Skip to content

Commit 0558791

Browse files
emojemoj
emoj
authored and
emoj
committed
added anonymous support compatible with kong 1.0.X
1 parent f0c573c commit 0558791

File tree

2 files changed

+101
-47
lines changed

2 files changed

+101
-47
lines changed

‎kong/plugins/oidc/handler.lua‎

Lines changed: 63 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,16 @@ local utils = require("kong.plugins.oidc.utils")
44
local filter = require("kong.plugins.oidc.filter")
55
local session = require("kong.plugins.oidc.session")
66

7-
local singletons = require "kong.singletons"
87
local constants = require "kong.constants"
9-
local responses = require "kong.tools.responses"
8+
9+
local kong = kong
1010

1111
OidcHandler.PRIORITY = 1000
1212

13+
local function internal_server_error(err)
14+
kong.log.err(err)
15+
return kong.response.exit(500, { message = "An unexpected error occurred" })
16+
end
1317

1418
function OidcHandler:new()
1519
OidcHandler.super.new(self, "oidc")
@@ -18,7 +22,7 @@ end
1822
function OidcHandler:access(config)
1923
OidcHandler.super.access(self)
2024

21-
if ngx.ctx.authenticated_credential and config.anonymous ~= "" then
25+
if config.anonymous and kong.client.get_credential() then
2226
-- we're already authenticated, and we're configured for using anonymous,
2327
-- hence we're in a logical OR between auth methods and we're already done.
2428
return
@@ -69,19 +73,20 @@ function make_oidc(oidcConfig)
6973
ngx.log(ngx.DEBUG, "Entering recovery page: " .. oidcConfig.recovery_page_path)
7074
ngx.redirect(oidcConfig.recovery_page_path)
7175
end
72-
if oidcConfig.anonymous ~= "" then
76+
if oidcConfig.anonymous then
7377
-- get anonymous user
74-
local consumer_cache_key = singletons.db.consumers:cache_key(oidcConfig.anonymous)
75-
local consumer, err = singletons.cache:get(consumer_cache_key, nil,
76-
load_consumer_into_memory,
77-
oidcConfig.anonymous, true)
78+
local consumer_cache_key = kong.db.consumers:cache_key(oidcConfig.anonymous)
79+
local consumer, err = kong.cache:get(consumer_cache_key, nil,
80+
load_consumer_into_memory,
81+
oidcConfig.anonymous, true)
7882
if err then
79-
return responses.send_HTTP_INTERNAL_SERVER_ERROR(err)
83+
return internal_server_error(err)
8084
end
85+
8186
set_consumer(consumer, nil, nil)
8287

8388
else
84-
utils.exit(500, err, ngx.HTTP_INTERNAL_SERVER_ERROR)
89+
return kong.response.exit(err.status, err.message, err.headers)
8590
end
8691
end
8792
return res
@@ -93,19 +98,20 @@ function introspect(oidcConfig)
9398
if err then
9499
if oidcConfig.bearer_only == "yes" then
95100
ngx.header["WWW-Authenticate"] = 'Bearer realm="' .. oidcConfig.realm .. '",error="' .. err .. '"'
96-
if oidcConfig.anonymous ~= "" then
101+
if oidcConfig.anonymous then
97102
-- get anonymous user
98-
local consumer_cache_key = singletons.db.consumers:cache_key(oidcConfig.anonymous)
99-
local consumer, err = singletons.cache:get(consumer_cache_key, nil,
100-
load_consumer_into_memory,
101-
oidcConfig.anonymous, true)
103+
local consumer_cache_key = kong.db.consumers:cache_key(oidcConfig.anonymous)
104+
local consumer, err = kong.cache:get(consumer_cache_key, nil,
105+
load_consumer_into_memory,
106+
oidcConfig.anonymous, true)
102107
if err then
103-
return responses.send_HTTP_INTERNAL_SERVER_ERROR(err)
108+
return internal_server_error(err)
104109
end
110+
105111
set_consumer(consumer, nil, nil)
106112

107113
else
108-
utils.exit(ngx.HTTP_UNAUTHORIZED, err, ngx.HTTP_UNAUTHORIZED)
114+
return kong.response.exit(err.status, err.message, err.headers)
109115
end
110116

111117
end
@@ -120,17 +126,48 @@ end
120126
-- TESTING
121127

122128
local function set_consumer(consumer, credential, token)
123-
ngx_set_header(constants.HEADERS.CONSUMER_ID, consumer.id)
124-
ngx_set_header(constants.HEADERS.CONSUMER_CUSTOM_ID, consumer.custom_id)
125-
ngx_set_header(constants.HEADERS.CONSUMER_USERNAME, consumer.username)
126-
ngx.ctx.authenticated_consumer = consumer
129+
local set_header = kong.service.request.set_header
130+
local clear_header = kong.service.request.clear_header
131+
132+
if consumer and consumer.id then
133+
set_header(constants.HEADERS.CONSUMER_ID, consumer.id)
134+
else
135+
clear_header(constants.HEADERS.CONSUMER_ID)
136+
end
137+
138+
if consumer and consumer.custom_id then
139+
set_header(constants.HEADERS.CONSUMER_CUSTOM_ID, consumer.custom_id)
140+
else
141+
clear_header(constants.HEADERS.CONSUMER_CUSTOM_ID)
142+
end
143+
144+
if consumer and consumer.username then
145+
set_header(constants.HEADERS.CONSUMER_USERNAME, consumer.username)
146+
else
147+
clear_header(constants.HEADERS.CONSUMER_USERNAME)
148+
end
149+
150+
kong.client.authenticate(consumer, credential)
151+
127152
if credential then
128-
ngx_set_header("x-authenticated-scope", token.scope)
129-
ngx_set_header("x-authenticated-userid", token.authenticated_userid)
130-
ngx.ctx.authenticated_credential = credential
131-
ngx_set_header(constants.HEADERS.ANONYMOUS, nil) -- in case of auth plugins concatenation
153+
if token.scope then
154+
set_header("x-authenticated-scope", token.scope)
155+
else
156+
clear_header("x-authenticated-scope")
157+
end
158+
159+
if token.authenticated_userid then
160+
set_header("x-authenticated-userid", token.authenticated_userid)
161+
else
162+
clear_header("x-authenticated-userid")
163+
end
164+
165+
clear_header(constants.HEADERS.ANONYMOUS) -- in case of auth plugins concatenation
166+
132167
else
133-
ngx_set_header(constants.HEADERS.ANONYMOUS, true)
168+
set_header(constants.HEADERS.ANONYMOUS, true)
169+
clear_header("x-authenticated-scope")
170+
clear_header("x-authenticated-userid")
134171
end
135172

136173
end

‎kong/plugins/oidc/schema.lua‎

Lines changed: 38 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,41 @@
1+
local typedefs = require "kong.db.schema.typedefs"
2+
3+
local function validate_flows(config)
4+
5+
return true
6+
7+
end
8+
19
return {
2-
no_consumer = true,
10+
name = "oidc",
311
fields = {
4-
anonymous = { type = "string", uuid = true, legacy = true },
5-
client_id = { type = "string", required = true },
6-
client_secret = { type = "string", required = true },
7-
discovery = { type = "string", required = true, default = "https://.well-known/openid-configuration" },
8-
introspection_endpoint = { type = "string", required = false },
9-
timeout = { type = "number", required = false },
10-
introspection_endpoint_auth_method = { type = "string", required = false },
11-
bearer_only = { type = "string", required = true, default = "no" },
12-
realm = { type = "string", required = true, default = "kong" },
13-
redirect_uri_path = { type = "string" },
14-
scope = { type = "string", required = true, default = "openid" },
15-
response_type = { type = "string", required = true, default = "code" },
16-
ssl_verify = { type = "string", required = true, default = "no" },
17-
token_endpoint_auth_method = { type = "string", required = true, default = "client_secret_post" },
18-
session_secret = { type = "string", required = false },
19-
recovery_page_path = { type = "string" },
20-
logout_path = { type = "string", required = false, default = '/logout' },
21-
redirect_after_logout_uri = { type = "string", required = false, default = '/' },
22-
filters = { type = "string" }
23-
}
12+
{ consumer = typedefs.no_consumer },
13+
{ run_on = typedefs.run_on_first },
14+
{ config = {
15+
type = "record",
16+
fields = {
17+
{anonymous = { type = "string", uuid = true, legacy = true }},
18+
{client_id = { type = "string", required = true }},
19+
{client_secret = { type = "string", required = true }},
20+
{discovery = { type = "string", required = true, default = "https://.well-known/openid-configuration" }},
21+
{introspection_endpoint = { type = "string", required = false }},
22+
{timeout = { type = "number", required = false }},
23+
{introspection_endpoint_auth_method = { type = "string", required = false }},
24+
{bearer_only = { type = "string", required = true, default = "no" }},
25+
{realm = { type = "string", required = true, default = "kong" }},
26+
{redirect_uri_path = { type = "string" }},
27+
{scope = { type = "string", required = true, default = "openid" }},
28+
{response_type = { type = "string", required = true, default = "code" }},
29+
{ssl_verify = { type = "string", required = true, default = "no" }},
30+
{token_endpoint_auth_method = { type = "string", required = true, default = "client_secret_post" }},
31+
{session_secret = { type = "string", required = false }},
32+
{recovery_page_path = { type = "string" }},
33+
{logout_path = { type = "string", required = false, default = '/logout' }},
34+
{redirect_after_logout_uri = { type = "string", required = false, default = '/' }},
35+
{filters = { type = "string" }}
36+
},
37+
custom_validator = validate_flows,
38+
},
39+
},
40+
},
2441
}

0 commit comments

Comments
 (0)