AWS：在Elastic Beanstalk的ALB中配置OIDC身份验证

核心结论 #

Beanstalk创建的ALB不支持通过原生控制台或基础配置直接启用OIDC身份验证，但可以通过以下几种可行方式实现：

方式一：直接通过AWS CLI/SDK修改ALB配置 #

1. 确认Beanstalk环境已创建好ALB，获取ALB的ARN和后端目标组信息
2. 使用AWS CLI命令修改HTTPS监听器，添加OIDC认证规则：

   aws elbv2 modify-listener \
     --listener-arn <your-alb-listener-arn> \
     --default-actions '[
       {
         "Type": "authenticate-oidc",
         "AuthenticateOIDCConfig": {
           "Issuer": "https://login.microsoftonline.com/{your-tenant-id}/v2.0",
           "AuthorizationEndpoint": "https://login.microsoftonline.com/{your-tenant-id}/oauth2/v2.0/authorize",
           "TokenEndpoint": "https://login.microsoftonline.com/{your-tenant-id}/oauth2/v2.0/token",
           "UserInfoEndpoint": "https://graph.microsoft.com/oidc/userinfo",
           "ClientId": "your-client-id",
           "ClientSecret": "your-client-secret",
           "Scope": "openid email profile",
           "SessionCookieName": "AWSELBAuthSessionCookie",
           "OnUnauthenticatedRequest": "authenticate"
         }
       },
       {
         "Type": "forward",
         "TargetGroupArn": "<your-target-group-arn>"
       }
     ]'
   

3. 注意：后续Beanstalk环境更新可能会覆盖该配置，需配合配置文件固化规则

方式二：用Beanstalk配置文件自动配置ALB OIDC #

在应用源码的.ebextensions目录下创建配置文件（如01-alb-oidc.config），通过CloudFormation资源定义自动配置OIDC：

Resources:
  AWSEBV2LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn:
        Ref: AWSEBV2LoadBalancer
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn: <your-acm-cert-arn>
      DefaultActions:
        - Type: authenticate-oidc
          AuthenticateOIDCConfig:
            Issuer: "https://login.microsoftonline.com/{your-tenant-id}/v2.0"
            AuthorizationEndpoint: "https://login.microsoftonline.com/{your-tenant-id}/oauth2/v2.0/authorize"
            TokenEndpoint: "https://login.microsoftonline.com/{your-tenant-id}/oauth2/v2.0/token"
            UserInfoEndpoint: "https://graph.microsoft.com/oidc/userinfo"
            ClientId: "your-client-id"
            ClientSecret:
              Ref: OidcClientSecret
            SessionCookieName: "AWSELBAuthSessionCookie"
            Scope: "openid email profile"
            OnUnauthenticatedRequest: authenticate
        - Type: forward
          TargetGroupArn:
            Ref: AWSEBV2LoadBalancerTargetGroup

Parameters:
  OidcClientSecret:
    Type: AWS::SecretsManager::Secret::SecretString
    Default: <secret-arn>

• 该方式会在Beanstalk环境创建/更新时自动应用OIDC配置，避免被覆盖
• 客户端密钥建议存储在Secrets Manager，通过参数引用避免硬编码

方式三：添加身份代理层（备选） #

若不想直接修改ALB，可在公有子网部署Nginx/Apache作为反向代理：

• 在代理层安装mod_auth_openidc（Apache）或nginx-openidc模块，配置OIDC认证逻辑
• 代理层验证用户身份后，将请求转发到私有子网的PHP应用
• 优势是支持自定义认证逻辑，缺点是增加了架构复杂度

内容的提问来源于stack exchange，提问作者Goural