CodersSecret

Course guide

SSO with Envoy for Kubernetes Products

Understand how SSO works for Kubernetes products behind Envoy using OIDC or SAML through an IdP and external authorization service.

Plain Envoy can be the enforcement point for browser products, while an identity provider and auth service handle OIDC or SAML login flows. This course teaches the request flow, redirect behavior, sessions, trusted identity headers, and production failure modes.

Learning path

Continue from concept to implementation

These course modules place this topic in context, connect it to adjacent decisions, and provide the practical next step.

Module 4

JWT and JWKS Validation at Envoy

Use Envoy jwt_authn to verify signed tokens before requests reach product APIs.

95 minutes | 4 learning objectives

Module 5

SSO with OIDC or SAML Through Envoy and External Auth

Use Envoy as the enforcement point while an IdP and auth service handle login protocol details.

105 minutes | 4 learning objectives

Module 6

Access Tokens, Service Tokens, and Federated Credentials

Handle humans, services, jobs, and cloud/data-platform access without treating every token the same.

100 minutes | 4 learning objectives

Practical outcomes

What the recommended module teaches

  • Explain why Envoy is not the full identity provider
  • Design an SSO flow for browser products behind Envoy
  • Use ext_authz to delegate login/session decisions to a central auth service
  • Compare OIDC and SAML at the architecture level without getting lost in protocol details