Kubernetes Dashboard does not accept Authorization: Bearer token even when passed via Ingress Reverse Proxy

[venkatsunil5]

What happened?

I have using Kubernetes Dashboard v7.13.0 behind an OAuth2 Proxy (via NGINX Ingress and Kong gateway). The OAuth2 proxy correctly authenticates the user and responds with an Authorization: Bearer header. The ingress is configured with annotations to forward this header to the Kubernetes Dashboard.

Despite successful authentication and the presence of the bearer token in the ingress response (verified via /oauth2/auth returning 202 and including the Authorization header), the dashboard still prompts for manual token input on the login screen.

However we suspect Kong is either stripping or not receiving the Authorization header, as the token is not visible in Kong logs or the requests reaching the dashboard. Even with nginx.kubernetes.io/auth-response-headers and other annotations configured, the dashboard does not detect the token.

dashboard-ingress.yaml annotations:

    annotations:
      #konghq.com/plugins: "preserve-auth-header"
      nginx.ingress.kubernetes.io/auth-url: "https://<host>/oauth2/auth"
      nginx.ingress.kubernetes.io/auth-signin: "https://<host>/oauth2/start?rd=https://$host$request_uri"
      nginx.ingress.kubernetes.io/auth-response-headers: >-
        X-Auth-Request-Email,X-Auth-Request-Preferred-,X-Auth-Request-Access-Token,
        X-Auth-Request-Roles,X-Auth-Request-User,X-Auth-Request-Groups,X-Forwarded-Groups,
        Authorization
      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
      nginx.ingress.kubernetes.io/proxy-buffer-size: "256k"
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
      nginx.ingress.kubernetes.io/rewrite-target: "/"
      nginx.ingress.kubernetes.io/proxy-buffers: "4 512k"
      nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "512k"

oauth2-proxy configs:

        --set config.clientID="xxxxxx" \
	--set config.clientSecret="xxxxxxx" \
	--set config.cookieSecret="xxxxxxxxx" \
        --set image.repository="docker.io/oauth2-proxy/oauth2-proxy" \
        --set image.tag="v7.9.0" \
        --set extraArgs.provider="oidc" \
        --set extraArgs.azure-tenant="xxxxxxxxxx" \
        --set extraArgs.oidc-issuer-url="https://login.microsoftonline.com/xxxxxxxxxx/v2.0" \
        --set extraArgs.redirect-url="https://<host>/oauth2/callback" \
        --set extraArgs.scope="openid profile email offline_access" \
        --set extraArgs.email-domain="*" \
        --set extraArgs.upstream="https://kubernetes-dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local:443" \
        --set extraArgs.whitelist-domain="xxxxxxxx" \
        --set extraArgs.cookie-domain=".cloud.xxx.net" \
        --set extraArgs.cookie-csrf-expire="59m" \
        --set extraArgs.cookie-csrf-per-request=true \
        --set extraArgs.cookie-expire="1h" \
        --set extraArgs.cookie-refresh="59m" \
        --set extraArgs.cookie-secure=true \
        --set extraArgs.cookie-name="_oauth2_proxy_csrf" \
        --set extraArgs.reverse-proxy=true \
        --set extraArgs.set-authorization-header=true \
        --set extraArgs.pass-authorization-header=true \
        --set extraArgs.pass-access-token=true \
        --set extraArgs.show-debug-on-error=true \
        --set extraArgs.ssl-upstream-insecure-skip-verify=true \
        --set extraArgs.ssl-insecure-skip-verify=true \
        --set extraArgs.skip-auth-strip-headers=false \
        --set extraArgs.pass-user-headers=true \
	--set extraArgs.pass-host-header=true \
        --set extraArgs.set-xauthrequest=true \
        --set extraArgs.skip-provider-button=true \
        --set extraArgs.skip-jwt-bearer-tokens=true \
        --set ingress.enabled=true \
        --set ingress.className="nginx" \
        --set ingress.path="/oauth2" \
        --set ingress.hosts[0]="<host>" \
        --set ingress.annotations."nginx\.ingress\.kubernetes\.io/proxy-buffer-size"="256k" \
        --set ingress.annotations."nginx\.ingress\.kubernetes\.io/proxy-body-size"="5000m"

What did you expect to happen?

• If a valid Authorization: Bearer header is present on the request reaching the dashboard, it should automatically log in the user
• The dashboard should recognize the token and not prompt for manual token entry
• The behavior should be consistent with OAuth2 proxy + reverse proxy flows as suggested in the documentation and community discussions

How can we reproduce it (as minimally and precisely as possible)?

• Deploy Kubernetes Dashboard v7.13.0 using the official Helm chart
• Use OAuth2 Proxy with --reverse-proxy, --set-xauthrequest, --pass-authorization-header, and --pass-access-token
• Use NGINX Ingress with annotations as shown above
• Route ingress backend to the kubernetes dashboard via a Kong proxy service
• Login via OAuth2 proxy works and returns 202 with Authorization: Bearer token
• Dashboard still shows manual token login instead of using the bearer token
• No Authorization header seen in the request headers or logs

Anything else we need to know?

No response

What browsers are you seeing the problem on?

Chrome

Kubernetes Dashboard version

v7.13.0

Kubernetes version

Client Version: v1.30.3 Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3 Server Version: v1.30.4

Dev environment

No response

[venkatsunil5]

EDIT: Upon enabling the verbose on the dashboard components, I see that the bearer token is reaching the dashboard but dashboard is rejecting the token and hence resulting in 401 Unauthorized. OIDC is enabled on our aks cluster and api-server is reachable. What is that we are missing here? Please shed some inputs!

[oskarm93]

--set extraArgs.scope="openid 6dae42f8-4368-4678-94ff-3960e28e3630/.default" \

This will send X-Auth-Request-Access-Token header to the dashboard with correct JWT. However, I still haven't figured out how to rename the header from X-Auth-Request-Access-Token to Authorization. You cannot take Authorization header straight from the oauth2 proxy as it has the wrong scope. Perhaps use auth-snippet annotation on nginx ingress?

[venkatsunil5]

@oskarm93 - Thanks for responding. We have this in our updated config and also added to the App Registration API Permissions as shown below, but still we are running into 401 Unauthorized issues. We enabled verbose on all the dashboard components and noticed that the bearer token is reaching the dashboard but k8s api server is rejecting the token.

NOTE: When decoding the bearer token, we noticed that aud in the token is the app registration client id instead of the AKS AAD Server appId. Is that how it works or aud should match AKS AAD server appId?

Updated Oauth2-proxy config:

--set config.clientID="xxxxxx" \
	--set config.clientSecret="xxxxxxx" \
	--set config.cookieSecret="xxxxxxxxx" \
        --set image.repository="docker.io/oauth2-proxy/oauth2-proxy" \
        --set image.tag="v7.9.0" \
        --set extraArgs.provider="oidc" \
        --set extraArgs.azure-tenant="azureTenantId" \
        --set extraArgs.oidc-issuer-url="https://login.microsoftonline.com/azureTenantId/v2.0" \
        --set extraArgs.oidc-jwks-url="https://login.microsoftonline.com/azureTenantId/discovery/v2.0/keys" \
        --set extraArgs.oidc-email-claim="email" \
        --set extraArgs.oidc-groups-claim="groups" \
        --set extraArgs.login-url="https://login.microsoftonline.com/azureTenantId/oauth2/v2.0/authorize" \
        --set extraArgs.redeem-url="https://login.microsoftonline.com/azureTenantId/oauth2/v2.0/token" \
        --set extraArgs.redirect-url="https://<host>/oauth2/callback" \
        --set extraArgs.skip-oidc-discovery=true \
        --set extraArgs.scope="openid profile email offline_access 6dae42f8-4368-4678-94ff-3960e28e3630/.default" \
        --set extraArgs.email-domain="*" \
        --set extraArgs.upstream="https://kubernetes-dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local:443" \
        --set extraArgs.whitelist-domain="xxxxxxxx" \
        --set extraArgs.cookie-domain=".cloud.xxx.net" \
        --set extraArgs.cookie-csrf-expire="59m" \
        --set extraArgs.cookie-csrf-per-request=true \
        --set extraArgs.cookie-expire="1h" \
        --set extraArgs.cookie-refresh="59m" \
        --set extraArgs.cookie-secure=true \
        --set extraArgs.cookie-name="_oauth2_proxy_csrf" \
        --set extraArgs.reverse-proxy=true \
        --set extraArgs.set-authorization-header=true \
        --set extraArgs.pass-authorization-header=true \
        --set extraArgs.pass-access-token=true \
        --set extraArgs.show-debug-on-error=true \
        --set extraArgs.ssl-upstream-insecure-skip-verify=true \
        --set extraArgs.ssl-insecure-skip-verify=true \
        --set extraArgs.skip-auth-strip-headers=false \
        --set extraArgs.pass-user-headers=true \
	--set extraArgs.pass-host-header=true \
        --set extraArgs.set-xauthrequest=true \
        --set extraArgs.skip-provider-button=true \
        --set extraArgs.skip-jwt-bearer-tokens=true \
        --set ingress.enabled=true \
        --set ingress.className="nginx" \
        --set ingress.path="/oauth2" \
        --set ingress.hosts[0]="<host>" \
        --set ingress.annotations."nginx\.ingress\.kubernetes\.io/proxy-buffer-size"="256k" \
        --set ingress.annotations."nginx\.ingress\.kubernetes\.io/proxy-body-size"="5000m"

Kubernetes Dashboard Ingress:

    annotations:
      #konghq.com/plugins: "preserve-auth-header"
      nginx.ingress.kubernetes.io/auth-url: "https://<host>/oauth2/auth"
      nginx.ingress.kubernetes.io/auth-signin: "https://<host>/oauth2/start?rd=https://$host$request_uri"
      nginx.ingress.kubernetes.io/auth-response-headers: >-
        X-Auth-Request-Email,X-Auth-Request-Preferred-,X-Auth-Request-Access-Token,
        X-Auth-Request-Roles,X-Auth-Request-User,X-Auth-Request-Groups,X-Forwarded-Groups,
        Authorization
      nginx.ingress.kubernetes.io/auth-snippet: |
        proxy_set_header Authorization "Bearer $http_x_auth_request_access_token";
      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
      nginx.ingress.kubernetes.io/proxy-buffer-size: "256k"
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
      nginx.ingress.kubernetes.io/rewrite-target: "/"
      nginx.ingress.kubernetes.io/proxy-buffers: "4 512k"
      nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "512k"

Dashboard Auth Error:

I0702 13:16:22.605419       1 main.go:34] "Starting Kubernetes Dashboard Auth" version="1.3.0"
I0702 13:16:22.605502       1 init.go:48] Using in-cluster config
I0702 13:16:22.605665       1 main.go:43] "Listening and serving insecurely on" address="0.0.0.0:8000"
I0702 13:17:10.757040       1 auth.go:38] "Bearer token" size=2026
I0702 13:17:10.757539       1 envvar.go:172] "Feature gate default state" feature="ClientsAllowCBOR" enabled=false
I0702 13:17:10.757556       1 envvar.go:172] "Feature gate default state" feature="ClientsPreferCBOR" enabled=false
I0702 13:17:10.757561       1 envvar.go:172] "Feature gate default state" feature="InformerResourceVersion" enabled=false
I0702 13:17:10.757566       1 envvar.go:172] "Feature gate default state" feature="WatchListClient" enabled=false
I0702 13:17:10.758451       1 discovery_client.go:658] "Request Body" body=""
I0702 13:17:10.758554       1 round_trippers.go:473] curl -v -XGET  -H "Accept: application/json, */*" -H "User-Agent: dashboard-auth/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Authorization: Bearer <masked>" 'https://xxx:xxx:xx:xx/version'
I0702 13:17:10.782797       1 round_trippers.go:517] HTTP Trace: Dial to tcp:xxx:xxx:xx:xx:443 succeed
I0702 13:17:10.797939       1 round_trippers.go:560] GET https://xxx:xxx:xx:xx:443/version 401 Unauthorized in 39 milliseconds
I0702 13:17:10.797983       1 round_trippers.go:577] HTTP Statistics: DNSLookup 0 ms Dial 24 ms TLSHandshake 8 ms ServerProcessing 6 ms Duration 39 ms
I0702 13:17:10.797991       1 round_trippers.go:584] Response Headers:
I0702 13:17:10.797998       1 round_trippers.go:587]     Date: Wed, 02 Jul 2025 13:17:10 GMT
I0702 13:17:10.798003       1 round_trippers.go:587]     Audit-Id: audit-id
I0702 13:17:10.798007       1 round_trippers.go:587]     Cache-Control: no-cache, private
I0702 13:17:10.798011       1 round_trippers.go:587]     Content-Type: application/json
I0702 13:17:10.798014       1 round_trippers.go:587]     Content-Length: 129
I0702 13:17:10.798067       1 discovery_client.go:658] "Response Body" body=<
	{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}
 >
E0702 13:17:10.798115       1 handler.go:33] "Could not get user" err="MSG_LOGIN_UNAUTHORIZED_ERROR"