consumer-restriction

Description

The consumer-restriction Plugin allows users to set access restrictions based on Consumer, Route, or Service.

Attributes

NameTypeRequiredDefaultValid valuesDescription
typestringFalseconsumer_name[“consumer_name”, “consumer_group_id”, “service_id”, “route_id”]Type of object to base the restriction on.
whitelistarray[string]TrueList of objects to whitelist. Has a higher priority than allowed_by_methods.
blacklistarray[string]TrueList of objects to blacklist. Has a higher priority than whitelist.
rejected_codeintegerFalse403[200,…]HTTP status code returned when the request is rejected.
rejected_msgstringFalseMessage returned when the request is rejected.
allowed_by_methodsarray[object]False[“GET”, “POST”, “PUT”, “DELETE”, “PATCH”, “HEAD”, “OPTIONS”, “CONNECT”, “TRACE”, “PURGE”]List of allowed HTTP methods for a Consumer.
consumer-restriction - 图1note

The different values in the type attribute have these meanings:

  • consumer_name: Username of the Consumer to restrict access to a Route or a Service.
  • consumer_group_id: ID of the Consumer Group to restrict access to a Route or a Service.
  • service_id: ID of the Service to restrict access from a Consumer. Need to be used with an Authentication Plugin.
  • route_id: ID of the Route to restrict access from a Consumer.

Example usage

Restricting by consumer_name

The example below shows how you can use the consumer-restriction Plugin on a Route to restrict specific consumers.

You can first create two consumers jack1 and jack2:

  1. curl http://127.0.0.1:9180/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -i -d '
  2. {
  3. "username": "jack1",
  4. "plugins": {
  5. "basic-auth": {
  6. "username":"jack2019",
  7. "password": "123456"
  8. }
  9. }
  10. }'
  11. curl http://127.0.0.1:9180/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -i -d '
  12. {
  13. "username": "jack2",
  14. "plugins": {
  15. "basic-auth": {
  16. "username":"jack2020",
  17. "password": "123456"
  18. }
  19. }
  20. }'

Next, you can configure the Plugin to the Route:

  1. curl http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3. "uri": "/index.html",
  4. "upstream": {
  5. "type": "roundrobin",
  6. "nodes": {
  7. "127.0.0.1:1980": 1
  8. }
  9. },
  10. "plugins": {
  11. "basic-auth": {},
  12. "consumer-restriction": {
  13. "whitelist": [
  14. "jack1"
  15. ]
  16. }
  17. }
  18. }'

Now, this configuration will only allow jack1 to access your Route:

  1. curl -u jack2019:123456 http://127.0.0.1:9080/index.html
  1. HTTP/1.1 200 OK

And requests from jack2 are blocked:

  1. curl -u jack2020:123456 http://127.0.0.1:9080/index.html -i
  1. HTTP/1.1 403 Forbidden
  2. ...
  3. {"message":"The consumer_name is forbidden."}

Restricting by allowed_by_methods

The example below configures the Plugin to a Route to restrict jack1 to only make POST requests:

  1. curl http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3. "uri": "/index.html",
  4. "upstream": {
  5. "type": "roundrobin",
  6. "nodes": {
  7. "127.0.0.1:1980": 1
  8. }
  9. },
  10. "plugins": {
  11. "basic-auth": {},
  12. "consumer-restriction": {
  13. "allowed_by_methods":[{
  14. "user": "jack1",
  15. "methods": ["POST"]
  16. }]
  17. }
  18. }
  19. }'

Now if jack1 makes a GET request, the access is restricted:

  1. curl -u jack2019:123456 http://127.0.0.1:9080/index.html
  1. HTTP/1.1 403 Forbidden
  2. ...
  3. {"message":"The consumer_name is forbidden."}

To also allow GET requests, you can update the Plugin configuration and it would be reloaded automatically:

  1. curl http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3. "uri": "/index.html",
  4. "upstream": {
  5. "type": "roundrobin",
  6. "nodes": {
  7. "127.0.0.1:1980": 1
  8. }
  9. },
  10. "plugins": {
  11. "basic-auth": {},
  12. "consumer-restriction": {
  13. "allowed_by_methods":[{
  14. "user": "jack1",
  15. "methods": ["POST","GET"]
  16. }]
  17. }
  18. }
  19. }'

Now, if a GET request is made:

  1. curl -u jack2019:123456 http://127.0.0.1:9080/index.html
  1. HTTP/1.1 200 OK

Restricting by service_id

To restrict a Consumer from accessing a Service, you also need to use an Authentication Plugin. The example below uses the key-auth Plugin.

First, you can create two services:

  1. curl http://127.0.0.1:9180/apisix/admin/services/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3. "upstream": {
  4. "nodes": {
  5. "127.0.0.1:1980": 1
  6. },
  7. "type": "roundrobin"
  8. },
  9. "desc": "new service 001"
  10. }'
  11. curl http://127.0.0.1:9180/apisix/admin/services/2 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  12. {
  13. "upstream": {
  14. "nodes": {
  15. "127.0.0.1:1980": 1
  16. },
  17. "type": "roundrobin"
  18. },
  19. "desc": "new service 002"
  20. }'

Then configure the consumer-restriction Plugin on the Consumer with the key-auth Plugin and the service_id to whitelist.

  1. curl http://127.0.0.1:9180/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3. "username": "new_consumer",
  4. "plugins": {
  5. "key-auth": {
  6. "key": "auth-jack"
  7. },
  8. "consumer-restriction": {
  9. "type": "service_id",
  10. "whitelist": [
  11. "1"
  12. ],
  13. "rejected_code": 403
  14. }
  15. }
  16. }'

Finally, you can configure the key-auth Plugin and bind the service to the Route:

  1. curl http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3. "uri": "/index.html",
  4. "upstream": {
  5. "type": "roundrobin",
  6. "nodes": {
  7. "127.0.0.1:1980": 1
  8. }
  9. },
  10. "service_id": 1,
  11. "plugins": {
  12. "key-auth": {
  13. }
  14. }
  15. }'

Now, if you test the Route, you should be able to access the Service:

  1. curl http://127.0.0.1:9080/index.html -H 'apikey: auth-jack' -i
  1. HTTP/1.1 200 OK
  2. ...

Now, if the Route is configured to the Service with service_id 2:

  1. curl http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3. "uri": "/index.html",
  4. "upstream": {
  5. "type": "roundrobin",
  6. "nodes": {
  7. "127.0.0.1:1980": 1
  8. }
  9. },
  10. "service_id": 2,
  11. "plugins": {
  12. "key-auth": {
  13. }
  14. }
  15. }'

Since the Service is not in the whitelist, it cannot be accessed:

  1. curl http://127.0.0.1:9080/index.html -H 'apikey: auth-jack' -i
  1. HTTP/1.1 403 Forbidden
  2. ...
  3. {"message":"The service_id is forbidden."}

Disable Plugin

To disable the consumer-restriction Plugin, you can delete the corresponding JSON configuration from the Plugin configuration. APISIX will automatically reload and you do not have to restart for this to take effect.

  1. curl http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3. "uri": "/index.html",
  4. "upstream": {
  5. "type": "roundrobin",
  6. "nodes": {
  7. "127.0.0.1:1980": 1
  8. }
  9. },
  10. "plugins": {
  11. "basic-auth": {}
  12. }
  13. }'