You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "jonathan-dev (via GitHub)" <gi...@apache.org> on 2024/08/20 13:51:31 UTC
[I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
jonathan-dev opened a new issue, #11514:
URL: https://github.com/apache/apisix/issues/11514
### Description
The documentation for the multi-auth plugin says:
> This plugin provides a flexible authentication mechanism by iterating through the list of authentication plugins specified in the auth_plugins attribute. It allows multiple consumers to share the same route while using different authentication methods. For example, one consumer can authenticate using basic authentication, while another consumer can authenticate using JWT.
However when setting it up with openid-connect (which to my knowledeg is a auth plugin) I get the following message:
`{"error_msg":"failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported"}`
Is the openid-connect some kind of exception?
### Environment
I am using this docker image: apache/apisix:3.9.1-redhat
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "jonathan-dev (via GitHub)" <gi...@apache.org>.
jonathan-dev commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-2301497130
I just looked at the source of the plugin and it seems like the problem is just that the open-idconnect plugin doesn't have the type set to "auth" in its `_M` object. Is that the only problem? Or are there other issues related because the plugin does authentication in a different way to the other plugins? They just seem to return `nil` on their rewrite method if the request is fine.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "Fucks (via GitHub)" <gi...@apache.org>.
Fucks commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-2973373632
Is this problem solved? I tried to use multi-auth plugin with some key-auth and openid-connect using docker image version 3.12.0-debian. But the problem is still occurring
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "jonathan-dev (via GitHub)" <gi...@apache.org>.
jonathan-dev commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-2298939458
Same for the authz-keycloak plugin:
`{"error_msg":"failed to check the configuration of plugin multi-auth err: authz-keycloak plugin is not supported"}`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "UnoYakshi (via GitHub)" <gi...@apache.org>.
UnoYakshi commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-4088798425
@Baoyuantop, thank you for so thorough reply! Makes sense now.
Although, I think we should update the documentation (openid-connect, multi-auth) on that regard. Because I see it as a quite common case, to combine API Key and OIDC approaches.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "UnoYakshi (via GitHub)" <gi...@apache.org>.
UnoYakshi commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-4088622888
> openid-connect is not an auth plugin, so it cannot be used in multi-auth.
Excuse my ignorance, but isn't OIDC's purpose is to identify an identity, generating an access token for example? I mean, why `openid-connect` plugin is not categorized as an auth plugin? What's semantics behind this decision?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-4088722415
Good question. In APISIX, `type = 'auth'` is not a general label meaning "this plugin does authentication." It is a specific framework-level marker with strict technical requirements:
1. **Consumer binding**: Auth-type plugins must define a `consumer_schema` so that credentials (API keys, JWT secrets, etc.) can be configured on [Consumers](https://apisix.apache.org/docs/apisix/terminology/consumer/). At request time, the plugin extracts the credential, looks up the matching Consumer, and binds it to the request context. This is how APISIX knows *which consumer* is making the request.
2. **Simple rewrite contract**: Auth-type plugins run in the `rewrite` phase and follow a simple contract — return `nil` on success (pass-through) or return an HTTP status code on failure. This is what `multi-auth` relies on to iterate through plugins.
The `openid-connect` plugin works fundamentally differently:
- It does **not** bind to Consumers (no `consumer_schema`) — it delegates identity verification entirely to an external IdP.
- Its `rewrite` phase involves complex flows: HTTP 302 redirects to the IdP, callback handling, session/cookie management, token introspection, etc. This doesn't fit the simple success/failure contract that `multi-auth` expects.
So while OIDC absolutely does authentication in the general sense, its architecture is incompatible with the `type = 'auth'` plugin contract in APISIX. That's the reason it can't be used with `multi-auth`.
As a workaround, you can use separate routes with different `vars` conditions to route requests to different authentication methods, as described [above](https://github.com/apache/apisix/issues/11514#issuecomment-2623695639). Alternatively, if you only use `bearer_only` mode (token introspection without the redirect flow), a custom plugin approach is also feasible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "suxxez (via GitHub)" <gi...@apache.org>.
suxxez commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-2623695639
I found a solution for my problem by implementing two basically identical routes **/api/my-service/***
The first route has OIDC enabled and this extra vars:
```
"vars": [
[
"arg_apikey",
"!",
"~~",
"."
]
]
```
The second route has key-auth enabled and this extra vars:
```
"vars": [
[
"arg_apikey",
"~~",
"."
]
]
```
This approach uses pattern matching to figure out which route the request should take. If there is the request parameter "`apikey=ANYSTRING`" present, second route is used. If there is no request parameter apikey present, the first route is used.
It's not great and it would be cool to have multi-auth work out of the box, but it works.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "jonathan-dev (via GitHub)" <gi...@apache.org>.
jonathan-dev commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-2621546199
I ended up adjusting the source code of the plugin to my need and loaded it as a custom plugin which wasn't all that hard to do
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-2974914965
openid-connect is not an auth plugin, so it cannot be used in multi-auth.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported [apisix]
Posted by "suxxez (via GitHub)" <gi...@apache.org>.
suxxez commented on issue #11514:
URL: https://github.com/apache/apisix/issues/11514#issuecomment-2618828607
I've stumbled upon this problem and also on the missing "auth" type in the `_M` object. Did you find any solution @jonathan-dev?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org