Supported replacement for ingress-nginx auth-response-headers with ExternalAuth Policy and snippets disabled

Projects NGINX Ingress Controller
1

My issue:

I am migrating from the community ingress-nginx controller to F5 NGINX Ingress Controller OSS. Several existing Ingress resources use external authentication together with response headers returned by the authentication service: ```yaml

nginx.ingress.kubernetes.io/auth-url: “http://example-service.example.local/v1/auth”

nginx.ingress.kubernetes.io/auth-response-headers: “Tenant-ID, User-ID, Permissions”

The authentication service returns identity and authorization headers after successful authentication. The application backend depends on those headers.

The migration tool converts auth-url to an ExternalAuth Policy:

apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: external-auth-policy
spec:
  externalAuth:
    authURI: /v1/auth
    authServiceName: auth-namespace/auth-service

However, I cannot find a supported field in the ExternalAuth Policy that is equivalent to the community controller’s auth-response-headers.

Snippets are intentionally disabled on the controller.

How I encountered the problem:
I created an isolated test with:

  • an ExternalAuth Policy;
  • a mock authentication service;
  • an echo backend;
  • a Mergeable Ingress Minion referencing the Policy.

The mock authentication service behaves as follows:

Invalid authentication:
HTTP 401

Valid authentication:
HTTP 204
Tenant-ID: tenant-123
User-ID: user-456
Permissions: read,write

The observed results were:

1. Authentication service returns 401
   Result: F5 returns 401 to the client.
   Status: works as expected.

2. Authentication service returns 204
   Result: F5 forwards the original request to the backend.
   Status: works as expected.

3. Authentication service returns identity headers
   Result: the backend receives empty/missing Tenant-ID, User-ID and Permissions headers.
   Status: auth response headers are not propagated.

I also called the authentication service directly and confirmed that it returns the expected headers:

HTTP/1.1 204 No Content
Tenant-ID: tenant-123
User-ID: user-456
Permissions: read,write

The backend output through F5 was equivalent to:

tenant-id=
user-id=
permissions=

Solutions I’ve tried:
ExternalAuth Policy with authURI and authServiceName;

  1. verification that the authentication service returns the required headers;
  2. verification that allow/deny behavior works correctly;
  3. checking the installed Policy CRD schema;

Version of NIC and/or NGINX:

F5 NGINX Ingress Controller OSS: 5.5.1 Helm chart: 2.6.1 NGINX data plane observed in responses: 1.31.2

Deployment environment:
Kubernetes on Azure Kubernetes Service F5 NGINX Ingress Controller OSS Mergeable Ingress resources using Master and Minion ExternalAuth Policy attached to a Minion Snippets disabled

My questions are:

  1. Is there a supported F5 NIC equivalent to the community auth-response-headers annotation?

  2. Can ExternalAuth Policy propagate selected response headers from the auth service to the application backend without authSnippets?

  3. Can nginx.org/proxy-set-headers reference headers or variables produced by the ExternalAuth subrequest?

  4. Is a custom NGINX template currently the only solution when snippets are disabled?

  5. Is there a planned Policy field similar to headersToBackend for ExternalAuth?

  6. What is the recommended replacement for auth-snippet when the goal is to remove a header such as Content-Type only from the authentication subrequest?

    Thanks everyone.

2

Hi @alexneego you’re correct, currently there’s no policy support for auth-response-headers and headersToBackend . You can see the list of supported options at Policy resources | NGINX Documentation

It would be worth filing at feature request at Issues · nginx/kubernetes-ingress · GitHub for both

For now if you want to keep the snippets disabled, custom-template is the only way