You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2022/07/07 05:20:49 UTC
[GitHub] [apisix] navendu-pottekkat commented on a diff in pull request #7406: docs: update openid-connect plugin document
navendu-pottekkat commented on code in PR #7406:
URL: https://github.com/apache/apisix/pull/7406#discussion_r915466405
##########
docs/en/latest/plugins/openid-connect.md:
##########
@@ -29,7 +29,7 @@ description: This document contains information about the Apache APISIX openid-c
## Description
-The `openid-connect` Plugin provides authentication and introspection capability to APISIX with [OpenID Connect](https://openid.net/connect/).
+[OpenID Connect](https://openid.net/connect/) (OIDC) is an authentication protocol based on the OAuth 2.0. It allows the client to obtain user information from the identity provider (IdP), e.g., Keycloak, Ory, Okta, Auth0, etc. API Gateway Apache APISIX supports to integrate with the above identity providers to protect your APIs.
Review Comment:
```suggestion
[OpenID Connect](https://openid.net/connect/) (OIDC) is an authentication protocol based on the OAuth 2.0. It allows the client to obtain user information from the identity provider (IdP), e.g., Keycloak, Ory, Okta, Auth0, etc. `openid-connect` Plugin in APISIX integrates with the above identity providers to protect your APIs.
```
##########
docs/en/latest/plugins/openid-connect.md:
##########
@@ -2,10 +2,10 @@
title: openid-connect
keywords:
- APISIX
- - Plugin
+ - API Gateway
- OpenID Connect
- - openid-connect
-description: This document contains information about the Apache APISIX openid-connect Plugin.
+ - OIDC
+description: OpenID Connect (OIDC) is an authentication protocol based on the OAuth 2.0. It allows the client to obtain user information from the identity provider (IdP), e.g., Keycloak, Ory, Okta, Auth0, etc. API Gateway APISIX supports to integrate with the above identity providers to protect your APIs.
Review Comment:
```suggestion
description: OpenID Connect (OIDC) is an authentication protocol based on the OAuth 2.0. It allows the client to obtain user information from the identity provider (IdP), e.g., Keycloak, Ory, Okta, Auth0, etc. openid-connect Plugin in APISIX integrates with the above identity providers to protect your APIs.
```
##########
docs/en/latest/plugins/openid-connect.md:
##########
@@ -59,21 +59,25 @@ The `openid-connect` Plugin provides authentication and introspection capability
| set_userinfo_header | boolean | False | true | | When set to true and the UserInfo object is available, sets it in the `X-Userinfo` request header. |
| set_refresh_token_header | boolean | False | false | | When set to true and a refresh token object is available, sets it in the `X-Refresh-Token` request header. |
-## Modes of operation
+## Scenarios
-The `openid-connect` Plugin offers three modes of operation:
+:::tip
-1. The Plugin can be configured to just validate an access token that is expected to be present in a request header. In such cases, requests without a token or with an invalid token are rejected. This requires the `bearer_only` attribute to be set to `true` and either `introspection_endpoint` or `public_key` attribute to be configured. This mode of operation can be used for service-to-service communication where the requester can reasonably be expected to obtain and manage a valid token by itself.
+1. Tutorial: [Use Keycloak with API Gateway to secure APIs](https://apisix.apache.org/blog/2022/07/06/use-keycloak-with-api-gateway-to-secure-apis/)
-2. The Plugin can be configured to authenticate requests without a valid token against an identity provider through OIDC authorization. The Plugin then acts as an OIDC Relying Party. In such cases, after successful authentication, the Plugin obtains and manages an access token in a session cookie. Subsequent requests that contain the cookie will use the access token. This requires the `bearer_only` attribute to be set to `false`. This mode of operation can be used to support cases where the client or the requester is a human interacting through a web browser.
+2. Testcases: [openid-connect.t](https://github.com/apache/apisix/blob/master/t/plugin/openid-connect.t)
Review Comment:
Do we need to share link to this? Why would a user need to look at the test cases? If it is to show usage examples, we should explicitly add examples to the documentation instead of pointing the user to test cases.
##########
docs/en/latest/plugins/openid-connect.md:
##########
@@ -59,21 +59,25 @@ The `openid-connect` Plugin provides authentication and introspection capability
| set_userinfo_header | boolean | False | true | | When set to true and the UserInfo object is available, sets it in the `X-Userinfo` request header. |
| set_refresh_token_header | boolean | False | false | | When set to true and a refresh token object is available, sets it in the `X-Refresh-Token` request header. |
-## Modes of operation
+## Scenarios
-The `openid-connect` Plugin offers three modes of operation:
+:::tip
-1. The Plugin can be configured to just validate an access token that is expected to be present in a request header. In such cases, requests without a token or with an invalid token are rejected. This requires the `bearer_only` attribute to be set to `true` and either `introspection_endpoint` or `public_key` attribute to be configured. This mode of operation can be used for service-to-service communication where the requester can reasonably be expected to obtain and manage a valid token by itself.
+1. Tutorial: [Use Keycloak with API Gateway to secure APIs](https://apisix.apache.org/blog/2022/07/06/use-keycloak-with-api-gateway-to-secure-apis/)
Review Comment:
This link to the tutorial can either be added to the top of the documentation or the very end IMO. It can also be phrased as "See [Use Keycloak with API Gateway to secure APIs](https://apisix.apache.org/blog/2022/07/06/use-keycloak-with-api-gateway-to-secure-apis/) for detailed instructions on setting up Keycloak." or something like that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org