Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(vault): vault lua module, integration with jwt-auth authentication plugin #5745

Merged
merged 28 commits into from
Dec 15, 2021
Merged

feat(vault): vault lua module, integration with jwt-auth authentication plugin #5745

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
b2788ff
vault-auth init
bisakhmondal Dec 3, 2021
a88c615
vault storage kv engine integration
bisakhmondal Dec 6, 2021
17b3c23
not required file
bisakhmondal Dec 6, 2021
7605c38
integrating vault storage backend with jwt-auth authentication plugin
bisakhmondal Dec 8, 2021
ae240ed
Merge branch 'master' into vault-jwt
bisakhmondal Dec 9, 2021
876cce3
Merge branch 'master' into vault-jwt
bisakhmondal Dec 9, 2021
c3a7d4a
openssl rsa-2048 pem public private keypairs
bisakhmondal Dec 9, 2021
ed628b2
vault integration tests with corner cases
bisakhmondal Dec 9, 2021
9ec682a
minor updates
bisakhmondal Dec 9, 2021
36f0141
adding real vault server into CIs
bisakhmondal Dec 9, 2021
c3aaf8f
lint fix
bisakhmondal Dec 9, 2021
80358b9
suggestions
bisakhmondal Dec 9, 2021
e4d10da
now get doesnot returns vault data
bisakhmondal Dec 9, 2021
f927fb9
update exposed port address
bisakhmondal Dec 9, 2021
ee251aa
documentation
bisakhmondal Dec 9, 2021
6158837
blank commit
bisakhmondal Dec 9, 2021
f9cdc4e
remove custom path support from mvp
bisakhmondal Dec 10, 2021
6729106
trimming down validation and key generation if vault config is enabled
bisakhmondal Dec 10, 2021
83b3fe0
remove redundant codes
bisakhmondal Dec 10, 2021
58292d2
Ci fix
bisakhmondal Dec 10, 2021
55c105d
changing vault kv suffix to /consumer/<username>/jwt-auth
bisakhmondal Dec 10, 2021
1f2ff22
update tests and modify the way http status code were sent
bisakhmondal Dec 10, 2021
cac28d1
fix doc broken link
bisakhmondal Dec 10, 2021
f78cf89
comment out vault config in yaml and update tests accordingly
bisakhmondal Dec 12, 2021
6a28225
Merge branch 'master' into vault-jwt
bisakhmondal Dec 13, 2021
2d44654
change yaml_config to extra_yaml_config
bisakhmondal Dec 13, 2021
66ee305
single extra yaml config
bisakhmondal Dec 13, 2021
a56ed8e
suggestion
bisakhmondal Dec 14, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/en/latest/plugins/jwt-auth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ curl http://127.0.0.1:9080/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f1

Here the plugin looks up for key `secret` inside vault path (`<vault.prefix from conf.yaml>/consumer/jack/jwt-auth`) for consumer username `jack` mentioned in the consumer config and uses it for subsequent signing and jwt verification. If the key is not found in the same path, the plugin logs error and fails to perform jwt authentication.

1. RS256 rsa keypairs, both public and private keys are stored into vault.
2. RS256 rsa keypairs, both public and private keys are stored into vault.

```shell
curl http://127.0.0.1:9080/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
Expand Down
38 changes: 10 additions & 28 deletions t/plugin/jwt-auth-vault.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,16 @@ _EOC_

$block->set_value("http_config", $http_config);

my $vault_config = $block->extra_yaml_config // <<_EOC_;
vault:
host: "http://0.0.0.0:8200"
timeout: 10
prefix: kv/apisix
token: root
_EOC_

$block->set_value("extra_yaml_config", $vault_config);

Comment on lines +42 to +51
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How is it now? @spacewander

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

if (!$block->request) {
$block->set_value("request", "GET /t");
}
Expand Down Expand Up @@ -148,13 +158,6 @@ passed


=== TEST 4: sign a jwt and access/verify /secure-endpoint, fails as no secret entry into vault
--- extra_yaml_config
vault:
host: "http://0.0.0.0:8200"
timeout: 10
prefix: kv/apisix
token: root
#END
--- config
location /t {
content_by_lua_block {
Expand Down Expand Up @@ -198,13 +201,6 @@ Success! Data written to: kv/apisix/consumer/jack/jwt-auth


=== TEST 6: sign a HS256 jwt and access/verify /secure-endpoint
--- extra_yaml_config
vault:
host: "http://0.0.0.0:8200"
timeout: 10
prefix: kv/apisix
token: root
#END
--- config
location /t {
content_by_lua_block {
Expand Down Expand Up @@ -272,13 +268,6 @@ passed


=== TEST 9: sign a jwt with with rsa keypair and access /secure-endpoint
--- extra_yaml_config
vault:
host: "http://0.0.0.0:8200"
timeout: 10
prefix: kv/apisix
token: root
#END
--- config
location /t {
content_by_lua_block {
Expand Down Expand Up @@ -347,13 +336,6 @@ passed


=== TEST 12: sign a jwt with with rsa keypair and access /secure-endpoint
--- extra_yaml_config
vault:
host: "http://0.0.0.0:8200"
timeout: 10
prefix: kv/apisix
token: root
#END
--- config
location /t {
content_by_lua_block {
Expand Down