apache / apache/apisix

help request: Is this a valid approach for creating a temporary consumer?

Open
#12,888 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Description

This is a follow up to [Bishnup1995](https://github.com/Bishnup1995)'s question regarding creating consumers from the openid-connect plugin
- #11015

I've created a plugin that parses the oidc identity token from the X-ID-Token header that the openid-connect plugin adds after succesfull authentication. The plugin configuration allows me to specify oidc role -> consumer mappings for the route, i.e.
```yaml
uris:
- /hello
plugins:
oidc-consumer:
consumers:
- id: read-only-user
oidc-roles:
- standard-user
- id: admin-user
oidc-roles:
- super-user
```

If a token role matches, the relevant consumer is attached to the request by calling the following function:
```lua
-- Attach an ephemeral consumer to the request context
-- https://github.com/apache/apisix/issues/11015#issuecomment-2994693291
--
-- Note: Consumer groups cannot added in this way, as they must be registered
-- via the consumer_groups module, which is system-wide, not request-scoped.
--
local consumer_mod = require("apisix.consumer")
local function attach_consumer(ctx, consumer_id, username)
local apisix_consumer_conf = {
conf_version = "oidc-tmp-consumer"
}

local apisix_consumer = {
-- Properties required by plugin.lua's _M.merge_consumer_route
id = consumer_id,
modifiedIndex = 0,
consumer_name = consumer_id,

-- Optional value for request header X-Credential-Identifier
credential_id = consumer_id,

-- Optional value for request header X-Consumer-Username
username = username,
}

consumer_mod.attach_consumer(ctx, apisix_consumer, apisix_consumer_conf)
end
```

Is this a valid approach?
Should this be handled differently?

Thanks!

### Environment

- APISIX version (run `apisix version`): `3.14.1`
- Operating system (run `uname -a`): `Linux apisix-cc56488df-kzmnn 6.12.55-74.119.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC`
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`): `openresty/1.27.1.2`
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`):
- APISIX Dashboard version, if relevant:
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run `luarocks --version`):

Contributor guide

Open the contributing guide

Research direction

Start by reading the referenced attach_consumer discussion in issue #11015, then inspect apisix.consumer and plugin.lua, especially _M.merge_consumer_route. Check how the proposed request-scoped consumer interacts with consumer_groups and the documented headers; done means reaching and documenting a maintainer-approved approach.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
api
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.