External Authorization

• External authorization architecture overview
• Network filter v2 API reference
• This filter should be configured with the name envoy.ext_authz.

The external authorization network filter calls an external authorization service to check if the incoming request is authorized or not. If the request is deemed unauthorized by the network filter then the connection will be closed.

Tip

It is recommended that this filter is configured first in the filter chain so that requests are authorized prior to rest of the filters processing the request.

The content of the request that are passed to an authorization service is specified by CheckRequest.

The network filter, gRPC service, can be configured as follows. You can see all the configuration options at Network filter.

Example

A sample filter configuration could be:

filters:
  - name: envoy.ext_authz
    config:
      stat_prefix: ext_authz
      grpc_service:
        envoy_grpc:
          cluster_name: ext-authz
clusters:
  - name: ext-authz
    type: static
    http2_protocol_options: {}
    load_assignment:
      cluster_name: ext-authz
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: 127.0.0.1
                port_value: 10003

Statistics

The network filter outputs statistics in the config.ext_authz. namespace.