Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: ext auth forward_auth endpoint_mode enhancement #1180

Merged
merged 7 commits into from
Aug 8, 2024

Conversation

hanxiantao
Copy link
Collaborator

@hanxiantao hanxiantao commented Aug 6, 2024

Ⅰ. Describe what this PR did

因为envoy和forward_auth两种endpoint_mode,envoy这种endpoint_mode目前是能拿到原始的requestMethod和requestPath,但forward_auth这种endpoint_mode暂不支持,考虑到鉴权大部分都会涉及requestMethod和requestPath,endpoint_mode为forward_auth时添加了X-Original-Method和X-Original-URI两个请求头

示例如下:
X-Original-Method: POST
X-Original-Uri: /path/to/resource?query=param

Ⅱ. Does this pull request fix one issue?

#1152

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

apiVersion: extensions.higress.io/v1alpha1
kind: WasmPlugin
metadata:
  name: test
  namespace: higress-system
spec:
  defaultConfig:
    http_service:
      authorization_request:
        allowed_headers:
          - exact: x-auth-version
        headers_to_add:
          x-envoy-header: true
      authorization_response:
        allowed_upstream_headers:
          - exact: x-user-id
          - exact: x-auth-version
      endpoint:
        path: /auth
        request_method: POST
        service_name: ext-auth.static
        service_port: 80
      endpoint_mode: forward_auth
      timeout: 1000
  imagePullSecret: aliyun
  url: >-
    oci://registry.cn-hangzhou.aliyuncs.com/wasm-plugin/wasm-plugin:ext-auth-0.0.85

1)原始请求为POST
image
认证服务收到的请求头中X-Original-Method为POST,X-Original-Uri为/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5
image

2)原始请求为PUT
image
认证服务收到的请求头中X-Original-Method为PUT,X-Original-Uri为/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5
image

Ⅴ. Special notes for reviews

@hanxiantao
Copy link
Collaborator Author

cc @jaggerwang

@codecov-commenter
Copy link

codecov-commenter commented Aug 6, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 35.95%. Comparing base (ef31e09) to head (a4d7472).
Report is 21 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #1180      +/-   ##
==========================================
+ Coverage   35.91%   35.95%   +0.04%     
==========================================
  Files          69       69              
  Lines       11576     9483    -2093     
==========================================
- Hits         4157     3410     -747     
+ Misses       7104     5757    -1347     
- Partials      315      316       +1     

see 67 files with indirect coverage changes

@hanxiantao
Copy link
Collaborator Author

ApiSix的forward-auth插件也做了对应支持,会向认证服务传原始Uri、Method、Host等信息

image

@@ -45,7 +45,7 @@ type HttpService struct {

type AuthorizationRequest struct {
// allowedHeaders In addition to the user’s supplied matchers,
// Host, Method, Path, Content-Length, and Authorization are automatically included to the list.
// Authorization are automatically included to the list
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

默认只带上游的Authorization头过去( endpoint_modeforward_auth 时,会把原始请求的请求路径设置到 X-Original-Uri ,原始请求的HTTP Method设置到 X-Original-Method ),我补充下后面这部分到注释里吧

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is?

已调整

@hanxiantao hanxiantao requested a review from CH3CHO August 7, 2024 03:07
@jaggerwang
Copy link

可以获取到了,谢谢!

Copy link
Collaborator

@johnlanni johnlanni left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@johnlanni johnlanni merged commit 53f8410 into alibaba:main Aug 8, 2024
12 checks passed
@hanxiantao hanxiantao deleted the enhancement-forward-auth-mode branch August 8, 2024 11:26
@CH3CHO
Copy link
Collaborator

CH3CHO commented Aug 9, 2024

镜像已更新,地址不变:higress-registry.cn-hangzhou.cr.aliyuncs.com/plugins/ext-auth:1.0.0

@hanxiantao
Copy link
Collaborator Author

@jaggerwang 你这边可以换成官方的镜像地址了

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants