(servicecomb-docs) branch master updated: add white/black rule descriptions (#332)

[li...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

liubao pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/servicecomb-docs.git


The following commit(s) were added to refs/heads/master by this push:
     new 87fb4df  add white/black rule descriptions (#332)
87fb4df is described below

commit 87fb4df259c077883e1fa18b8c66c6db92f3bc91
Author: Cheng YouLing <97...@users.noreply.github.com>
AuthorDate: Mon May 6 14:18:14 2024 +0800

    add white/black rule descriptions (#332)
---
 .../en_US/docs/references-handlers/publickey.md           | 12 +++++++++++-
 .../zh_CN/docs/references-handlers/publickey.md           | 15 ++++++++++++++-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/java-chassis-reference/en_US/docs/references-handlers/publickey.md b/java-chassis-reference/en_US/docs/references-handlers/publickey.md
index 6bc93d1..2000ec2 100644
--- a/java-chassis-reference/en_US/docs/references-handlers/publickey.md
+++ b/java-chassis-reference/en_US/docs/references-handlers/publickey.md
@@ -54,6 +54,16 @@ servicecomb:
           rule: cust*
 ```
 
-The above rules are configured with blacklists, which do not allow microservice names to be accessed by hackers; whitelists allow access to services with microservice names named cust.
+The above rules are configured with black and white rule. includePathPatterns is set the request path that needs auth, and excludePathPatterns is set the request path that not need auth. black/white is microservice black and white rules.
+
+IncludePathPatterns, excludePathPatterns Supports three types of matching rules: prefix (xxx/), suffix (/xxx) and exact match.
+
+Logic for determining whether the current request requires authentication:
+
+1.Check whether the path of current request matches the excludePathPatterns setting rule. If yes, authentication is not required.
+
+2.If excludePathPatterns does not match, check whether a rule is configured for includePathPatterns. If no, all requests need to be authenticated; If set, check whether the path of current request matches the rule. If yes, authentication is required. If no, authentication is not required.
+
+Microservice black/white determination rules: which do not allow microservice names to be accessed by hackers; whitelists allow access to services with microservice names named cust.
 
 ServiceComb provides [trust-sample] (https://github.com/apache/servicecomb-samples/tree/master/java-chassis-samples/trust-sample) to demonstrate the black and white list feature.
diff --git a/java-chassis-reference/zh_CN/docs/references-handlers/publickey.md b/java-chassis-reference/zh_CN/docs/references-handlers/publickey.md
index 583e9e6..1a754fb 100644
--- a/java-chassis-reference/zh_CN/docs/references-handlers/publickey.md
+++ b/java-chassis-reference/zh_CN/docs/references-handlers/publickey.md
@@ -16,6 +16,9 @@
 servicecomb:
   publicKey:
     accessControl:
+      enabled: true
+      includePathPatterns: '/authIncludePath'
+      excludePathPatterns: '/authExcludePath'
       black:
         list01:
           category: property ## property, fixed value
@@ -31,6 +34,16 @@ servicecomb:
           rule: cust*
 ```
 
-以上规则配置了黑名单，不允许微服务名称为hacker的访问；白名单，允许微服务名称为cust前缀的服务访问。
+以上为服务黑白名单规则配置，其中includePathPatterns为需要鉴权请求path，excludePathPatterns为不需要鉴权请求path，black/white分别为微服务黑白名单规则。
+
+includePathPatterns、excludePathPatterns规则设置支持前缀(xxx/)、后缀(/xxx)、精确三种匹配规则。
+
+判断当前请求是否需要鉴权逻辑：
+
+1、判断当前请求path是否能够匹配excludePathPatterns设置规则，如果匹配，则不需要鉴权；
+
+2、excludePathPatterns未满足条件，再判断includePathPatterns是否设置规则，如果未设置则所有请求均需要进行鉴权；如果有设置规则，则判断当前请求path是否能够匹配设置规则，如果匹配则需要鉴权，如果不匹配则不需要鉴权。
+
+微服务黑名单判断规则：不允许微服务名称为hacker的访问；白名单，允许微服务名称为cust前缀的服务访问。
 
 ServiceComb提供了[trust-sample](https://github.com/apache/servicecomb-samples/tree/master/java-chassis-samples/trust-sample)来演示黑白名单功能。