You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "madhawa-gunasekara (via GitHub)" <gi...@apache.org> on 2023/11/12 15:15:24 UTC
[PR] feat: add multi-auth plugin [apisix]
madhawa-gunasekara opened a new pull request, #10482:
URL: https://github.com/apache/apisix/pull/10482
### Description
Add multiple authentication for routes. This is the implementation of multi-auth plugin
```json
{
"plugins":{
"multi-auth":{
"auth_plugins":[
{
"basic-auth":{ }
},
{
"key-auth":{
"query":"apikey",
"hide_credentials":true,
"header":"apikey"
}
},
{
"jwt-auth":{
"cookie":"jwt",
"query":"jwt",
"hide_credentials":true,
"header":"authorization"
}
}
]
}
}
}
```
Fixes #10196
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first)
<!--
Note
1. Mark the PR as draft until it's ready to be reviewed.
2. Always add/update tests for any changes unless you have a good reason.
3. Always update the documentation to reflect the changes made in the PR.
4. Make a new commit to resolve conversations instead of `push -f`.
5. To resolve merge conflicts, merge master instead of rebasing.
6. Use "request review" to notify the reviewer after making changes.
7. Only a reviewer can mark a conversation as resolved.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1393344690
##########
docs/en/latest/plugins/multi-auth.md:
##########
@@ -0,0 +1,140 @@
+---
+title: basic-auth
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - Multi Auth
+ - multi-auth
+description: This document contains information about the Apache APISIX multi-auth Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `multi-auth` Plugin is used to add multiple authentication methods to a Route or a Service. Plugins with type 'auth' are supported.
Review Comment:
I added details in here
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1394366453
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,89 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ if auth == nil then
+ return false, auth_plugin_name .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, auth_plugin_name .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ -- returns 401 HTTP status code if authentication failed, otherwise nothing returns.
+ local auth_code = auth.rewrite(auth_plugin_conf, ctx)
+ status_code = auth_code
+ if auth_code == nil then
+ core.log.debug("Authentication is successful" .. auth_plugin_name .. " plugin")
+ goto authenticated
+ else
+ core.log.warn("Authentication is failed" .. auth_plugin_name .. " plugin, code: "
Review Comment:
changed it
##########
t/plugin/multi-auth.t:
##########
@@ -0,0 +1,418 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
Review Comment:
removed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on PR #10482:
URL: https://github.com/apache/apisix/pull/10482#issuecomment-1811962519
Hi @moonming,
I fixed the changes you mentioned, can you rereview again?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1394366109
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,89 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ if auth == nil then
+ return false, auth_plugin_name .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, auth_plugin_name .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ -- returns 401 HTTP status code if authentication failed, otherwise nothing returns.
Review Comment:
Thanks for the suggestion
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1393344285
##########
t/plugin/multi-auth.t:
##########
@@ -0,0 +1,244 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
+ $ENV{VAULT_TOKEN} = "root";
+}
+
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+run_tests;
+
+__DATA__
+
+=== TEST 1: add consumer with basic-auth and key-auth plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "foo",
+ "plugins": {
+ "basic-auth": {
+ "username": "foo",
+ "password": "bar"
+ },
+ "key-auth": {
+ "key": "auth-one"
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 2: enable multi auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": {
+ "auth_plugins": [
+ {
+ "basic-auth": {}
+ },
+ {
+ "key-auth": {
+ "query": "apikey",
+ "hide_credentials": true,
+ "header": "apikey"
+ }
+ },
+ {
+ "jwt-auth": {
Review Comment:
I added the test cases to cover jwt as well.
This is kind of a wrapper plugin to enable different authentication methods using "or" relationship.
I just added these 3 plugins to show case the compatibility of any plugin with type 'auth'.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1394126226
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,89 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ if auth == nil then
+ return false, auth_plugin_name .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, auth_plugin_name .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ -- returns 401 HTTP status code if authentication failed, otherwise nothing returns.
+ local auth_code = auth.rewrite(auth_plugin_conf, ctx)
+ status_code = auth_code
+ if auth_code == nil then
+ core.log.debug("Authentication is successful" .. auth_plugin_name .. " plugin")
+ goto authenticated
+ else
+ core.log.warn("Authentication is failed" .. auth_plugin_name .. " plugin, code: "
Review Comment:
`core.log.debug` instead of warn may be better here. Or just skip the whole `else` block. It is a normal use case that one or more authentication methods would fail.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "SatriyoJati (via GitHub)" <gi...@apache.org>.
SatriyoJati commented on PR #10482:
URL: https://github.com/apache/apisix/pull/10482#issuecomment-2487221265
it said that it is only support for auth plugin with type 'auth', is authz-keycloak included to this type?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1392844237
##########
t/plugin/multi-auth.t:
##########
@@ -0,0 +1,244 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
+ $ENV{VAULT_TOKEN} = "root";
+}
+
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+run_tests;
+
+__DATA__
+
+=== TEST 1: add consumer with basic-auth and key-auth plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "foo",
+ "plugins": {
+ "basic-auth": {
+ "username": "foo",
+ "password": "bar"
+ },
+ "key-auth": {
+ "key": "auth-one"
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 2: enable multi auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": {
+ "auth_plugins": [
+ {
+ "basic-auth": {}
+ },
+ {
+ "key-auth": {
+ "query": "apikey",
+ "hide_credentials": true,
+ "header": "apikey"
+ }
+ },
+ {
+ "jwt-auth": {
+ "cookie": "jwt",
+ "query": "jwt",
+ "hide_credentials": true,
+ "header": "authorization"
+ }
+ }
+ ]
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 3: verify, missing authorization
+--- request
+GET /hello
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 4: verify basic
+--- request
+GET /hello
+--- more_headers
+Authorization: Basic Zm9vOmJhcg==
+--- response_body
+hello world
+--- error_log
+find consumer foo
+
+
+
+=== TEST 5: verify key
+--- request
+GET /hello
+--- more_headers
+apikey: auth-one
+--- response_body
+hello world
+
+
+
+=== TEST 6: verify, invalid basic credentials
+--- request
+GET /hello
+--- more_headers
+Authorization: Basic YmFyOmJhcgo=
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 7: verify, invalid api key
+--- request
+GET /hello
+--- more_headers
+apikey: auth-two
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 8: enable multi auth plugin using admin api
Review Comment:
Noted .
##########
t/plugin/multi-auth.t:
##########
@@ -0,0 +1,244 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
+ $ENV{VAULT_TOKEN} = "root";
+}
+
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+run_tests;
+
+__DATA__
+
+=== TEST 1: add consumer with basic-auth and key-auth plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "foo",
+ "plugins": {
+ "basic-auth": {
+ "username": "foo",
+ "password": "bar"
+ },
+ "key-auth": {
+ "key": "auth-one"
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 2: enable multi auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": {
+ "auth_plugins": [
+ {
+ "basic-auth": {}
+ },
+ {
+ "key-auth": {
+ "query": "apikey",
+ "hide_credentials": true,
+ "header": "apikey"
+ }
+ },
+ {
+ "jwt-auth": {
+ "cookie": "jwt",
+ "query": "jwt",
+ "hide_credentials": true,
+ "header": "authorization"
+ }
+ }
+ ]
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 3: verify, missing authorization
+--- request
+GET /hello
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 4: verify basic
+--- request
+GET /hello
+--- more_headers
+Authorization: Basic Zm9vOmJhcg==
+--- response_body
+hello world
+--- error_log
+find consumer foo
+
+
+
+=== TEST 5: verify key
+--- request
+GET /hello
+--- more_headers
+apikey: auth-one
+--- response_body
+hello world
+
+
+
+=== TEST 6: verify, invalid basic credentials
+--- request
+GET /hello
+--- more_headers
+Authorization: Basic YmFyOmJhcgo=
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 7: verify, invalid api key
+--- request
+GET /hello
+--- more_headers
+apikey: auth-two
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 8: enable multi auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": { }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- error_code: 400
+--- response_body_like eval
+qr/\{"error_msg":"failed to check the configuration of plugin multi-auth err: property \\"auth_plugins\\" is required"\}/
+
+
+
+=== TEST 9: enable multi auth plugin using admin api
Review Comment:
Sure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1396959024
##########
docs/en/latest/plugins/multi-auth.md:
##########
@@ -0,0 +1,144 @@
+---
+title: multi-auth
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - Multi Auth
+ - multi-auth
+description: This document contains information about the Apache APISIX multi-auth Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `multi-auth` Plugin is used to add multiple authentication methods to a Route or a Service. It supports plugins of type 'auth'. You can combine different authentication methods using "or" relationship with `multi-auth` plugin. If you want to use multiple methods in an "and" relationship, apply specific authentication plugins directly to the route or service.
+
+## Attributes
+
+For Route:
+
+| Name | Type | Required | Default | Description |
+|--------------|-------|----------|---------|-----------------------------------------------------------------------|
+| auth_plugins | array | True | - | Add supporting auth plugins configuration. expects at least 2 plugins |
+
+## Enable Plugin
+
+To enable the Plugin, you have to create a Consumer object with multiple authentication configurations:
Review Comment:
I will add it as an example
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1396305300
##########
docs/en/latest/plugins/multi-auth.md:
##########
@@ -0,0 +1,144 @@
+---
+title: multi-auth
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - Multi Auth
+ - multi-auth
+description: This document contains information about the Apache APISIX multi-auth Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `multi-auth` Plugin is used to add multiple authentication methods to a Route or a Service. It supports plugins of type 'auth'. You can combine different authentication methods using "or" relationship with `multi-auth` plugin. If you want to use multiple methods in an "and" relationship, apply specific authentication plugins directly to the route or service.
+
+## Attributes
+
+For Route:
+
+| Name | Type | Required | Default | Description |
+|--------------|-------|----------|---------|-----------------------------------------------------------------------|
+| auth_plugins | array | True | - | Add supporting auth plugins configuration. expects at least 2 plugins |
+
+## Enable Plugin
+
+To enable the Plugin, you have to create a Consumer object with multiple authentication configurations:
Review Comment:
Better example and a more realistic use case is to have multiple consumers using different authentication plugins using the same route with multi-auth.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "moonming (via GitHub)" <gi...@apache.org>.
moonming commented on PR #10482:
URL: https://github.com/apache/apisix/pull/10482#issuecomment-1815707904
@madhawa-gunasekara good job 👍
@markokocic thanks for your review
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1393339992
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,87 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for key, value in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. key)
+ if auth == nil then
+ return false, key .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, key .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for key, value in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. key)
+ local auth_code = auth.rewrite(value, ctx)
+ status_code = auth_code
+ if auth_code == nil then
Review Comment:
I added comment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1395629962
##########
docs/en/latest/plugins/multi-auth.md:
##########
@@ -0,0 +1,140 @@
+---
+title: basic-auth
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - Multi Auth
+ - multi-auth
+description: This document contains information about the Apache APISIX multi-auth Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `multi-auth` Plugin is used to add multiple authentication methods to a Route or a Service. Plugins with type 'auth' are supported.
Review Comment:
@madhawa-gunasekara did you see this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1394367974
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,89 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ if auth == nil then
+ return false, auth_plugin_name .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, auth_plugin_name .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ -- returns 401 HTTP status code if authentication failed, otherwise nothing returns.
+ local auth_code = auth.rewrite(auth_plugin_conf, ctx)
+ status_code = auth_code
+ if auth_code == nil then
+ core.log.debug("Authentication is successful" .. auth_plugin_name .. " plugin")
+ goto authenticated
+ else
+ core.log.warn("Authentication is failed" .. auth_plugin_name .. " plugin, code: "
Review Comment:
It should be debug. Thanks for pointing it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1396307627
##########
docs/en/latest/plugins/multi-auth.md:
##########
@@ -0,0 +1,144 @@
+---
+title: multi-auth
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - Multi Auth
+ - multi-auth
+description: This document contains information about the Apache APISIX multi-auth Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `multi-auth` Plugin is used to add multiple authentication methods to a Route or a Service. It supports plugins of type 'auth'. You can combine different authentication methods using "or" relationship with `multi-auth` plugin. If you want to use multiple methods in an "and" relationship, apply specific authentication plugins directly to the route or service.
+
Review Comment:
As already mentioned, docs should state that authentication plugins will be tried in the order specified in plugin config, and as soon as one one match, it will let that consumer proceed with the service call.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "moonming (via GitHub)" <gi...@apache.org>.
moonming commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1390598291
##########
t/plugin/multi-auth.t:
##########
@@ -0,0 +1,244 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
+ $ENV{VAULT_TOKEN} = "root";
+}
+
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+run_tests;
+
+__DATA__
+
+=== TEST 1: add consumer with basic-auth and key-auth plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "foo",
+ "plugins": {
+ "basic-auth": {
+ "username": "foo",
+ "password": "bar"
+ },
+ "key-auth": {
+ "key": "auth-one"
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 2: enable multi auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": {
+ "auth_plugins": [
+ {
+ "basic-auth": {}
+ },
+ {
+ "key-auth": {
+ "query": "apikey",
+ "hide_credentials": true,
+ "header": "apikey"
+ }
+ },
+ {
+ "jwt-auth": {
Review Comment:
There is no test case to cover jwt?
##########
t/plugin/multi-auth.t:
##########
@@ -0,0 +1,244 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
+ $ENV{VAULT_TOKEN} = "root";
+}
+
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+run_tests;
+
+__DATA__
+
+=== TEST 1: add consumer with basic-auth and key-auth plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "foo",
+ "plugins": {
+ "basic-auth": {
+ "username": "foo",
+ "password": "bar"
+ },
+ "key-auth": {
+ "key": "auth-one"
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 2: enable multi auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": {
+ "auth_plugins": [
+ {
+ "basic-auth": {}
+ },
+ {
+ "key-auth": {
+ "query": "apikey",
+ "hide_credentials": true,
+ "header": "apikey"
+ }
+ },
+ {
+ "jwt-auth": {
+ "cookie": "jwt",
+ "query": "jwt",
+ "hide_credentials": true,
+ "header": "authorization"
+ }
+ }
+ ]
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 3: verify, missing authorization
+--- request
+GET /hello
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 4: verify basic
+--- request
+GET /hello
+--- more_headers
+Authorization: Basic Zm9vOmJhcg==
+--- response_body
+hello world
+--- error_log
+find consumer foo
+
+
+
+=== TEST 5: verify key
+--- request
+GET /hello
+--- more_headers
+apikey: auth-one
+--- response_body
+hello world
+
+
+
+=== TEST 6: verify, invalid basic credentials
+--- request
+GET /hello
+--- more_headers
+Authorization: Basic YmFyOmJhcgo=
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 7: verify, invalid api key
+--- request
+GET /hello
+--- more_headers
+apikey: auth-two
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 8: enable multi auth plugin using admin api
Review Comment:
Need a meaningful title
##########
docs/en/latest/plugins/multi-auth.md:
##########
@@ -0,0 +1,140 @@
+---
+title: basic-auth
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - Multi Auth
+ - multi-auth
+description: This document contains information about the Apache APISIX multi-auth Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `multi-auth` Plugin is used to add multiple authentication methods to a Route or a Service. Plugins with type 'auth' are supported.
Review Comment:
For multiple different plug-ins, is there an "and" relationship or an "or" relationship between them? In other words, if there are two authentication plug-ins, do both plug-ins need to be verified?
##########
t/plugin/multi-auth.t:
##########
@@ -0,0 +1,244 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
+ $ENV{VAULT_TOKEN} = "root";
+}
+
+use t::APISIX 'no_plan';
+
+repeat_each(2);
+no_long_string();
+no_root_location();
+no_shuffle();
+run_tests;
+
+__DATA__
+
+=== TEST 1: add consumer with basic-auth and key-auth plugins
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "foo",
+ "plugins": {
+ "basic-auth": {
+ "username": "foo",
+ "password": "bar"
+ },
+ "key-auth": {
+ "key": "auth-one"
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 2: enable multi auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": {
+ "auth_plugins": [
+ {
+ "basic-auth": {}
+ },
+ {
+ "key-auth": {
+ "query": "apikey",
+ "hide_credentials": true,
+ "header": "apikey"
+ }
+ },
+ {
+ "jwt-auth": {
+ "cookie": "jwt",
+ "query": "jwt",
+ "hide_credentials": true,
+ "header": "authorization"
+ }
+ }
+ ]
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 3: verify, missing authorization
+--- request
+GET /hello
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 4: verify basic
+--- request
+GET /hello
+--- more_headers
+Authorization: Basic Zm9vOmJhcg==
+--- response_body
+hello world
+--- error_log
+find consumer foo
+
+
+
+=== TEST 5: verify key
+--- request
+GET /hello
+--- more_headers
+apikey: auth-one
+--- response_body
+hello world
+
+
+
+=== TEST 6: verify, invalid basic credentials
+--- request
+GET /hello
+--- more_headers
+Authorization: Basic YmFyOmJhcgo=
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 7: verify, invalid api key
+--- request
+GET /hello
+--- more_headers
+apikey: auth-two
+--- error_code: 401
+--- response_body
+{"message":"Authorization Failed"}
+
+
+
+=== TEST 8: enable multi auth plugin using admin api
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": { }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- error_code: 400
+--- response_body_like eval
+qr/\{"error_msg":"failed to check the configuration of plugin multi-auth err: property \\"auth_plugins\\" is required"\}/
+
+
+
+=== TEST 9: enable multi auth plugin using admin api
Review Comment:
Need a meaningful title
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,87 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for key, value in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. key)
+ if auth == nil then
+ return false, key .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, key .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for key, value in pairs(auth_plugin) do
Review Comment:
When will there be multiple `key` and `value` under an authentication plug-in? I see that the test case does not cover
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,87 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for key, value in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. key)
+ if auth == nil then
+ return false, key .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, key .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for key, value in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. key)
+ local auth_code = auth.rewrite(value, ctx)
+ status_code = auth_code
+ if auth_code == nil then
Review Comment:
What does it mean when the return value is `nil`? You can add some comments
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1394131386
##########
docs/en/latest/plugins/multi-auth.md:
##########
@@ -0,0 +1,140 @@
+---
+title: basic-auth
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - Multi Auth
+ - multi-auth
+description: This document contains information about the Apache APISIX multi-auth Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `multi-auth` Plugin is used to add multiple authentication methods to a Route or a Service. Plugins with type 'auth' are supported.
Review Comment:
Actually, it will go through the list of configured auth plugins, and exit after the first one is successfully authenticated. That means route can be shared between different consumers using different auth methods. If a consumer is using basic, he would be able to authenticate using basic, if another user uses jwt, he would be able to authenticate using jwt.
Maybe the doc can be clearer about the intent and use case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "SatriyoJati (via GitHub)" <gi...@apache.org>.
SatriyoJati commented on PR #10482:
URL: https://github.com/apache/apisix/pull/10482#issuecomment-2487222008
since when i combine key-auth with authz-keycloak, it shown this error
`{"error_msg":"failed to check the configuration of plugin multi-auth err: authz-keycloak plugin is not supported"}`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1393346282
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,87 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for key, value in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. key)
+ if auth == nil then
+ return false, key .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, key .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for key, value in pairs(auth_plugin) do
Review Comment:
I used proper variable names to avoid the confusion :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1394058401
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,89 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ if auth == nil then
+ return false, auth_plugin_name .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, auth_plugin_name .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ -- returns 401 HTTP status code if authentication failed, otherwise nothing returns.
+ local auth_code = auth.rewrite(auth_plugin_conf, ctx)
+ status_code = auth_code
+ if auth_code == nil then
+ core.log.debug("Authentication is successful" .. auth_plugin_name .. " plugin")
+ goto authenticated
+ else
+ core.log.warn("Authentication is failed" .. auth_plugin_name .. " plugin, code: "
Review Comment:
```suggestion
core.log.warn(auth_plugin_name .. " failed to authenticate the request, code: "
```
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,89 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ if auth == nil then
+ return false, auth_plugin_name .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, auth_plugin_name .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ -- returns 401 HTTP status code if authentication failed, otherwise nothing returns.
Review Comment:
```suggestion
-- returns 401 HTTP status code if authentication failed, otherwise returns nothing.
```
##########
t/plugin/multi-auth.t:
##########
@@ -0,0 +1,418 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
Review Comment:
this begin block is not needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "madhawa-gunasekara (via GitHub)" <gi...@apache.org>.
madhawa-gunasekara commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1396959919
##########
docs/en/latest/plugins/multi-auth.md:
##########
@@ -0,0 +1,140 @@
+---
+title: basic-auth
+keywords:
+ - Apache APISIX
+ - API Gateway
+ - Plugin
+ - Multi Auth
+ - multi-auth
+description: This document contains information about the Apache APISIX multi-auth Plugin.
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+The `multi-auth` Plugin is used to add multiple authentication methods to a Route or a Service. Plugins with type 'auth' are supported.
Review Comment:
Yes, I will improve the docs
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "markokocic (via GitHub)" <gi...@apache.org>.
markokocic commented on code in PR #10482:
URL: https://github.com/apache/apisix/pull/10482#discussion_r1394126226
##########
apisix/plugins/multi-auth.lua:
##########
@@ -0,0 +1,89 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local require = require
+local pairs = pairs
+
+local schema = {
+ type = "object",
+ title = "work with route or service object",
+ properties = {
+ auth_plugins = { type = "array", minItems = 2 }
+ },
+ required = { "auth_plugins" },
+}
+
+
+local plugin_name = "multi-auth"
+
+local _M = {
+ version = 0.1,
+ priority = 2600,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema
+}
+
+function _M.check_schema(conf)
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
+ return false, err
+ end
+
+ local auth_plugins = conf.auth_plugins
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ if auth == nil then
+ return false, auth_plugin_name .. " plugin did not found"
+ else
+ if auth.type ~= 'auth' then
+ return false, auth_plugin_name .. " plugin is not supported"
+ end
+ end
+ end
+ end
+
+ return true
+end
+
+function _M.rewrite(conf, ctx)
+ local auth_plugins = conf.auth_plugins
+ local status_code
+ for k, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = require("apisix.plugins." .. auth_plugin_name)
+ -- returns 401 HTTP status code if authentication failed, otherwise nothing returns.
+ local auth_code = auth.rewrite(auth_plugin_conf, ctx)
+ status_code = auth_code
+ if auth_code == nil then
+ core.log.debug("Authentication is successful" .. auth_plugin_name .. " plugin")
+ goto authenticated
+ else
+ core.log.warn("Authentication is failed" .. auth_plugin_name .. " plugin, code: "
Review Comment:
`core.log.debug` instead of warn may be better here. Or just skip the whole `else` block.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add multi-auth plugin [apisix]
Posted by "moonming (via GitHub)" <gi...@apache.org>.
moonming merged PR #10482:
URL: https://github.com/apache/apisix/pull/10482
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org