mirror of
https://github.com/alibaba/higress.git
synced 2026-04-27 23:17:26 +08:00
key auth support multiple credentials (#1956)
Co-authored-by: Kent Dong <ch3cho@qq.com>
This commit is contained in:
澄潭
GitHub
@@ -45,15 +45,13 @@ namespace {
|
||||
const std::string OriginalAuthKey("X-HI-ORIGINAL-AUTH");
|
||||
|
||||
void deniedInvalidCredentials(const std::string& realm) {
|
||||
sendLocalResponse(401, "Request denied by Key Auth check. Invalid API key",
|
||||
"",
|
||||
sendLocalResponse(401, "Request denied by Key Auth check. Invalid API key", "",
|
||||
{{"WWW-Authenticate", absl::StrCat("Key realm=", realm)}});
|
||||
}
|
||||
|
||||
void deniedUnauthorizedConsumer(const std::string& realm) {
|
||||
sendLocalResponse(
|
||||
403, "Request denied by Key Auth check. Unauthorized consumer", "",
|
||||
{{"WWW-Authenticate", absl::StrCat("Basic realm=", realm)}});
|
||||
sendLocalResponse(403, "Request denied by Key Auth check. Unauthorized consumer", "",
|
||||
{{"WWW-Authenticate", absl::StrCat("Basic realm=", realm)}});
|
||||
}
|
||||
|
||||
} // namespace
|
||||
@@ -62,12 +60,16 @@ bool PluginRootContext::parsePluginConfig(const json& configuration,
|
||||
KeyAuthConfigRule& rule) {
|
||||
if ((configuration.find("consumers") != configuration.end()) &&
|
||||
(configuration.find("credentials") != configuration.end())) {
|
||||
LOG_WARN(
|
||||
"The consumers field and the credentials field cannot appear at the "
|
||||
"same level");
|
||||
LOG_WARN("The consumers field and the credentials field cannot appear at the same level");
|
||||
return false;
|
||||
}
|
||||
if (!JsonArrayIterate(
|
||||
if ((configuration.find("consumers") == configuration.end()) &&
|
||||
(configuration.find("credentials") == configuration.end())) {
|
||||
LOG_WARN("No consumers and no credentials");
|
||||
return false;
|
||||
}
|
||||
if (configuration.find("credentials") != configuration.end()) {
|
||||
if (!JsonArrayIterate(
|
||||
configuration, "credentials", [&](const json& credentials) -> bool {
|
||||
auto credential = JsonValueAs<std::string>(credentials);
|
||||
if (credential.second != Wasm::Common::JsonParserResultDetail::OK) {
|
||||
@@ -76,34 +78,93 @@ bool PluginRootContext::parsePluginConfig(const json& configuration,
|
||||
rule.credentials.insert(credential.first.value());
|
||||
return true;
|
||||
})) {
|
||||
LOG_WARN("failed to parse configuration for credentials.");
|
||||
return false;
|
||||
LOG_WARN("failed to parse configuration for credentials.");
|
||||
return false;
|
||||
}
|
||||
if (!JsonArrayIterate(configuration, "keys", [&](const json& item) -> bool {
|
||||
auto key = JsonValueAs<std::string>(item);
|
||||
if (key.second != Wasm::Common::JsonParserResultDetail::OK) {
|
||||
return false;
|
||||
}
|
||||
rule.keys.push_back(key.first.value());
|
||||
return true;
|
||||
})) {
|
||||
LOG_WARN("failed to parse configuration for keys.");
|
||||
return false;
|
||||
}
|
||||
if (rule.keys.empty()) {
|
||||
LOG_WARN("at least one key has to be configured for a rule.");
|
||||
return false;
|
||||
}
|
||||
rule.keys.push_back(OriginalAuthKey);
|
||||
auto it = configuration.find("realm");
|
||||
if (it != configuration.end()) {
|
||||
auto realm_string = JsonValueAs<std::string>(it.value());
|
||||
if (realm_string.second != Wasm::Common::JsonParserResultDetail::OK) {
|
||||
return false;
|
||||
}
|
||||
rule.realm = realm_string.first.value();
|
||||
}
|
||||
it = configuration.find("in_query");
|
||||
if (it != configuration.end()) {
|
||||
auto in_query = JsonValueAs<bool>(it.value());
|
||||
if (in_query.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!in_query.first) {
|
||||
LOG_WARN("failed to parse 'in_query' field in filter configuration.");
|
||||
return false;
|
||||
}
|
||||
rule.in_query = in_query.first.value();
|
||||
}
|
||||
it = configuration.find("in_header");
|
||||
if (it != configuration.end()) {
|
||||
auto in_header = JsonValueAs<bool>(it.value());
|
||||
if (in_header.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!in_header.first) {
|
||||
LOG_WARN("failed to parse 'in_header' field in filter configuration.");
|
||||
return false;
|
||||
}
|
||||
rule.in_header = in_header.first.value();
|
||||
}
|
||||
if (!rule.in_query && !rule.in_header) {
|
||||
LOG_WARN("at least one of 'in_query' and 'in_header' must set to true");
|
||||
return false;
|
||||
}
|
||||
// LOG_DEBUG(rule.debugString("parse phase, credentials branch"));
|
||||
}
|
||||
if (!JsonArrayIterate(
|
||||
configuration, "consumers", [&](const json& consumer) -> bool {
|
||||
Consumer c;
|
||||
auto item = consumer.find("name");
|
||||
if (item == consumer.end()) {
|
||||
LOG_WARN("can't find 'name' field in consumer.");
|
||||
return false;
|
||||
}
|
||||
auto name = JsonValueAs<std::string>(item.value());
|
||||
if (name.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!name.first) {
|
||||
return false;
|
||||
}
|
||||
c.name = name.first.value();
|
||||
item = consumer.find("credential");
|
||||
if (item == consumer.end()) {
|
||||
LOG_WARN("can't find 'credential' field in consumer.");
|
||||
return false;
|
||||
}
|
||||
if (configuration.find("consumers") != configuration.end()) {
|
||||
bool need_global_keys = false;
|
||||
if (!JsonArrayIterate(
|
||||
configuration, "consumers", [&](const json& consumer) -> bool {
|
||||
Consumer c;
|
||||
auto item = consumer.find("name");
|
||||
if (item == consumer.end()) {
|
||||
LOG_WARN("can't find 'name' field in consumer.");
|
||||
return false;
|
||||
}
|
||||
auto name = JsonValueAs<std::string>(item.value());
|
||||
if (name.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!name.first) {
|
||||
return false;
|
||||
}
|
||||
c.name = name.first.value();
|
||||
if (consumer.find("credential") != consumer.end() &&
|
||||
consumer.find("credentials") != consumer.end()) {
|
||||
LOG_WARN("'credential' and 'credentials' can't appear at the same time.");
|
||||
return false;
|
||||
}
|
||||
if (consumer.find("credential") == consumer.end() &&
|
||||
consumer.find("credentials") == consumer.end()) {
|
||||
LOG_WARN("at least one of 'credential' and 'credentials' should be set.");
|
||||
return false;
|
||||
}
|
||||
item = consumer.find("credential");
|
||||
if (item != consumer.end()) {
|
||||
auto credential = JsonValueAs<std::string>(item.value());
|
||||
if (credential.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!credential.first) {
|
||||
return false;
|
||||
}
|
||||
c.credential = credential.first.value();
|
||||
c.credentials.insert(credential.first.value());
|
||||
if (rule.credential_to_name.find(credential.first.value()) !=
|
||||
rule.credential_to_name.end()) {
|
||||
LOG_WARN(absl::StrCat("duplicate consumer credential: ",
|
||||
@@ -113,106 +174,118 @@ bool PluginRootContext::parsePluginConfig(const json& configuration,
|
||||
rule.credentials.insert(credential.first.value());
|
||||
rule.credential_to_name.emplace(
|
||||
std::make_pair(credential.first.value(), name.first.value()));
|
||||
item = consumer.find("keys");
|
||||
if (item != consumer.end()) {
|
||||
c.keys = std::vector<std::string>{OriginalAuthKey};
|
||||
}
|
||||
item = consumer.find("credentials");
|
||||
if (item != consumer.end()) {
|
||||
if (!JsonArrayIterate(
|
||||
consumer, "keys", [&](const json& key_json) -> bool {
|
||||
auto key = JsonValueAs<std::string>(key_json);
|
||||
if (key.second !=
|
||||
Wasm::Common::JsonParserResultDetail::OK) {
|
||||
return false;
|
||||
}
|
||||
c.keys->push_back(key.first.value());
|
||||
return true;
|
||||
})) {
|
||||
LOG_WARN("failed to parse configuration for consumer keys.");
|
||||
consumer, "credentials", [&](const json& credential_json) -> bool {
|
||||
auto credential = JsonValueAs<std::string>(credential_json);
|
||||
if (credential.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!credential.first) {
|
||||
return false;
|
||||
}
|
||||
c.credentials.insert(credential.first.value());
|
||||
if (rule.credential_to_name.find(credential.first.value()) !=
|
||||
rule.credential_to_name.end()) {
|
||||
LOG_WARN(absl::StrCat("duplicate consumer credential: ",
|
||||
credential.first.value()));
|
||||
return false;
|
||||
}
|
||||
rule.credentials.insert(credential.first.value());
|
||||
rule.credential_to_name.emplace(
|
||||
std::make_pair(credential.first.value(), name.first.value()));
|
||||
return true;
|
||||
})) {
|
||||
LOG_WARN(absl::StrCat("failed to parse credentials for consumer: ", c.name));
|
||||
return false;
|
||||
}
|
||||
item = consumer.find("in_query");
|
||||
if (item != consumer.end()) {
|
||||
auto in_query = JsonValueAs<bool>(item.value());
|
||||
if (in_query.second !=
|
||||
Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!in_query.first) {
|
||||
LOG_WARN(
|
||||
"failed to parse 'in_query' field in consumer "
|
||||
"configuration.");
|
||||
return false;
|
||||
}
|
||||
c.in_query = in_query.first;
|
||||
}
|
||||
item = consumer.find("in_header");
|
||||
if (item != consumer.end()) {
|
||||
auto in_header = JsonValueAs<bool>(item.value());
|
||||
if (in_header.second !=
|
||||
Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!in_header.first) {
|
||||
LOG_WARN(
|
||||
"failed to parse 'in_header' field in consumer "
|
||||
"configuration.");
|
||||
return false;
|
||||
}
|
||||
c.in_header = in_header.first;
|
||||
}
|
||||
}
|
||||
item = consumer.find("keys");
|
||||
if (item == consumer.end()) {
|
||||
LOG_WARN("not found keys configuration for consumer " + c.name + ", will use global configuration to extract keys");
|
||||
need_global_keys = true;
|
||||
} else {
|
||||
c.keys = std::vector<std::string>{OriginalAuthKey};
|
||||
if (!JsonArrayIterate(
|
||||
consumer, "keys", [&](const json& key_json) -> bool {
|
||||
auto key = JsonValueAs<std::string>(key_json);
|
||||
if (key.second !=
|
||||
Wasm::Common::JsonParserResultDetail::OK) {
|
||||
return false;
|
||||
}
|
||||
c.keys->push_back(key.first.value());
|
||||
return true;
|
||||
})) {
|
||||
LOG_WARN("failed to parse configuration for consumer keys.");
|
||||
return false;
|
||||
}
|
||||
rule.consumers.push_back(std::move(c));
|
||||
item = consumer.find("in_query");
|
||||
if (item != consumer.end()) {
|
||||
auto in_query = JsonValueAs<bool>(item.value());
|
||||
if (in_query.second != Wasm::Common::JsonParserResultDetail::OK || !in_query.first) {
|
||||
LOG_WARN("failed to parse 'in_query' field in consumer configuration.");
|
||||
return false;
|
||||
}
|
||||
c.in_query = in_query.first;
|
||||
}
|
||||
item = consumer.find("in_header");
|
||||
if (item != consumer.end()) {
|
||||
auto in_header = JsonValueAs<bool>(item.value());
|
||||
if (in_header.second !=
|
||||
Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!in_header.first) {
|
||||
LOG_WARN(
|
||||
"failed to parse 'in_header' field in consumer "
|
||||
"configuration.");
|
||||
return false;
|
||||
}
|
||||
c.in_header = in_header.first;
|
||||
}
|
||||
}
|
||||
rule.consumers.push_back(std::move(c));
|
||||
return true;
|
||||
})) {
|
||||
LOG_WARN("failed to parse configuration for credentials.");
|
||||
return false;
|
||||
}
|
||||
if (need_global_keys) {
|
||||
if (!JsonArrayIterate(configuration, "keys", [&](const json& item) -> bool {
|
||||
auto key = JsonValueAs<std::string>(item);
|
||||
if (key.second != Wasm::Common::JsonParserResultDetail::OK) {
|
||||
return false;
|
||||
}
|
||||
rule.keys.push_back(key.first.value());
|
||||
return true;
|
||||
})) {
|
||||
LOG_WARN("failed to parse configuration for credentials.");
|
||||
return false;
|
||||
}
|
||||
// if (rule.credentials.empty()) {
|
||||
// LOG_INFO("at least one credential has to be configured for a rule.");
|
||||
// return false;
|
||||
// }
|
||||
if (!JsonArrayIterate(configuration, "keys", [&](const json& item) -> bool {
|
||||
auto key = JsonValueAs<std::string>(item);
|
||||
if (key.second != Wasm::Common::JsonParserResultDetail::OK) {
|
||||
LOG_WARN("failed to parse configuration for keys.");
|
||||
return false;
|
||||
}
|
||||
auto it = configuration.find("in_query");
|
||||
if (it != configuration.end()) {
|
||||
auto in_query = JsonValueAs<bool>(it.value());
|
||||
if (in_query.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!in_query.first) {
|
||||
LOG_WARN("failed to parse 'in_query' field in filter configuration.");
|
||||
return false;
|
||||
}
|
||||
rule.keys.push_back(key.first.value());
|
||||
return true;
|
||||
})) {
|
||||
LOG_WARN("failed to parse configuration for keys.");
|
||||
return false;
|
||||
}
|
||||
if (rule.keys.empty()) {
|
||||
LOG_WARN("at least one key has to be configured for a rule.");
|
||||
return false;
|
||||
}
|
||||
rule.keys.push_back(OriginalAuthKey);
|
||||
auto it = configuration.find("realm");
|
||||
if (it != configuration.end()) {
|
||||
auto realm_string = JsonValueAs<std::string>(it.value());
|
||||
if (realm_string.second != Wasm::Common::JsonParserResultDetail::OK) {
|
||||
return false;
|
||||
rule.in_query = in_query.first.value();
|
||||
}
|
||||
it = configuration.find("in_header");
|
||||
if (it != configuration.end()) {
|
||||
auto in_header = JsonValueAs<bool>(it.value());
|
||||
if (in_header.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!in_header.first) {
|
||||
LOG_WARN("failed to parse 'in_header' field in filter configuration.");
|
||||
return false;
|
||||
}
|
||||
rule.in_header = in_header.first.value();
|
||||
}
|
||||
if (!rule.in_query && !rule.in_header) {
|
||||
LOG_WARN("at least one of 'in_query' and 'in_header' must set to true");
|
||||
return false;
|
||||
}
|
||||
}
|
||||
rule.realm = realm_string.first.value();
|
||||
}
|
||||
it = configuration.find("in_query");
|
||||
if (it != configuration.end()) {
|
||||
auto in_query = JsonValueAs<bool>(it.value());
|
||||
if (in_query.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!in_query.first) {
|
||||
LOG_WARN("failed to parse 'in_query' field in filter configuration.");
|
||||
return false;
|
||||
}
|
||||
rule.in_query = in_query.first.value();
|
||||
}
|
||||
it = configuration.find("in_header");
|
||||
if (it != configuration.end()) {
|
||||
auto in_header = JsonValueAs<bool>(it.value());
|
||||
if (in_header.second != Wasm::Common::JsonParserResultDetail::OK ||
|
||||
!in_header.first) {
|
||||
LOG_WARN("failed to parse 'in_header' field in filter configuration.");
|
||||
return false;
|
||||
}
|
||||
rule.in_header = in_header.first.value();
|
||||
}
|
||||
if (!rule.in_query && !rule.in_header) {
|
||||
LOG_WARN("at least one of 'in_query' and 'in_header' must set to true");
|
||||
return false;
|
||||
// LOG_DEBUG(rule.debugString("parse phase, consumers branch"));
|
||||
}
|
||||
return true;
|
||||
}
|
||||
@@ -220,6 +293,7 @@ bool PluginRootContext::parsePluginConfig(const json& configuration,
|
||||
bool PluginRootContext::checkPlugin(
|
||||
const KeyAuthConfigRule& rule,
|
||||
const std::optional<std::unordered_set<std::string>>& allow_set) {
|
||||
// LOG_DEBUG(rule.debugString("check phase"));
|
||||
if (rule.consumers.empty()) {
|
||||
for (const auto& key : rule.keys) {
|
||||
auto credential = extractCredential(rule.in_header, rule.in_query, key);
|
||||
@@ -263,9 +337,8 @@ bool PluginRootContext::checkPlugin(
|
||||
continue;
|
||||
}
|
||||
|
||||
if (credential != consumer.credential) {
|
||||
LOG_DEBUG("credential does not match the consumer's credential: " +
|
||||
credential);
|
||||
if (consumer.credentials.find(credential) == consumer.credentials.end()) {
|
||||
LOG_DEBUG("credential " + credential + " does not match the consumer " + consumer.name);
|
||||
continue;
|
||||
}
|
||||
|
||||
@@ -277,9 +350,13 @@ bool PluginRootContext::checkPlugin(
|
||||
|
||||
auto credential_to_name_iter = rule.credential_to_name.find(credential);
|
||||
if (credential_to_name_iter != rule.credential_to_name.end()) {
|
||||
if (allow_set && !allow_set->empty()) {
|
||||
if (allow_set->find(credential_to_name_iter->second) ==
|
||||
allow_set->end()) {
|
||||
if (allow_set) {
|
||||
if (allow_set->empty()) {
|
||||
LOG_DEBUG("allow set is empty, nobody is allowed");
|
||||
deniedUnauthorizedConsumer(rule.realm);
|
||||
return false;
|
||||
}
|
||||
if (allow_set->find(credential_to_name_iter->second) == allow_set->end()) {
|
||||
deniedUnauthorizedConsumer(rule.realm);
|
||||
LOG_DEBUG("unauthorized consumer: " +
|
||||
credential_to_name_iter->second);
|
||||
|
||||
Reference in New Issue
Block a user