User guide: Anonymous access
Bypass identity verification or fall back to anonymous access when credentials fail to validate
Authorino features in this guide:
For further details about Authorino features in general, check the [docs](./../features.md).
- Identity verification & authentication → Anonymous access
- Kubernetes server
Create a containerized Kubernetes server locally using Kind:
1. Install the Authorino Operator
2. Deploy the Talker API
The Talker API is just an echo API, included in the Authorino examples. We will use it in this guide as the service to be protected with Authorino.
3. Deploy Authorino
The command above will deploy Authorino as a separate service (as opposed to a sidecar of the protected API and other architectures), in
namespaced reconciliation mode, and with TLS termination disabled. For other variants and deployment options, check out the Getting Started section of the docs, the Architecture page, and the spec for the
Authorino CRD in the Authorino Operator repo.
4. Setup Envoy
The following bundle from the Authorino examples (manifest referred in the command below) is to apply Envoy configuration and deploy Envoy proxy, that wire up the Talker API behind the reverse-proxy and external authorization with the Authorino instance.
For details and instructions to setup Envoy manually, see Protect a service > Setup Envoy in the Getting Started page. For a simpler and straightforward way to manage an API, without having to manually install or configure Envoy and Authorino, check out Kuadrant.
The bundle also creates an
Ingress with host name
talker-api-authorino.127.0.0.1.nip.io, but if you are using a local Kubernetes cluster created with Kind, you need to forward requests on port 8000 to inside the cluster in order to actually reach the Envoy service:
5. Create the
The example above enables anonymous access (i.e. removes authentication), without adding any extra layer of protection to the API. This is virtually equivalent to setting a top-level condition to the
AuthConfig that always skips the configuration, or to switching authentication/authorization off completely in the route to the API.
For more sophisticated use cases of anonymous access with Authorino, consider combining this feature with other identity sources in the
AuthConfig while playing with the priorities of each source, as well as combination with
when conditions, and/or adding authorization policies that either cover authentication or address anonymous access with proper rules (e.g. enforcing read-only access).
Check out the docs for the Anonymous access feature for an example of an
AuthConfig that falls back to anonymous access when a priority OIDC/JWT-based authentication fails, and enforces a read-only policy in such cases.
6. Consume the API
If you have started a Kubernetes cluster locally with Kind to try this user guide, delete it by running:
Otherwise, delete the resources created in each step:
kubectl delete authconfig/talker-api-protection kubectl delete authorino/authorino kubectl delete -f https://raw.githubusercontent.com/kuadrant/authorino-examples/main/envoy/envoy-notls-deploy.yaml kubectl delete -f https://raw.githubusercontent.com/kuadrant/authorino-examples/main/talker-api/talker-api-deploy.yaml
To uninstall the Authorino Operator and manifests (CRDs, RBAC, etc), run: