feat: As a user, I want to use forward-auth as part of multi-auth, so that I can keep my route configuration simple
- Dominant language
- Lua
- Stars
- 17.1k
- Forks
- 2.9k
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 63
Description
### Description
I have OAuth2-Proxy implemented to protect endpoints for front-end and back-end APIs.
The `multi-auth` plugin is helpful to implement `basic-auth` and `key-auth`. However, for front end web app, we would like to use the `SESSION` cookie set by `OAuth2-Proxy` via the `forward-auth` plugin in APISIX to keep the route configuration simple.
It works very well with the below configuration:
```JSONC
// Works!
{
"uri": "/echo",
"name": "api-example",
"plugins": {
"forward-auth": {
"uri": "http://my-release-oauth2-proxy:4180/oauth2/auth",
"request_headers": ["Cookie"],
"upstream_headers": ["Cookie"],
"client_headers": ["Location"]
}
},
"upstream": {
"nodes": [
{
"host": "my-release-api-example",
"port": 1234,
"weight": 1
}
],
"type": "ewma",
"scheme": "http",
"pass_host": "pass"
}
}
```
But it would be good to also make it work with below configuration:
```JSONC
// Does not work!
{
"uri": "/echo",
"name": "api-example",
"plugins": {
"multi-auth": {
"auth_plugins": [
{
"basic-auth": {}
},
{
"key-auth":{
"query":"apikey",
"hide_credentials":true,
"header":"apikey"
}
},
{
"forward-auth": {
"uri": "http://my-release-oauth2-proxy:4180/oauth2/auth",
"request_headers": ["Cookie"],
"upstream_headers": ["Cookie"],
"client_headers": ["Location"]
}
}
]
}
},
"upstream": {
"nodes": [
{
"host": "my-release-api-example",
"port": 1234,
"weight": 1
}
],
"type": "ewma",
"scheme": "http",
"pass_host": "pass"
}
}
// Get response from APISIX as:
// {"error_msg":"failed to check the configuration of plugin multi-auth err: forward-auth plugin is not supported"}
```
There are many workarounds and this is not a blocker. But would be very nice to have.
Contributor guide
Research direction
Start by reproducing the multi-auth configuration error with the forward-auth example and compare it with the standalone forward-auth configuration shown in the issue. Trace the multi-auth plugin's supported-plugin validation and integration behavior; done means forward-auth is accepted in auth_plugins and the combined configuration preserves the documented authentication and header behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, backend
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100