Skip to content

Latest commit

 

History

History
118 lines (93 loc) · 3.97 KB

authz-casdoor.md

File metadata and controls

118 lines (93 loc) · 3.97 KB
title keywords description
authz-casdoor
Apache APISIX
API Gateway
Plugin
Authz Casdoor
authz-casdoor
This document contains information about the Apache APISIX authz-casdoor Plugin.

Description

The authz-casdoor Plugin can be used to add centralized authentication with Casdoor.

Attributes

Name Type Required Description
endpoint_addr string True URL of Casdoor.
client_id string True Client ID in Casdoor.
client_secret string True Client secret in Casdoor.
callback_url string True Callback URL used to receive state and code.

NOTE: encrypt_fields = {"client_secret"} is also defined in the schema, which means that the field will be stored encrypted in etcd. See encrypted storage fields.

:::info IMPORTANT

endpoint_addr and callback_url should not end with '/'.

:::

:::info IMPORTANT

The callback_url must belong to the URI of your Route. See the code snippet below for an example configuration.

:::

Enable Plugin

You can enable the Plugin on a specific Route as shown below:

curl "http://127.0.0.1:9180/apisix/admin/routes/1" -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d '
{
  "methods": ["GET"],
  "uri": "/anything/*",
  "plugins": {
    "authz-casdoor": {
        "endpoint_addr":"http://localhost:8000",
        "callback_url":"http://localhost:9080/anything/callback",
        "client_id":"7ceb9b7fda4a9061ec1c",
        "client_secret":"3416238e1edf915eac08b8fe345b2b95cdba7e04"
    }
  },
  "upstream": {
    "type": "roundrobin",
    "nodes": {
      "httpbin.org:80": 1
    }
  }
}'

Example usage

Once you have enabled the Plugin, a new user visiting this Route would first be processed by the authz-casdoor Plugin. They would be redirected to the login page of Casdoor.

After successfully logging in, Casdoor will redirect this user to the callback_url with GET parameters code and state specified. The Plugin will also request for an access token and confirm whether the user is really logged in. This process is only done once and subsequent requests are left uninterrupted.

Once this is done, the user is redirected to the original URL they wanted to visit.

Delete Plugin

To remove the authz-casdoor Plugin, you can delete the corresponding JSON configuration from the Plugin configuration. APISIX will automatically reload and you do not have to restart for this to take effect.

:::note You can fetch the admin_key from config.yaml and save to an environment variable with the following command:

admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')

:::

curl http://127.0.0.1:9180/apisix/admin/routes/1  -H "X-API-KEY: $admin_key" -X PUT -d '
{
    "methods": ["GET"],
    "uri": "/anything/*",
    "plugins": {},
    "upstream": {
        "type": "roundrobin",
        "nodes": {
            "httpbin.org:80": 1
        }
    }
}'