Solo external auth service — plugin chain & AuthConfig

apiVersion: extauth.solo.io/v1
kind: AuthConfig
metadata:
  name: oidc-login
  namespace: gloo-system
spec:
  configs:
  - oauth2:
      oidcAuthorizationCode:
        appUrl: https://app.example.com
        callbackPath: /callback
        clientId: my-app
        clientSecretRef:
          name: oidc-client-secret
          namespace: gloo-system
        issuerUrl: https://login.example.com/
        scopes:
        - openid
        - profile
        - email
        session:
          redis:
            cookieName: session
            options:
              host: redis.gloo-system.svc:6379

apiVersion: extauth.solo.io/v1
kind: AuthConfig
metadata:
  name: token-introspection
  namespace: gloo-system
spec:
  configs:
  - name: oauth
    oauth2:
      accessTokenValidation:
        introspection:
          introspectionUrl: https://idp.example.com/oauth2/introspect
          clientId: gateway
          clientSecretRef:
            name: idp-client-secret
            namespace: gloo-system
        cacheTimeout: 10m
        userIdAttributeName: sub

apiVersion: extauth.solo.io/v1
kind: AuthConfig
metadata:
  name: jwt-verify
  namespace: gloo-system
spec:
  configs:
  - name: jwt
    oauth2:
      accessTokenValidation:
        jwt:
          remoteJwks:
            url: https://idp.example.com/.well-known/jwks.json
            refreshInterval: 1h
          issuer: https://idp.example.com/
          audiences:
          - mcp-gateway
          claimsToHeaders:
          - claim: sub
            header: x-user-id
          - claim: tenant
            header: x-tenant

apiVersion: extauth.solo.io/v1
kind: AuthConfig
metadata:
  name: opa-allow
  namespace: gloo-system
spec:
  configs:
  - name: opa
    opaAuth:
      modules:
      - name: policy
        namespace: gloo-system
      query: "data.mcp.allow == true"

The referenced ConfigMap holds the Rego under a policy.rego key — see §4 for the full sample.

Use-case: you already run OPA with a bundle server (Styra DAS, an S3 bundle, an internal control plane) and want ext-auth-service to delegate the decision rather than embed the Rego itself. The in-process opaAuth above is the right call if you don't already have OPA infrastructure — it removes a hop.

Exact field shape (server URL, package, query) varies by version — see the Solo OPA AuthConfig docs for the schema that ships with your install.

apiVersion: extauth.solo.io/v1
kind: AuthConfig
metadata:
  name: api-key
  namespace: gloo-system
spec:
  configs:
  - apiKeyAuth:
      headerName: x-api-key
      labelSelector:
        team: platform
---
apiVersion: v1
kind: Secret
type: extauth.solo.io/apikey
metadata:
  name: customer-a-key
  namespace: gloo-system
  labels:
    team: platform
data:
  api-key: <base64-of-key>

apiVersion: extauth.solo.io/v1
kind: AuthConfig
metadata:
  name: basic
  namespace: gloo-system
spec:
  configs:
  - basicAuth:
      realm: gateway
      apr:
        users:
          alice:
            salt: TYiryv0/
            hashedPassword: 8BvzLUO9IfGPGGsPnAgSu1

apiVersion: extauth.solo.io/v1
kind: AuthConfig
metadata:
  name: ldap
  namespace: gloo-system
spec:
  configs:
  - ldap:
      address: "ldap://ldap.default.svc.cluster.local:389"
      userDnTemplate: "uid=%s,ou=people,dc=solo,dc=io"
      membershipAttributeName: "memberOf"
      allowedGroups:
      - "cn=managers,ou=groups,dc=solo,dc=io"
      - "cn=developers,ou=groups,dc=solo,dc=io"
      searchFilter: "(objectClass=*)"
      disableGroupChecking: false
      groupLookupSettings:
        checkGroupsWithServiceAccount: true
        credentialsSecretRef:
          name: ldapcredentials
          namespace: gloo-system

apiVersion: extauth.solo.io/v1
kind: AuthConfig
metadata:
  name: hmac
  namespace: gloo-system
spec:
  configs:
  - hmacAuth:
      secretRefs:
        secretRefs:
        - name: hmac-shared-secret
          namespace: gloo-system
      parametersInHeaders: {}        # selects the HeaderConfig variant
---
apiVersion: v1
kind: Secret
type: extauth.solo.io/hmac
metadata:
  name: hmac-shared-secret
  namespace: gloo-system
stringData:
  username: caller-a
  password: <shared-secret>

apiVersion: extauth.solo.io/v1
kind: AuthConfig
metadata:
  name: custom-grpc
  namespace: gloo-system
spec:
  configs:
  - passThroughAuth:
      grpc:
        address: my-authz.svc.cluster.local:9001
        connectionTimeout: 5s

Pick this when you're running the Solo developer portal and want ext-auth-service to honour portal-managed subscriptions (per-app keys, per-plan rate limits, lifecycle events from the portal). For plain API-key auth without the portal, use apiKeyAuth above.

Wired up by the dev-portal install — see the Solo developer portal docs for the schema and lifecycle.