SSO with OIDC or SAML Through Envoy and External Auth

The Honest Architecture

Plain Envoy is the central enforcement point. It is not usually the component that completes the full browser login protocol by itself. For OIDC or SAML, a browser is redirected to an identity provider or an auth service that knows how to speak the protocol. Envoy protects product routes and delegates the decision through ext_authz.

Browser Flow

1. User opens a product such as the data explorer.
2. Envoy sees no valid session or token.
3. Envoy calls the central auth service with request context.
4. The auth service starts OIDC or SAML login with the IdP.
5. After login, the user returns with a valid session or token.
6. Envoy allows the request and forwards trusted identity context to the product.

Envoy ext_authz Example

This example sends authorization decisions to a central service. That service can understand sessions, OIDC, SAML, groups, tenants, and product policy. Keep timeouts short because this service is on the request path.

http_filters:
- name: envoy.filters.http.ext_authz
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
    transport_api_version: V3
    grpc_service:
      envoy_grpc:
        cluster_name: central_authz_service
      timeout: 250ms
    include_peer_certificate: true
    failure_mode_allow: false
- name: envoy.filters.http.router
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

clusters:
- name: central_authz_service
  type: STRICT_DNS
  connect_timeout: 500ms
  http2_protocol_options: {}
  load_assignment:
    cluster_name: central_authz_service
    endpoints:
    - lb_endpoints:
      - endpoint:
          address:
            socket_address:
              address: authz.platform.svc.cluster.local
              port_value: 9000

OIDC vs SAML

What the Auth Service Decides

The auth service can say: allow, deny, redirect to login, or enrich the request with identity headers. It can also normalize groups from OIDC or SAML into platform roles such as viewer, operator, admin, or data-steward.