mirror of
https://github.com/alibaba/higress.git
synced 2026-05-27 06:07:27 +08:00
feat(ext-auth): add support for allowed properties forwarding in external authorization requests (#3694)
Signed-off-by: CH3CHO <ch3cho@qq.com>
This commit is contained in:
Kent Dong
GitHub
@@ -51,10 +51,18 @@ description: Ext 认证插件实现了调用外部授权服务进行认证鉴权
|
||||
| 名称 | 数据类型 | 必填 | 默认值 | 描述 |
|
||||
|--------------------------|------------------------|------|--------|--------------------------------------------------------------|
|
||||
| `allowed_headers` | array of StringMatcher | 否 | - | 设置后，匹配项的客户端请求头将添加到授权服务请求中的请求头中。除了用户自定义的头部匹配规则外，授权服务请求中会自动包含 `Authorization` 这个HTTP头（`endpoint_mode` 为 `forward_auth` 时，会添加 `X-Forwarded-*` 的请求头） |
|
||||
| `allowed_properties` | array of AllowedProperty | 否 | - | 设置后将把 Envoy filter state 中的 property 映射为 HTTP header 发送给授权服务。<br>Envoy 支持的 property 列表参见下方文档：<br><ul><li>Envoy 1.27（Higress < 2.2.0）：https://www.envoyproxy.io/docs/envoy/v1.27.0/intro/arch_overview/advanced/attributes</li><li>Envoy 1.36（Higress >= 2.2.0）：https://www.envoyproxy.io/docs/envoy/v1.36.0/intro/arch_overview/advanced/attributes</li></ul> |
|
||||
| `headers_to_add` | map[string]string | 否 | - | 设置将包含在授权服务请求中的请求头列表。请注意，同名的客户端请求头将被覆盖 |
|
||||
| `with_request_body` | bool | 否 | false | 缓冲客户端请求体，并将其发送至鉴权请求中（HTTP Method为GET、OPTIONS、HEAD请求时不生效） |
|
||||
| `max_request_body_bytes` | int | 否 | 10MB | 设置在内存中保存客户端请求体的最大尺寸。当客户端请求体达到在此字段中设置的数值时，将会返回HTTP 413状态码，并且不会启动授权过程。注意，这个设置会优先于 `failure_mode_allow` 的配置 |
|
||||
|
||||
`AllowedProperty` 类型每一项的配置字段说明
|
||||
|
||||
| 名称 | 数据类型 | 必填 | 默认值 | 描述 |
|
||||
|------------|----------|------|--------|--------------------------------------------------------------|
|
||||
| `path` | array of string | 是 | - | 属性路径，如 `["route_name"]` 或 `["metadata", "user_id"]` |
|
||||
| `header` | string | 是 | - | 映射到的请求头名称 |
|
||||
|
||||
`authorization_response` 中每一项的配置字段说明
|
||||
|
||||
| 名称 | 数据类型 | 必填 | 默认值 | 描述 |
|
||||
@@ -235,7 +243,52 @@ Content-Length: 0
|
||||
|
||||
`ext-auth` 服务返回响应头中如果包含 `x-user-id` 和 `x-auth-version`，网关调用upstream时的请求中会带上这两个请求头
|
||||
|
||||
#### 示例3：传递路由名称到授权服务
|
||||
|
||||
`ext-auth` 插件的配置：
|
||||
|
||||
```yaml
|
||||
http_service:
|
||||
authorization_request:
|
||||
allowed_headers:
|
||||
- exact: x-auth-version
|
||||
allowed_properties:
|
||||
- path: [route_name]
|
||||
header: x-route-name
|
||||
headers_to_add:
|
||||
x-envoy-header: true
|
||||
authorization_response:
|
||||
allowed_upstream_headers:
|
||||
- exact: x-user-id
|
||||
- exact: x-auth-version
|
||||
endpoint_mode: envoy
|
||||
endpoint:
|
||||
service_name: ext-auth.backend.svc.cluster.local
|
||||
service_host: my-domain.local
|
||||
service_port: 8090
|
||||
path_prefix: /auth
|
||||
timeout: 1000
|
||||
```
|
||||
|
||||
使用如下请求网关，当开启 `ext-auth` 插件后：
|
||||
|
||||
```shell
|
||||
curl -X POST http://localhost:8082/users?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -X GET -H "foo: bar" -H "Authorization: xxx"
|
||||
```
|
||||
|
||||
`ext-auth` 服务将接收到如下的鉴权请求：
|
||||
|
||||
```
|
||||
POST /auth/users?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 HTTP/1.1
|
||||
Host: my-domain.local
|
||||
Authorization: xxx
|
||||
X-Auth-Version: 1.0
|
||||
x-envoy-header: true
|
||||
Content-Length: 0
|
||||
X-Route-Name: your-route-name
|
||||
```
|
||||
|
||||
通过 `allowed_properties` 配置，可以将 Envoy filter state 中的 `route_name` 等属性映射为 HTTP header 发送给授权服务，便于授权服务根据路由信息进行鉴权决策。
|
||||
|
||||
### endpoint_mode为forward_auth时
|
||||
|
||||
@@ -340,4 +393,53 @@ x-envoy-header: true
|
||||
Content-Length: 0
|
||||
```
|
||||
|
||||
`ext-auth` 服务返回响应头中如果包含 `x-user-id` 和 `x-auth-version`，网关调用upstream时的请求中会带上这两个请求头
|
||||
`ext-auth` 服务返回响应头中如果包含 `x-user-id` 和 `x-auth-version`，网关调用upstream时的请求中会带上这两个请求头
|
||||
|
||||
#### 示例3：传递路由名称到授权服务
|
||||
|
||||
`ext-auth` 插件的配置：
|
||||
|
||||
```yaml
|
||||
http_service:
|
||||
authorization_request:
|
||||
allowed_headers:
|
||||
- exact: x-auth-version
|
||||
allowed_properties:
|
||||
- path: [route_name]
|
||||
header: x-route-name
|
||||
authorization_response:
|
||||
allowed_upstream_headers:
|
||||
- exact: x-mse-consumer
|
||||
- exact: x-ext-auth-user
|
||||
endpoint_mode: forward_auth
|
||||
endpoint:
|
||||
service_name: ext-auth.backend.svc.cluster.local
|
||||
service_port: 8090
|
||||
path: /auth
|
||||
request_method: POST
|
||||
timeout: 1000
|
||||
```
|
||||
|
||||
使用如下请求网关，当开启 `ext-auth` 插件后：
|
||||
|
||||
```shell
|
||||
curl -i http://localhost:8082/users?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -X GET -H "foo: bar" -H "Authorization: xxx" -H "X-Auth-Version: 1.0" -H "Host: foo.bar.com"
|
||||
```
|
||||
|
||||
`ext-auth` 服务将接收到如下的鉴权请求：
|
||||
|
||||
```
|
||||
POST /auth HTTP/1.1
|
||||
Host: my-domain.local
|
||||
Authorization: xxx
|
||||
X-Forwarded-Proto: HTTP
|
||||
X-Forwarded-Host: foo.bar.com
|
||||
X-Forwarded-Uri: /users?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5
|
||||
X-Forwarded-Method: GET
|
||||
X-Auth-Version: 1.0
|
||||
x-envoy-header: true
|
||||
X-Route-Name: your-route-name
|
||||
Content-Length: 0
|
||||
```
|
||||
|
||||
通过 `allowed_properties` 配置，可以将 Envoy filter state 中的 `route_name` 等属性映射为 HTTP header 发送给授权服务，便于授权服务根据路由信息进行鉴权决策。
|
||||
Reference in New Issue
Block a user