# Kong proxy elb ssl terminate oath2 plugin

**URL:** <https://discuss.konghq.com/t/kong-proxy-elb-ssl-terminate-oath2-plugin/4083>\
**Category:** Questions\
**Tags:** kubernetes\
**Created:** [July 25, 2019, 8:13pm UTC](https://discuss.konghq.com/t/kong-proxy-elb-ssl-terminate-oath2-plugin/4083 "2019-07-25T20:13:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ldipotet](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/ldipotet/32/4842_2.png) [@ldipotet](https://discuss.konghq.com/u/ldipotet)\
**Post date:** [July 25, 2019, 8:13pm UTC](https://discuss.konghq.com/t/kong-proxy-elb-ssl-terminate-oath2-plugin/4083/1 "2019-07-25T20:13:54Z")

</div>

I have kong + kong-ingress-controller behind aws elb that has ACM certificate in AWS.  
kong-admin and kong-proxy work quite well with https BUT I can’t request token … always get as response and access denied.

> * * *
> 
> apiVersion: v1  
> kind: Service  
> metadata:  
> name: kong-proxy  
> namespace: kong  
> annotations:  
> [service.beta.kubernetes.io/aws-load-balancer-backend-protocol:](http://service.beta.kubernetes.io/aws-load-balancer-backend-protocol:) “http”  
> [service.beta.kubernetes.io/aws-load-balancer-ssl-ports:](http://service.beta.kubernetes.io/aws-load-balancer-ssl-ports:) “443,8443”  
> [service.beta.kubernetes.io/aws-load-balancer-proxy-protocol:](http://service.beta.kubernetes.io/aws-load-balancer-proxy-protocol:) “\*”  
> [service.beta.kubernetes.io/aws-load-balancer-ssl-cert:](http://service.beta.kubernetes.io/aws-load-balancer-ssl-cert:) arn:aws:acm:eu-west-1:xxxxxxxxxxxxx  
> spec:  
> externalTrafficPolicy: Local  
> type: LoadBalancer  
> ports:
> 
> - name: kong-proxy  
> port: 80  
> targetPort: 8000  
> protocol: TCP
> - name: kong-proxy-ssl  
> port: 443  
> targetPort: 8000  
> protocol: TCP  
> selector:  
> app: kong
> 
> * * *
> 
> apiVersion: v1  
> kind: Service  
> metadata:  
> name: kong-ingress-controller  
> namespace: kong  
> spec:  
> type: ClusterIP  
> ports:
> 
> - name: kong-admin  
> port: 80  
> targetPort: 8001  
> protocol: TCP
> - name: kong-admin-ssl  
> port: 443  
> targetPort: 8001  
> protocol: TCP  
> selector:  
> app: ingress-kong

my ingress:

> apiVersion: extensions/v1beta1  
> kind: Ingress  
> metadata:  
> name: kong-ingress-1  
> namespace: kong  
> annotations:  
> [ingress.kubernetes.io/rewrite-target:](http://ingress.kubernetes.io/rewrite-target:) /  
> [kubernetes.io/ingress.class:](http://kubernetes.io/ingress.class:) “kong”  
> spec:  
> rules:
> 
> - http:  
> paths:
> - path: /admin  
> backend:  
> serviceName: kong-ingress-controller  
> servicePort: 443
> - path: /proxy  
> backend:  
> serviceName: kong-proxy  
> servicePort: 443

curl for adding oauth2:

> curl -X POST   
> –url [http://dev.cert.scadip.com/admin/services/football-service/plugins/](http://dev.cert.scadip.com/admin/services/football-service/plugins/)   
> –data “name=oauth2”   
> –data “config.mandatory\_scope=true”   
> –data “config.scopes=read”   
> –data “config.enable\_password\_grant=true”   
> –data “config.global\_credentials=true”   
> – **data "config.accept\_http\_if\_already\_terminated=true**"

and I have added trusted ip too in both (kong and kong ingress controller):

> * * *
> 
> apiVersion: extensions/v1beta1  
> kind: Deployment  
> metadata:  
> name: kong  
> namespace: kong  
> spec:  
> template:  
> metadata:  
> labels:  
> name: kong  
> app: kong  
> spec:  
> containers:  
> - name: kong-proxy  
> image: kong:1.2  
> env:  
> - name: KONG\_DATABASE  
> value: cassandra  
> - name: KONG\_CASSANDRA\_KEYSPACE  
> value: kong  
> - name: KONG\_CASSANDRA\_CONTACT\_POINTS  
> value: cassandra.default.svc.cluster.local  
> - name: KONG\_PROXY\_ACCESS\_LOG  
> value: “/dev/stdout”  
> - name: KONG\_PROXY\_ERROR\_LOG  
> value: “/dev/stderr”  
> - name: KONG\_ADMIN\_LISTEN  
> value: ‘off’  
> **- name: KONG\_TRUSTED\_IPS**  
> value: 0.0.0.0/0,::/0  
> ports:  
> - name: proxy  
> containerPort: 8000  
> protocol: TCP  
> - name: proxy-ssl  
> containerPort: 8443  
> protocol: TCP  
> lifecycle:  
> preStop:  
> exec:  
> command: [“/bin/sh”, “-c”, “kong quit”]

my request token curl:

> curl -v -i -X POST   
> –url [https://dev.xxxx.com/proxy/apirest/premier/oauth2/token](https://dev.xxxx.com/proxy/apirest/premier/oauth2/token)   
> –data “grant\_type=password”   
> –data “client\_id=fg9mcyewJ15cgxxxxxxxxxx”   
> –data “client\_secret=zANetM0xxxxxxxR3ZQDqIC8EvUL”   
> –data “provision\_key=hB3eH5MTuneFixxxxxxxxxxq8oG8auR”   
> –data “scope=read”   
> –data “authenticated\_userid=myusrid”

any idea about why I always have access denied as response, please?

---

<div class="post-metadata">

**Author:** ![ldipotet](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/ldipotet/32/4842_2.png) [@ldipotet](https://discuss.konghq.com/u/ldipotet)\
**Post date:** [July 26, 2019, 10:15am UTC](https://discuss.konghq.com/t/kong-proxy-elb-ssl-terminate-oath2-plugin/4083/2 "2019-07-26T10:15:13Z")

</div>

I solved the problem … I gonna prepared a link with all implementation on github as soon as I can because there are many people with the same problem …