVerifier);
  req.session.accessToken = tokens.access_token;
  req.session.refreshToken = tokens.refresh_token;
  res.redirect('/');
});

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: jwt-auth
spec:
  selector:
    matchLabels:
      app: my-service
  jwtRules:
  - issuer: https://idp.example.com/realms/myrealm
    jwksUri: https://idp.example.com/realms/myrealm/protocol/openid-connect/certs
    forwardOriginalToken: true
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
spec:
  selector:
    matchLabels:
      app: my-service
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]
    to:
    - operation:
        methods: ["GET", "POST"]

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll()
                .requestMatchers("/admin/**").hasRole("admin")
                .anyRequest().authenticated()
            )
            .oauth2Login()
            .logout()
                .logoutSuccessUrl("/");
        return http.build();
    }
}