apache / apache/apisix

feat: As a user, I want to use forward-auth as part of multi-auth, so that I can keep my route configuration simple

Open
#11,209 5 comments 2 reactions 0 assignees View on GitHub
feature-request
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Description

I have OAuth2-Proxy implemented to protect endpoints for front-end and back-end APIs.

The `multi-auth` plugin is helpful to implement `basic-auth` and `key-auth`. However, for front end web app, we would like to use the `SESSION` cookie set by `OAuth2-Proxy` via the `forward-auth` plugin in APISIX to keep the route configuration simple.

It works very well with the below configuration:

```JSONC
// Works!
{
"uri": "/echo",
"name": "api-example",
"plugins": {
"forward-auth": {
"uri": "http://my-release-oauth2-proxy:4180/oauth2/auth",
"request_headers": ["Cookie"],
"upstream_headers": ["Cookie"],
"client_headers": ["Location"]
}
},
"upstream": {
"nodes": [
{
"host": "my-release-api-example",
"port": 1234,
"weight": 1
}
],
"type": "ewma",
"scheme": "http",
"pass_host": "pass"
}
}
```

But it would be good to also make it work with below configuration:

```JSONC
// Does not work!
{
"uri": "/echo",
"name": "api-example",
"plugins": {
"multi-auth": {
"auth_plugins": [
{
"basic-auth": {}
},
{
"key-auth":{
"query":"apikey",
"hide_credentials":true,
"header":"apikey"
}
},
{
"forward-auth": {
"uri": "http://my-release-oauth2-proxy:4180/oauth2/auth",
"request_headers": ["Cookie"],
"upstream_headers": ["Cookie"],
"client_headers": ["Location"]
}
}
]
}
},
"upstream": {
"nodes": [
{
"host": "my-release-api-example",
"port": 1234,
"weight": 1
}
],
"type": "ewma",
"scheme": "http",
"pass_host": "pass"
}
}
// Get response from APISIX as:
// {"error_msg":"failed to check the configuration of plugin multi-auth err: forward-auth plugin is not supported"}
```

There are many workarounds and this is not a blocker. But would be very nice to have.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the multi-auth configuration error with the forward-auth example and compare it with the standalone forward-auth configuration shown in the issue. Trace the multi-auth plugin's supported-plugin validation and integration behavior; done means forward-auth is accepted in auth_plugins and the combined configuration preserves the documented authentication and header behavior.

Written by the indexing model from the issue text.

Assessment

Domain
api, backend
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.