multi-auth
multi-auth 插件允许使用不同认证方法的 Consumer 共享相同的路由或服务。它支持配置多个认证插件，只要请求成功通过任何配置的认证方法的认证，就会被允许通过。
示例
在同一路由上允许不同的认证方式
以下示例演示了如何让一个 Consumer 使用 Basic Auth，而另一个 Consumer 使用 Key Auth，并且两者共享相同的路由。
- Admin API
- ADC
- Ingress Controller
创建两个 Consumer：
curl "http://127.0.0.1:9180/apisix/admin/consumers" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"username":"consumer1"
}'
curl "http://127.0.0.1:9180/apisix/admin/consumers" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"username":"consumer2"
}'
为 consumer1 配置 Basic Auth 凭据：
curl "http://127.0.0.1:9180/apisix/admin/consumers/consumer1/credentials" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "cred-jane-key-auth",
"plugins": {
"basic-auth": {
"username":"consumer1",
"password":"consumer1_pwd"
}
}
}'
为 consumer2 配置 Key Auth 凭据：
curl "http://127.0.0.1:9180/apisix/admin/consumers/consumer2/credentials" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "cred-jane-key-auth",
"plugins": {
"key-auth": {
"key":"consumer2_pwd"
}
}
}'
创建一个启用了 multi-auth 的路由，并配置 Consumer 使用的两个认证插件：
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "multi-auth-route",
"uri": "/anything",
"plugins": {
"multi-auth":{
"auth_plugins":[
{
"basic-auth":{}
},
{
"key-auth":{
"hide_credentials":true,
"header":"apikey",
"query":"apikey"
}
}
]
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"httpbin.org": 1
}
}
}'
创建两个消费者及其各自的凭证，并创建启用了 multi-auth 的路由：
adc.yaml
consumers:
- username: consumer1
credentials:
- name: cred-consumer1-basic-auth
type: basic-auth
config:
username: consumer1
password: consumer1_pwd
- username: consumer2
credentials:
- name: cred-consumer2-key-auth
type: key-auth
config:
key: consumer2_pwd
services:
- name: multi-auth-service
routes:
- name: multi-auth-route
uris:
- /anything
plugins:
multi-auth:
auth_plugins:
- basic-auth: {}
- key-auth:
hide_credentials: true
header: apikey
query: apikey
upstream:
type: roundrobin
nodes:
- host: httpbin.org
port: 80
weight: 1
将配置同步到网关：
adc sync -f adc.yaml
- Gateway API
- APISIX CRD
multi-auth-ic.yaml
apiVersion: apisix.apache.org/v1alpha1
kind: Consumer
metadata:
namespace: aic
name: consumer1
spec:
gatewayRef:
name: apisix
credentials:
- type: basic-auth
name: cred-consumer1-basic-auth
config:
username: consumer1
password: consumer1_pwd
---
apiVersion: apisix.apache.org/v1alpha1
kind: Consumer
metadata:
namespace: aic
name: consumer2
spec:
gatewayRef:
name: apisix
credentials:
- type: key-auth
name: cred-consumer2-key-auth
config:
key: consumer2_pwd
---
apiVersion: v1
kind: Service
metadata:
namespace: aic
name: httpbin-external-domain
spec:
type: ExternalName
externalName: httpbin.org
---
apiVersion: apisix.apache.org/v1alpha1
kind: PluginConfig
metadata:
namespace: aic
name: multi-auth-plugin-config
spec:
plugins:
- name: multi-auth
config:
auth_plugins:
- basic-auth: {}
- key-auth:
hide_credentials: true
header: apikey
query: apikey
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
namespace: aic
name: multi-auth-route
spec:
parentRefs:
- name: apisix
rules:
- matches:
- path:
type: Exact
value: /anything
filters:
- type: ExtensionRef
extensionRef:
group: apisix.apache.org
kind: PluginConfig
name: multi-auth-plugin-config
backendRefs:
- name: httpbin-external-domain
port: 80
将配置应用到集群：
kubectl apply -f multi-auth-ic.yaml
multi-auth-ic.yaml
apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
namespace: aic
name: consumer1
spec:
ingressClassName: apisix
authParameter:
basicAuth:
value:
username: consumer1
password: consumer1_pwd
---
apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
namespace: aic
name: consumer2
spec:
ingressClassName: apisix
authParameter:
keyAuth:
value:
key: consumer2_pwd
---
apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
namespace: aic
name: httpbin-external-domain
spec:
ingressClassName: apisix
externalNodes:
- type: Domain
name: httpbin.org
---
apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
namespace: aic
name: multi-auth-route
spec:
ingressClassName: apisix
http:
- name: multi-auth-route
match:
paths:
- /anything
upstreams:
- name: httpbin-external-domain
plugins:
- name: multi-auth
enable: true
config:
auth_plugins:
- basic-auth: {}
- key-auth:
hide_credentials: true
header: apikey
query: apikey
将配置应用到集群：
kubectl apply -f multi-auth-ic.yaml
使用 consumer1 的 Basic Auth 凭据向路由发送请求：
curl -i "http://127.0.0.1:9080/anything" -u consumer1:consumer1_pwd
你应该收到一个 HTTP/1.1 200 OK 响应。
使用 consumer2 的 Key Auth 凭据向路由发送另一个请求：
curl -i "http://127.0.0.1:9080/anything" -H 'apikey: consumer2_pwd'
你应该再次收到一个 HTTP/1.1 200 OK 响应。
向路由发送不带任何凭据的请求：
curl -i "http://127.0.0.1:9080/anything"
你应该收到一个 HTTP/1.1 401 Unauthorized 响应。
这表明使用不同认证方法的 Consumer 能够认证并访问同一路由背后的资源。