title: Configure istio for container that requires basic auth
body: <p>I have a container which runs an http/rest service that requires basic auth.
  I have istio configured to service requests to this container.
  The service runs correctly on a cluster without istio.</p>
  
  <p>When querying the service with curl istio-envoy returns with status 401 and message "Full authentication is required to access this resource".</p>
  
  <p>I can get the same error by logging into the container and querying localhost with no authentication details provided.
  So by all appearances it seems istio is not forwarding on the basic authentication header.</p>
  
  <p>The container log never acknowledges the login attempt, I only see a 401 log message in the envoy container.</p>
  
  <p>I have tried with both mtls enabled and disabled.
  The gateway listens on port 443 and forwards to the service on port 80</p>
  
  <p>how do I configure istio to forward basic auth to my container</p>
  
  <pre><code>apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: mfm-gateway
    namespace: mfm-istio
  spec:
    selector:
      istio: ingressgateway
    servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      hosts:
        - dev-mfm-istio.testing.co.uk
      tls:
        mode: SIMPLE
        serverCertificate: /etc/istio/testing-co-uk-certs/tls.crt
        privateKey: /etc/istio/testing-co-uk-certs/tls.key
        caCertificates: /etc/istio/testing-co-uk-certs/ca.crt
        httpsRedirect: true
  </code></pre>
  
  <pre><code>apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    name: mfm-virtualservice
    namespace: mfm-istio
  spec:
    hosts:
    - "dev-mfm-istio.testing.co.uk"
    gateways:
    - mfm-istio/mfm-gateway
    http:
    - name: "Auth"
      match:
      -  uri:
           prefix: "/auth"
      route:
      - destination:
          host: authentication-service.mfm-istio.svc.cluster.local
          port:
            number: 80
    - name: "Base"
      route:
      - destination:
          host: web-application-service.mfm-istio.svc.cluster.local
          port:
            number: 80
  </code></pre>
  
  <pre><code>localhost: curl -ik https://dev-mfm-istio.testing.co.uk/auth/oauth/token -d username=admin -d password=lolpassword -d grant_type=password -d scope=a -H -u admin
  
  HTTP/2 401 
  pragma: no-cache
  www-authenticate: Bearer realm="authentication-service", error="unauthorized", error_description="Full authentication is required to access this resource"
  cache-control: no-store
  x-content-type-options: nosniff
  x-xss-protection: 1; mode=block
  x-frame-options: DENY
  content-type: application/json;charset=UTF-8
  date: Fri, 17 Apr 2020 13:51:43 GMT
  x-envoy-upstream-service-time: 4
  server: istio-envoy
  
  {"error":"unauthorized","error_description":"Full authentication is required to access this resource"}
  </code></pre>