authz_filter: configuration to support Ambassador authorization flow

envoy/config/filter/http/ext_authz/v2/ext_authz.proto

@@ -9,7 +9,7 @@ import "validate/validate.proto";
 
 // [#not-implemented-hide:]
 // External Authorization filter calls out to an external service over the
-// gRPC Authorization API defined by
+// gRPC or HTTP Authorization API defined by
 // :ref:`external_auth <envoy_api_msg_auth.CheckRequest>`.
 // A failed check will cause this filter to return 403 Forbidden.
 message ExtAuthz {
@@ -23,4 +23,25 @@ message ExtAuthz {
   // is NOT denied then traffic will be permitted.
   // Defaults to false.
   bool failure_mode_allow = 2;
+
+  // When this value is set to true, the filter must call an HTTP authorization service only.
+  bool use_http_service = 3;
+
+  // The external authorization HTTP service configuration. Only applicable when `use_http_service`
+  // is true.
+  message HttpService {
+
+    // Sets the cluster name which the authorization request must be sent to.
+    string cluster = 1;
+
+    // Sets the time in milliseconds within the service should respond to an authorization request.
+    uint32 timeout_ms = 2;
+
+    // Sets a list of authorization response headers that are allowed to be injected in the
+    // downstream client request before dispatching it to the upstream.
+    repeated string allowed_headers = 3;
+
+    // Sets an optional prefix to the value of request header `path` in the authorization request.
+    string path_prefix = 4;
+  }
 }

envoy/service/auth/v2/external_auth.proto

@@ -26,4 +26,22 @@ message CheckRequest {
 message CheckResponse {
   // Status `OK` allows the request. Any other status indicates the request should be denied.
   google.rpc.Status status = 1;
+
+  // An optional message which contains the attributes of an HTTP response object. This message is
+  // particularly useful when the authorization service needs to send specific responses to the
+  // downstream client or to modify the request headers before dispatching them to the upstream.
+  // E.g., when the authorization status is not OK, this message can be used by the authorization
+  // service to the tell the filter to respond with specific HTTP headers, body, and status code.
+  // When the authorization status is OK, this object may include the headers that should be
+  // modified in the original request before it gets sent to the upstream.
+  message HttpResponse {
+    // Http status code.
+    int32 status_code = 1;
+
+    // Http entity headers.
+    map<string, string> headers = 2;
+
+    // Http entity body.
+    string body = 3;
+  }
 }