Configuring RequestAuthentication

Like service-to-service authentication, Istio can also authenticate an end user or validate that an end user has been authenticated based on assertions presented by the end user. The RequestAuthentication policy is used to specify what authentication methods are supported by a workload. This policy identifies the authenticated identity but doesn’t enforce whether the request should be allowed or denied. Rather, it provides information about the authenticated identity to the authorization policy, which we will go through in the next section. In this section, we will learn how to make use of the Istio RequestAuthentication policy to validate an end user who has been authenticated by Auth0 and is providing a bearer token as security credentials to Istio. If you are not familiar with OAuth then you can read more about it at https://auth0.com/docs/authenticate/protocols/oauth.

We will follow the hands-on steps to configure Auth0 and perform an...