Dynamically obtain token through routing requests

[myhgc]

Is there any way to dynamically request an interface to obtain a token and set it to the header of this request before a request passes through the route?

[dosubot[bot]]

Hey @myhgc! I'm here to help you out with any bugs, questions, or contributions you have. Let's squash those bugs together! 😄

Yes, you can dynamically request an interface to obtain a token and set it to the header of a request before it passes through the route using Apache APISIX. Here is how you can achieve this:

1. Configure the backend service (upstream):

   curl "http://127.0.0.1:9180/apisix/admin/upstreams/1" -X PUT -d '
   {
     "name": "Conferences API upstream",
     "desc": "Register Conferences API as the upstream",
     "type": "roundrobin",
     "scheme": "https",
     "nodes": {
       "conferenceapi.azurewebsites.net:443": 1
     }
   }'

2. Create a Plugin Config:

   curl "http://127.0.0.1:9180/apisix/admin/plugin_configs/1" -X PUT -d '
   {
       "plugins": {
           "openid-connect":{
               "client_id":"{YOUR_OKTA_CLIENT_ID}",
               "client_secret":"{YOUR_OKTA_CLIENT_SECRET}",
               "discovery":"https://{YOUR_OKTA_ISSUER}/oauth2/default/.well-known/openid-configuration",
               "scope":"openid",
               "bearer_only":true,
               "realm":"master",
               "introspection_endpoint_auth_method":"https://{YOUR_OKTA_ISSUER}/oauth2/v1/introspect",
               "redirect_uri":"https://conferenceapi.azurewebsites.net/"
           },
           "proxy-rewrite": {
               "uri": "/speaker/$http_speakerId/sessions",
               "host":"conferenceapi.azurewebsites.net"
           },
           "serverless-pre-function": {
               "phase": "rewrite",
               "functions" : ["return function(conf, ctx)
   
       -- Import necessary libraries
       local core = require(\"apisix.core\")
       local jwt = require(\"resty.jwt\")
   
       -- Retrieve the JWT token from the Authorization header
       local jwt_token = core.request.header(ctx, \"Authorization\")
       if jwt_token ~= nil then
           -- Remove the Bearer prefix from the JWT token
           local _, _, jwt_token_only = string.find(jwt_token, \"Bearer%s+(.+)\")
           if jwt_token_only ~= nil then
              -- Decode the JWT token
              local jwt_obj = jwt:load_jwt(jwt_token_only)
   
              if jwt_obj.valid then
                -- Retrieve the value of the speakerId claim from the JWT token
                local speakerId_claim_value = jwt_obj.payload.speakerId
   
                -- Store the speakerId claim value in the header variable
                core.request.set_header(ctx, \"speakerId\", speakerId_claim_value)
              end
            end
        end
      end
       "]}
       }
   }'

3. Configure a new Route:

   curl "http://127.0.0.1:9180/apisix/admin/routes/1"  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
   {
       "name":"Conferences API speaker sessions route",
       "desc":"Create a new route in APISIX for the Conferences API speaker sessions",
       "methods": ["GET"],
       "uri": "/sessions",
       "upstream_id":"1",
       "plugin_config_id":1
   }'

4. Obtain a token from Okta:

   https://{YOUR_OKTA_ISSUER}/oauth2/default/v1/authorize?client_id={YOUR_OKTA_CLIENT_ID}
   &response_type=id_token
   &scope=openid
   &redirect_uri=https%3A%2F%2Fconferenceapi.azurewebsites.net
   &state=myState
   &nonce=myNonceValue

5. Test the dynamic routing:

   curl -i -X "GET http://127.0.0.1:9080/sessions" -H "Authorization: Bearer {YOUR_OKTA_JWT_TOKEN}"

This setup uses the openid-connect, serverless-pre-function, and proxy-rewrite plugins to dynamically obtain a token, set it to the header, and route the request based on the JWT token's claim ^[1][2].

To continue talking to Dosu, mention @dosu.

[myhgc]

hi，@dosu Thank you for your receipt。Is it necessary to configure the openid-connect plugin? Because the only way I get the dynamic token is through a basic auth authentication http interface. After successfully calling the http interface with the username and password, a json containing a token attribute is returned. Then I need to set this token to the header of the route rewrite. Thank you!

[dosubot[bot]]

You don't need to configure the openid-connect plugin if you are obtaining the token through a basic auth authentication HTTP interface. You can achieve this using the serverless-pre-function plugin to make an HTTP request to obtain the token and set it in the request header.

Here is how you can do it:

1. Create a Plugin Config:

   curl "http://127.0.0.1:9180/apisix/admin/plugin_configs/1" -X PUT -d '
   {
       "plugins": {
           "serverless-pre-function": {
               "phase": "rewrite",
               "functions" : ["return function(conf, ctx)
                   -- Import necessary libraries
                   local core = require(\"apisix.core\")
                   local http = require(\"resty.http\")
   
                   -- Make an HTTP request to obtain the token
                   local httpc = http.new()
                   local res, err = httpc:request_uri(\"https://your-auth-server.com/token\", {
                       method = \"POST\",
                       body = \"grant_type=client_credentials&client_id=your_client_id&client_secret=your_client_secret\",
                       headers = {
                           [\"Content-Type\"] = \"application/x-www-form-urlencoded\",
                           [\"Authorization\"] = \"Basic \" .. ngx.encode_base64(\"username:password\")
                       },
                       ssl_verify = false
                   })
   
                   if not res then
                       core.log.error(\"failed to request token: \", err)
                       return
                   end
   
                   local token = core.json.decode(res.body).access_token
   
                   if token then
                       -- Set the token in the request header
                       core.request.set_header(ctx, \"Authorization\", \"Bearer \" .. token)
                   else
                       core.log.error(\"failed to obtain access token\")
                   end
               end"]
           }
       }
   }'

2. Configure a new Route:

   curl "http://127.0.0.1:9180/apisix/admin/routes/1" -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
   {
       "name": "Your Route Name",
       "desc": "Description of your route",
       "methods": ["GET", "POST"],  # Adjust methods as needed
       "uri": "/your/route/uri",
       "upstream": {
           "nodes": {
               "your-upstream-service:port": 1
           },
           "type": "roundrobin"
       },
       "plugin_config_id": 1
   }'

In this setup:

• The serverless-pre-function plugin makes an HTTP request to your authentication server using basic auth to obtain the token.
• The token is then set in the Authorization header of the request before it is forwarded to the upstream service.

Replace https://your-auth-server.com/token, your_client_id, your_client_secret, username, password, and other placeholders with your actual values.

This approach allows you to dynamically obtain a token and set it in the request header without needing the openid-connect plugin ^[1][2].

To continue talking to Dosu, mention @dosu.

[myhgc]

Thank you again for your help. I use basic-auth for the routing authentication plug-in, and an error {"message":"Invalid authorization in request"} will appear. But changing "phase": "rewrite" in the serverless-pre-function plug-in to "phase": "before_proxy" makes it work properly. Thank you!