Dynamically obtain token through routing requests

[myhgc]

Is there any way to dynamically request an interface to obtain a token and set it to the header of this request before a request passes through the route?

[dosubot[bot]]

Hey @myhgc! I'm here to help you out with any bugs, questions, or contributions you have. Let's squash those bugs together! 😄

Yes, you can dynamically request an interface to obtain a token and set it to the header of a request before it passes through the route using Apache APISIX. Here is how you can achieve this:

1. Configure the backend service (upstream):

   curl "http://127.0.0.1:9180/apisix/admin/upstreams/1" -X PUT -d '
   {
     "name": "Conferences API upstream",
     "desc": "Register Conferences API as the upstream",
     "type": "roundrobin",
     "scheme": "https",
     "nodes": {
       "conferenceapi.azurewebsites.net:443": 1
     }
   }'

2. Create a Plugin Config:

   curl "http://127.0.0.1:9180/apisix/admin/plugin_configs/1" -X PUT -d '
   {
       "plugins": {
           "openid-connect":{
               "client_id":"{YOUR_OKTA_CLIENT_ID}",
               "client_secret":"{YOUR_OKTA_CLIENT_SECRET}",
               "discovery":"https://{YOUR_OKTA_ISSUER}/oauth2/default/.well-known/openid-configuration",
               "scope":"openid",
               "bearer_only":true,
               "realm":"master",
               "introspection_endpoint_auth_method":"https://{YOUR_OKTA_ISSUER}/oauth2/v1/introspect",
               "redirect_uri":"https://conferenceapi.azurewebsites.net/"
           },
           "proxy-rewrite": {
               "uri": "/speaker/$http_speakerId/sessions",
               "host":"conferenceapi.azurewebsites.net"
           },
           "serverless-pre-function": {
               "phase": "rewrite",
               "functions" : ["return function(conf, ctx)
   
       -- Import necessary libraries
       local core = require(\"apisix.core\")
       local jwt = require(\"resty.jwt\")
   
       -- Retrieve the JWT token from the Authorization header
       local jwt_token = core.request.header(ctx, \"Authorization\")
       if jwt_token ~= nil then
           -- Remove the Bearer prefix from the JWT token
           local _, _, jwt_token_only = string.find(jwt_token, \"Bearer%s+(.+)\")
           if jwt_token_only ~= nil then
              -- Decode the JWT token
              local jwt_obj = jwt:load_jwt(jwt_token_only)
   
              if jwt_obj.valid then
                -- Retrieve the value of the speakerId claim from the JWT token
                local speakerId_claim_value = jwt_obj.payload.speakerId
   
                -- Store the speakerId claim value in the header variable
                core.request.set_header(ctx, \"speakerId\", speakerId_claim_value)
              end
            end
        end
      end
       "]}
       }
   }'

3. Configure a new Route:

   curl "http://127.0.0.1:9180/apisix/admin/routes/1"  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
   {
       "name":"Conferences API speaker sessions route",
       "desc":"Create a new route in APISIX for the Conferences API speaker sessions",
       "methods": ["GET"],
       "uri": "/sessions",
       "upstream_id":"1",
       "plugin_config_id":1
   }'

4. Obtain a token from Okta:

   https://{YOUR_OKTA_ISSUER}/oauth2/default/v1/authorize?client_id={YOUR_OKTA_CLIENT_ID}
   &response_type=id_token
   &scope=openid
   &redirect_uri=https%3A%2F%2Fconferenceapi.azurewebsites.net
   &state=myState
   &nonce=myNonceValue

5. Test the dynamic routing:

   curl -i -X "GET http://127.0.0.1:9080/sessions" -H "Authorization: Bearer {YOUR_OKTA_JWT_TOKEN}"

This setup uses the openid-connect, serverless-pre-function, and proxy-rewrite plugins to dynamically obtain a token, set it to the header, and route the request based on the JWT token's claim ^[1][2].

To continue talking to Dosu, mention @dosu.

[myhgc]

hi，@dosu Thank you for your receipt。Is it necessary to configure the openid-connect plugin? Because the only way I get the dynamic token is through a basic auth authentication http interface. After successfully calling the http interface with the username and password, a json containing a token attribute is returned. Then I need to set this token to the header of the route rewrite. Thank you!

[dosubot[bot]]

You don't need to configure the openid-connect plugin if you are obtaining the token through a basic auth authentication HTTP interface. You can achieve this using the serverless-pre-function plugin to make an HTTP request to obtain the token and set it in the request header.

Here is how you can do it:

1. Create a Plugin Config:

   curl "http://127.0.0.1:9180/apisix/admin/plugin_configs/1" -X PUT -d '
   {
       "plugins": {
           "serverless-pre-function": {
               "phase": "rewrite",
               "functions" : ["return function(conf, ctx)
                   -- Import necessary libraries
                   local core = require(\"apisix.core\")
                   local http = require(\"resty.http\")
   
                   -- Make an HTTP request to obtain the token
                   local httpc = http.new()
                   local res, err = httpc:request_uri(\"https://your-auth-server.com/token\", {
                       method = \"POST\",
                       body = \"grant_type=client_credentials&client_id=your_client_id&client_secret=your_client_secret\",
                       headers = {
                           [\"Content-Type\"] = \"application/x-www-form-urlencoded\",
                           [\"Authorization\"] = \"Basic \" .. ngx.encode_base64(\"username:password\")
                       },
                       ssl_verify = false
                   })
   
                   if not res then
                       core.log.error(\"failed to request token: \", err)
                       return
                   end
   
                   local token = core.json.decode(res.body).access_token
   
                   if token then
                       -- Set the token in the request header
                       core.request.set_header(ctx, \"Authorization\", \"Bearer \" .. token)
                   else
                       core.log.error(\"failed to obtain access token\")
                   end
               end"]
           }
       }
   }'

2. Configure a new Route:

   curl "http://127.0.0.1:9180/apisix/admin/routes/1" -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
   {
       "name": "Your Route Name",
       "desc": "Description of your route",
       "methods": ["GET", "POST"],  # Adjust methods as needed
       "uri": "/your/route/uri",
       "upstream": {
           "nodes": {
               "your-upstream-service:port": 1
           },
           "type": "roundrobin"
       },
       "plugin_config_id": 1
   }'

In this setup:

• The serverless-pre-function plugin makes an HTTP request to your authentication server using basic auth to obtain the token.
• The token is then set in the Authorization header of the request before it is forwarded to the upstream service.

Replace https://your-auth-server.com/token, your_client_id, your_client_secret, username, password, and other placeholders with your actual values.

This approach allows you to dynamically obtain a token and set it in the request header without needing the openid-connect plugin ^[1][2].

To continue talking to Dosu, mention @dosu.

[myhgc]

Thank you again for your help. I use basic-auth for the routing authentication plug-in, and an error {"message":"Invalid authorization in request"} will appear. But changing "phase": "rewrite" in the serverless-pre-function plug-in to "phase": "before_proxy" makes it work properly. Thank you!

[myhgc]

@Dusu Can the return function in functions be defined independently in the plugin file?

[dosubot[bot]]

Yes, the return function in the functions can be defined independently in the plugin file. The provided code snippets show that the functions are defined as strings within the plugin configurations. For example:

"functions" : ["return function(conf, ctx)
                ngx.say(\"serverless-post-function\");
                end"]

This indicates that the return function is defined within the plugin configuration itself, and not separately in the plugin file. According to the documentation, only Lua functions are allowed, and they can be anonymous functions or closures. Other Lua code is not permitted ^[1][2].

To continue talking to Dosu, mention @dosu.