forward-auth

Description

The forward-auth Plugin implements a classic external authentication model. When authentication fails, you can have a custom error message or redirect the user to an authentication page.

This Plugin moves the authentication and authorization logic to a dedicated external service. APISIX forwards the user’s requests to the external service, blocks the original request, and replaces the result when the external service responds with a non 2xx status code.

Attributes

NameTypeRequiredDefaultValid valuesDescription
uristringTrueURI of the authorization service.
ssl_verifybooleanFalsetrueWhen set to true, verifies the SSL certificate.
request_methodstringFalseGET[“GET”,”POST”]HTTP method for a client to send requests to the authorization service. When set to POST the request body is send to the authorization service.
request_headersarray[string]FalseClient request headers to be sent to the authorization service. If not set, only the headers provided by APISIX are sent (for example, X-Forwarded-XXX).
upstream_headersarray[string]FalseAuthorization service response headers to be forwarded to the Upstream. If not set, no headers are forwarded to the Upstream service.
client_headersarray[string]FalseAuthorization service response headers to be sent to the client when authorization fails. If not set, no headers will be sent to the client.
timeoutintegerFalse3000ms[1, 60000]msTimeout for the authorization service HTTP call.
keepalivebooleanFalsetrueWhen set to true, keeps the connection alive for multiple requests.
keepalive_timeoutintegerFalse60000ms[1000, …]msIdle time after which the connection is closed.
keepalive_poolintegerFalse5[1, …]msConnection pool limit.

Data definition

APISIX will generate and the send the request headers listed below to the authorization service:

SchemeHTTP MethodHostURISource IP
X-Forwarded-ProtoX-Forwarded-MethodX-Forwarded-HostX-Forwarded-UriX-Forwarded-For

Example usage

First, you need to setup your external authorization service. The example below uses Apache APISIX’s serverless Plugin to mock the service:

  1. curl -X PUT 'http://127.0.0.1:9080/apisix/admin/routes/auth' \
  2. -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
  3. -H 'Content-Type: application/json' \
  4. -d '{
  5. "uri": "/auth",
  6. "plugins": {
  7. "serverless-pre-function": {
  8. "phase": "rewrite",
  9. "functions": [
  10. "return function (conf, ctx)
  11. local core = require(\"apisix.core\");
  12. local authorization = core.request.header(ctx, \"Authorization\");
  13. if authorization == \"123\" then
  14. core.response.exit(200);
  15. elseif authorization == \"321\" then
  16. core.response.set_header(\"X-User-ID\", \"i-am-user\");
  17. core.response.exit(200);
  18. else core.response.set_header(\"Location\", \"http://example.com/auth\");
  19. core.response.exit(403);
  20. end
  21. end"
  22. ]
  23. }
  24. }
  25. }'

Now you can configure the forward-auth Plugin to a specific Route:

  1. curl -X PUT 'http://127.0.0.1:9080/apisix/admin/routes/1' \
  2. -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
  3. -d '{
  4. "uri": "/headers",
  5. "plugins": {
  6. "forward-auth": {
  7. "uri": "http://127.0.0.1:9080/auth",
  8. "request_headers": ["Authorization"],
  9. "upstream_headers": ["X-User-ID"],
  10. "client_headers": ["Location"]
  11. }
  12. },
  13. "upstream": {
  14. "nodes": {
  15. "httpbin.org:80": 1
  16. },
  17. "type": "roundrobin"
  18. }
  19. }'

Now if we send the authorization details in the request header:

  1. curl http://127.0.0.1:9080/headers -H 'Authorization: 123'
  1. {
  2. "headers": {
  3. "Authorization": "123",
  4. "Next": "More-headers"
  5. }
  6. }

The authorization service response can also be forwarded to the Upstream:

  1. curl http://127.0.0.1:9080/headers -H 'Authorization: 321'
  1. {
  2. "headers": {
  3. "Authorization": "321",
  4. "X-User-ID": "i-am-user",
  5. "Next": "More-headers"
  6. }
  7. }

When authorization fails, the authorization service can send custom response back to the user:

  1. curl -i http://127.0.0.1:9080/headers
  1. HTTP/1.1 403 Forbidden
  2. Location: http://example.com/auth

Disable Plugin

To disable the forward-auth Plugin, you can delete the corresponding JSON configuration from the Plugin configuration. APISIX will automatically reload and you do not have to restart for this to take effect.

  1. curl http://127.0.0.1:2379/apisix/admin/routes/1 -X PUT -d value='
  2. {
  3. "methods": ["GET"],
  4. "uri": "/hello",
  5. "plugins": {},
  6. "upstream": {
  7. "type": "roundrobin",
  8. "nodes": {
  9. "127.0.0.1:1980": 1
  10. }
  11. }
  12. }'