kiali: kiali header strategy not working as expected
Hi, we integrated kiali with keycloak and reverse proxy that we have using the header strategy implementation guide. We made the ingress pointing to kiali UI to go through our reverse proxy where we validate the Authorization header and then redirect the request to kiali-server after adding proper impersonation headers as mentioned in the guide.
But it was observed that every time we open kiali, it shows a Login to Kiali screen momentarily and sends an /kiali/api/authenticate request with an Authorization header that contains username, password and token as blank. Now since our reverse proxy expects valid values for the header, we had to add logic to handle this special case but that does not seem like a cleaner approach.
We looked at kiali code and found that the kiali-ui sends this request for both anonymous and header strategy (link) and there was no way to bypass that.
In our opinion, since it is the reverse proxy which is responsible for Authn and Authz in case of header strategy, showing the Login to Kiali screen and sending the /api/authenticate request from Kiali UI seems an unnecessary step.
Can you please help us mitigate this?
About this issue
- Original URL
- State: open
- Created 3 years ago
- Comments: 17 (6 by maintainers)
Guys, we appreciate both of you contributing to the thread here and trying to resolve the issue.