Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for skipped_path_prefixes to ext-auth plugin #1694

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

hanxiantao
Copy link
Collaborator

Ⅰ. Describe what this PR did

1)支持 skipped_path_prefixes 用于排除特定路径跳过鉴权
2)优化代码结构,添加 config 对应的单元测试
3)优化文档,添加 endpoint_mode 为 forward_auth 时 X-Forwarded-* 请求头相关的示例,文档中删除 X-Original-* 相关的部分

Ⅱ. Does this pull request fix one issue?

fixes #1691

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

endpoint_mode为envoy时

1)认证成功

apiVersion: extensions.higress.io/v1alpha1
kind: WasmPlugin
metadata:
  name: test
  namespace: higress-system
spec:
  defaultConfig:
    http_service:
      authorization_request:
        allowed_headers:
          - exact: x-user-id
          - prefix: x-custom-
        headers_to_add:
          key1: value1
          key2: value2
        with_request_body: false
      endpoint:
        path_prefix: /auth
        service_name: ext-auth.static
        service_port: 80
        service_source: ip
    skipped_path_prefixes:
      - /foo/health
      - /foo/metrics
  imagePullSecret: aliyun
  url: >-
    oci://registry.cn-hangzhou.aliyuncs.com/wasm-plugin/wasm-plugin:ext-auth-0.0.86

curl -kvv -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com"

认证成功

endpoint_mode为envoy时认证成功

认证请求Method为原始请求Method,认证请求path为path_prefix+原始path拼接,并添加对应请求头key1和key2到认证服务

endpoint_mode为envoy时认证成功2

2)认证失败

curl -kvv -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com"

认证失败,响应码和响应体为认证服务返回的内容
endpoint_mode为envoy时认证失败

认证请求Method为原始请求Method,认证请求path为path_prefix+原始path拼接,并添加对应请求头key1和key2到认证服务
endpoint_mode为envoy时认证失败2

3)跳过认证

curl -kvv -X PUT http://localhost:8082/foo/health?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com"

此时认证服务还是返回失败,但/foo/health请求可以跳过认证

endpoint_mode为envoy时跳过认证

endpoint_mode为forward_auth时

1)认证成功

apiVersion: extensions.higress.io/v1alpha1
kind: WasmPlugin
metadata:
  name: test
  namespace: higress-system
spec:
  defaultConfig:
    http_service:
      authorization_request:
        allowed_headers:
          - exact: x-user-id
          - prefix: x-custom-
        headers_to_add:
          key1: value1
          key2: value2
        with_request_body: false
      endpoint_mode: forward_auth
      endpoint:
        request_method: POST
        path: /auth
        service_name: ext-auth.static
        service_port: 80
        service_source: ip
    skipped_path_prefixes:
      - /foo/health
      - /foo/metrics
  imagePullSecret: aliyun
  url: >-
    oci://registry.cn-hangzhou.aliyuncs.com/wasm-plugin/wasm-plugin:ext-auth-0.0.86

curl -kvv -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com" -H "x-user-id: 111111" -H "x-custom-1: test"

认证成功
endpoint_mode为forward_auth时认证成功

认证请求Method为配置的request_method,认证请求path为配置的path

endpoint_mode为forward_auth时认证成功2

2)认证失败和跳过认证

curl -kvv -X PUT http://localhost:8082/foo/health?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com" -H "x-user-id: 111111" -H "x-custom-1: test"

curl -kvv -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com" -H "x-user-id: 111111" -H "x-custom-1: test"

认证失败和跳过认证

Ⅴ. Special notes for reviews

@codecov-commenter
Copy link

codecov-commenter commented Jan 19, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 43.61%. Comparing base (ef31e09) to head (2bd1133).
Report is 276 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #1694      +/-   ##
==========================================
+ Coverage   35.91%   43.61%   +7.70%     
==========================================
  Files          69       76       +7     
  Lines       11576    12358     +782     
==========================================
+ Hits         4157     5390    +1233     
+ Misses       7104     6630     -474     
- Partials      315      338      +23     

see 70 files with indirect coverage changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

【外部认证】插件是否能支持响应body 及 例外路径(不需要认证)
2 participants