You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "zhangyuthink (via GitHub)" <gi...@apache.org> on 2023/09/29 23:18:43 UTC
[GitHub] [apisix] zhangyuthink opened a new issue, #10282: feat: As a user, I want to add another password field for the plugin basic-auth,such as passwd2,so that i can smoothly switch keys.
zhangyuthink opened a new issue, #10282:
URL: https://github.com/apache/apisix/issues/10282
### Description
When changing basic-auth's password attributes for consumer, both ApiSix and the client need to be changed. However, in practical applications, it is difficult to change both simultaneously, often with a certain time difference, which may lead to the service being unavailable for a period of time.
I hope to add another password field for the plugin basic-auth, such as password2. In this way, when changing basic-auth's password attributes for consumer, I can first configure password2 in ApiSix and inform the client of password2. The client can choose the time to change the secret key at their own discretion for a period of time thereafter.
In this way, changing the password will make the changes smoother and reduce the time of service interruption.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to add another password field for the plugin basic-auth,such as passwd2,so that i can smoothly changing password. [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on issue #10282:
URL: https://github.com/apache/apisix/issues/10282#issuecomment-1744256981
> ```lua
> cur_consumer.auth_conf.password2
> ```
Your suggestion lgtm. Although instead of `password2`, it can be `backup_password` or something similar. We can wait for other community members to comment here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to add another password field for the plugin basic-auth,such as passwd2,so that i can smoothly changing password. [apisix]
Posted by "zhangyuthink (via GitHub)" <gi...@apache.org>.
zhangyuthink commented on issue #10282:
URL: https://github.com/apache/apisix/issues/10282#issuecomment-1742641942
> @zhangyuthink So how about an additional `passwords` field. The schema will allow only one of `password` or `passwords`. If you configure `passwords`, then all the passwords will be checked until there is a match. Although I am not really sure of the performance hit if we don't cap the allowed number of passwords. So in your scenario, you can change the consumer to now accept `passwords` consisting of both old and new.
Firstly, regarding performance issues. I have reviewed the code and conducted preliminary testing, and under normal circumstances, the performance should not be affected. The basic-auth plugin first parses the password from the request of client, and then verifies it with the password in the configuration. We can modify [basic-auth.lua](https://github.com/apache/apisix/blob/master/apisix/plugins/basic-auth.lua),add code to verify the second password around line 155.
```lua
-- 4. check the password is correct
if cur_consumer.auth_conf.password ~= password and cur_consumer.auth_conf.password2 ~= password then
return 401, { message = "Invalid user authorization" }
end
```
Only if the first password is incorrect will check the second password. We only need to ensure that the first password is a long-term password.
Secondly, regarding what you said "change the consumer to now accept passwords consisting of both old and new.", I'm sorry, I didn't quite understand.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Revolyssup commented on issue #10282: feat: As a user, I want to add another password field for the plugin basic-auth,such as passwd2,so that i can smoothly changing password.
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on issue #10282:
URL: https://github.com/apache/apisix/issues/10282#issuecomment-1742437695
@zhangyuthink So you're proposal is to allow for a legacy password that will stay valid for some amount of time and for that time both the new and legacy password will be valid?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to add another password field for the plugin basic-auth,such as passwd2,so that i can smoothly changing password. [apisix]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #10282:
URL: https://github.com/apache/apisix/issues/10282#issuecomment-2360561158
This issue has been marked as stale due to 350 days of inactivity. It will be closed in 2 weeks if no further activity occurs. If this issue is still relevant, please simply write any comment. Even if closed, you can still revive the issue at any time or discuss it on the dev@apisix.apache.org list. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to add another password field for the plugin basic-auth,such as passwd2,so that i can smoothly changing password. [apisix]
Posted by "zhangyuthink (via GitHub)" <gi...@apache.org>.
zhangyuthink commented on issue #10282:
URL: https://github.com/apache/apisix/issues/10282#issuecomment-1742558077
> @zhangyuthink At this time, if you're already changing secrets on the client side for this new password, why not just create a new consumer on APISIX with a new username as well and slowly update the clients to use the new username and password. After all clients are using the new consumer, delete the older one.
This is also a method, but it may not be very suitable. I believe that consumers are specific and cannot be changed arbitrarily, which is not in line with the actual meaning and may cause confusion in management. For example, the elasticsearch-logger plugin can record consumers, but if you follow your approach, it will record different consumers, which is not suitable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to add another password field for the plugin basic-auth,such as passwd2,so that i can smoothly changing password. [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on issue #10282:
URL: https://github.com/apache/apisix/issues/10282#issuecomment-1742562871
@zhangyuthink So how about an additional `passwords` field. The schema will allow only one of `password` or `passwords`. If you configure `passwords`, then all the passwords will be checked until there is a match. Although I am not really sure of the performance hit if we don't cap the allowed number of passwords.
So in your scenario, you can change the consumer to now accept `passwords` consisting of both old and new.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Revolyssup commented on issue #10282: feat: As a user, I want to add another password field for the plugin basic-auth,such as passwd2,so that i can smoothly changing password.
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on issue #10282:
URL: https://github.com/apache/apisix/issues/10282#issuecomment-1742438691
@zhangyuthink At this time, if you're already changing secrets on the client side for this new password, why not just create a new consumer on APISIX with a new username as well and slowly update the clients to use the new username and password. After all clients are using the new consumer, delete the older one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to add another password field for the plugin basic-auth,such as passwd2,so that i can smoothly changing password. [apisix]
Posted by "zhangyuthink (via GitHub)" <gi...@apache.org>.
zhangyuthink commented on issue #10282:
URL: https://github.com/apache/apisix/issues/10282#issuecomment-1742549361
> @zhangyuthink So you're proposal is to allow for a legacy password that will stay valid for some amount of time and for that time both the new and legacy password will be valid?
yeah
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org