spacewander commented on a change in pull request #6382: URL: https://github.com/apache/apisix/pull/6382#discussion_r815648121
########## File path: apisix/plugins/auth-casdoor.lua ########## @@ -0,0 +1,138 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +local core = require("apisix.core") +local cjson = require("cjson") +local http = require("resty.http") +local session = require("resty.session") +local string = require("string") +local log = core.log +local ngx = ngx + +local plugin_name = "auth-casdoor" +local schema = { + type = "object", + properties = { + casdoor_endpoint = {type = "string"}, + client_id = {type = "string"}, + client_secret = {type = "string"}, + callback_url = {type = "string"}, + test = {type = "boolean", default = false} + }, + required = { + "callback_url", "casdoor_endpoint", "client_id", "client_secret" + } +} + +local _M = {version = 0.1, priority = 2559, name = plugin_name, schema = schema} Review comment: please put each field per line, like other plugins ########## File path: docs/en/latest/plugins/auth-casdoor.md ########## @@ -0,0 +1,93 @@ +--- +title: auth-casdoor +--- + +<!-- +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--> + +## Summary + +- [**Name**](#name) +- [**Attributes**](#attributes) +- [**Metadata**](#metadata) +- [**How To Enable**](#how-to-enable) +- [**Test Plugin**](#test-plugin) +- [**Disable Plugin**](#disable-plugin) +- [**Examples**](#examples) + +## Name + +`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management + +## Attributes + +| Name | Type | Requirement | Default | Valid | Description | +| ----------- | ------ | ----------- | ------- | ----- | ------------------------------------------------------------ | +| casdoor_endpoint | string | required | | | The url of casdoor. | +| client_id | string | required | | | The client id in casdoor. | +| client_secret | string | required | | | The client secret in casdoor. | +| callback_url | string | required | | | The callback url which is used to receive state and code. | +|test|boolean|not required|false| |used for unit test, no need to set it for users| + +## How To Enable + +You can enable the plugin on any route by giving out all four attributes mentioned above. + +### Example + +```shell +curl "http://127.0.0.1:9080/apisix/admin/routes/1"; -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d ' +{ + "methods": ["GET"], + "uri": "/anything/*", + "plugins": { + "auth-casdoor": { + "casdoor_endpoint":"http://localhost:8000";, + "callback_url":"http://localhost:9080/anything/callback";, + "client_id":"7ceb9b7fda4a9061ec1c", + "client_secret":"3416238e1edf915eac08b8fe345b2b95cdba7e04" + } + }, + "upstream": { + "type": "roundrobin", + "nodes": { + "httpbin.org:80": 1 + } + } +}' + +``` + +In this example, using apisix's admin API we created a route "/anything/*" pointed to "httpbin.org:80", and with "auth-casdoor" enabled. This route is now under authentication protection of casdoor. + +#### explanations about parameters of this plugin + +In the configuration of "auth-casdoor" plugin we can see four parameters. + +The first one is "callback_url". This is exactly the callback url in OAuth2. It should be emphasized that this callback url **must belong to the "uri" you specified for the route**, for example, in this example, http://localhost:9080/anything/callback obviously belong to "/anything/*" Only by this way can the visit toward callback_url can be intercepted and utilized by the plugin(so that the plugin can get the code and state in Oauth2). The logic of callback_url is implemented competely by plugin so that there is no need to modify the server implement this callback. Review comment: ```suggestion The first one is "callback_url". This is exactly the callback url in OAuth2. It should be emphasized that this callback url **must belong to the "uri" you specified for the route**, for example, in this example, http://localhost:9080/anything/callback obviously belong to "/anything/*". Only by this way can the visit toward callback_url can be intercepted and utilized by the plugin(so that the plugin can get the code and state in Oauth2). The logic of callback_url is implemented completely by the plugin so that there is no need to modify the server to implement this callback. ``` ########## File path: apisix/plugins/auth-casdoor.lua ########## @@ -0,0 +1,138 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +local core = require("apisix.core") +local cjson = require("cjson") +local http = require("resty.http") +local session = require("resty.session") +local string = require("string") +local log = core.log +local ngx = ngx + +local plugin_name = "auth-casdoor" +local schema = { + type = "object", + properties = { + casdoor_endpoint = {type = "string"}, + client_id = {type = "string"}, + client_secret = {type = "string"}, + callback_url = {type = "string"}, + test = {type = "boolean", default = false} + }, + required = { + "callback_url", "casdoor_endpoint", "client_id", "client_secret" + } +} + +local _M = {version = 0.1, priority = 2559, name = plugin_name, schema = schema} + +local function get_path(uri) + local without_query = uri:match("(.-)%?") or uri + return without_query:match(".-//[^/]+(/.*)") or without_query +end + +local function fetch_access_token(ctx, conf) + local args = core.request.get_uri_args(ctx) + if not args or not args.code or not args.state then + log.err() + return nil, "failed when accessing token. Invalid code or state" + end + local client = http.new() + local url = get_path(conf.casdoor_endpoint) .. Review comment: Could we require the endpoint not to have `?` so we don't need to use `get_path`? ########## File path: apisix/plugins/auth-casdoor.lua ########## @@ -0,0 +1,138 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +local core = require("apisix.core") +local cjson = require("cjson") +local http = require("resty.http") +local session = require("resty.session") +local string = require("string") +local log = core.log +local ngx = ngx + +local plugin_name = "auth-casdoor" +local schema = { + type = "object", + properties = { + casdoor_endpoint = {type = "string"}, + client_id = {type = "string"}, + client_secret = {type = "string"}, + callback_url = {type = "string"}, + test = {type = "boolean", default = false} + }, + required = { + "callback_url", "casdoor_endpoint", "client_id", "client_secret" + } +} + +local _M = {version = 0.1, priority = 2559, name = plugin_name, schema = schema} + +local function get_path(uri) + local without_query = uri:match("(.-)%?") or uri + return without_query:match(".-//[^/]+(/.*)") or without_query +end + +local function fetch_access_token(ctx, conf) + local args = core.request.get_uri_args(ctx) + if not args or not args.code or not args.state then + log.err() + return nil, "failed when accessing token. Invalid code or state" + end + local client = http.new() + local url = get_path(conf.casdoor_endpoint) .. + "/api/login/oauth/access_token" + + if conf.test then + url = get_path(conf.casdoor_endpoint) .. + "/casdoor_fake_access_token_api" + end + + local res, err = client:request_uri(url, { + method = "POST", + query = { + code = args.code, + grant_type = "authorization_code", + client_id = conf.client_id, + client_secret = conf.client_secret + } + }) + if not res then return nil, err end + local data, err = cjson.decode(res.body) + + if err or not data then return nil, err end + + if not data.access_token then + return nil, "failed when accessing token: no access_token contained" + end + + return data.access_token, nil +end + +function _M.check_schema(conf) + local ok, err = core.schema.check(schema, conf) + if not ok then return false, err end + -- check whether contains extra ? or / + local has_extra = string.find(conf.callback_url, "?", 1) Review comment: We can do the check in the schema via "pattern": https://github.com/apache/apisix/blob/acf7a0cc7f05aa15de21eb1aac798566f45bcb66/apisix/schema_def.lua#L34 ########## File path: docs/en/latest/plugins/auth-casdoor.md ########## @@ -0,0 +1,93 @@ +--- +title: auth-casdoor +--- + +<!-- +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--> + +## Summary + +- [**Name**](#name) +- [**Attributes**](#attributes) +- [**Metadata**](#metadata) +- [**How To Enable**](#how-to-enable) +- [**Test Plugin**](#test-plugin) +- [**Disable Plugin**](#disable-plugin) +- [**Examples**](#examples) + +## Name + +`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management + +## Attributes + +| Name | Type | Requirement | Default | Valid | Description | +| ----------- | ------ | ----------- | ------- | ----- | ------------------------------------------------------------ | +| casdoor_endpoint | string | required | | | The url of casdoor. | +| client_id | string | required | | | The client id in casdoor. | +| client_secret | string | required | | | The client secret in casdoor. | +| callback_url | string | required | | | The callback url which is used to receive state and code. | +|test|boolean|not required|false| |used for unit test, no need to set it for users| + +## How To Enable + +You can enable the plugin on any route by giving out all four attributes mentioned above. + +### Example + +```shell +curl "http://127.0.0.1:9080/apisix/admin/routes/1"; -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d ' +{ + "methods": ["GET"], + "uri": "/anything/*", + "plugins": { + "auth-casdoor": { + "casdoor_endpoint":"http://localhost:8000";, + "callback_url":"http://localhost:9080/anything/callback";, + "client_id":"7ceb9b7fda4a9061ec1c", + "client_secret":"3416238e1edf915eac08b8fe345b2b95cdba7e04" + } + }, + "upstream": { + "type": "roundrobin", + "nodes": { + "httpbin.org:80": 1 + } + } +}' + +``` + +In this example, using apisix's admin API we created a route "/anything/*" pointed to "httpbin.org:80", and with "auth-casdoor" enabled. This route is now under authentication protection of casdoor. + +#### explanations about parameters of this plugin Review comment: ```suggestion #### Explanations about parameters of this plugin ``` ########## File path: docs/en/latest/plugins/auth-casdoor.md ########## @@ -0,0 +1,93 @@ +--- +title: auth-casdoor +--- + +<!-- +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--> + +## Summary + +- [**Name**](#name) +- [**Attributes**](#attributes) +- [**Metadata**](#metadata) +- [**How To Enable**](#how-to-enable) +- [**Test Plugin**](#test-plugin) +- [**Disable Plugin**](#disable-plugin) +- [**Examples**](#examples) + +## Name + +`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management + +## Attributes + +| Name | Type | Requirement | Default | Valid | Description | +| ----------- | ------ | ----------- | ------- | ----- | ------------------------------------------------------------ | +| casdoor_endpoint | string | required | | | The url of casdoor. | +| client_id | string | required | | | The client id in casdoor. | +| client_secret | string | required | | | The client secret in casdoor. | +| callback_url | string | required | | | The callback url which is used to receive state and code. | +|test|boolean|not required|false| |used for unit test, no need to set it for users| + +## How To Enable + +You can enable the plugin on any route by giving out all four attributes mentioned above. + +### Example + +```shell +curl "http://127.0.0.1:9080/apisix/admin/routes/1"; -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d ' +{ + "methods": ["GET"], + "uri": "/anything/*", + "plugins": { + "auth-casdoor": { + "casdoor_endpoint":"http://localhost:8000";, + "callback_url":"http://localhost:9080/anything/callback";, + "client_id":"7ceb9b7fda4a9061ec1c", + "client_secret":"3416238e1edf915eac08b8fe345b2b95cdba7e04" + } + }, + "upstream": { + "type": "roundrobin", + "nodes": { + "httpbin.org:80": 1 + } + } +}' + +``` + +In this example, using apisix's admin API we created a route "/anything/*" pointed to "httpbin.org:80", and with "auth-casdoor" enabled. This route is now under authentication protection of casdoor. + +#### explanations about parameters of this plugin + +In the configuration of "auth-casdoor" plugin we can see four parameters. + +The first one is "callback_url". This is exactly the callback url in OAuth2. It should be emphasized that this callback url **must belong to the "uri" you specified for the route**, for example, in this example, http://localhost:9080/anything/callback obviously belong to "/anything/*" Only by this way can the visit toward callback_url can be intercepted and utilized by the plugin(so that the plugin can get the code and state in Oauth2). The logic of callback_url is implemented competely by plugin so that there is no need to modify the server implement this callback. + +The second parameter "callback_url" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app. + +#### How it works? + +Suppose a new user who have never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo¶m2=bar), considering that "auth-casdoor" is enabled, this visit would be processed by "auth-casdoor" plugin first. After checking the session and confirming that this use hasn't been authentication, the visit will be intercepted. After remembering the original url user wants to visit, he will be redirected to the login page of Casdoor. + +After successfully logging in with username and password(or whatever method he use), Casdoor will redirect this user to the "callback_url" with GET parameter "code " and "state" specified. Because the "callback_url" is known by the plugin, so when the visit toward the "callback_url" is intercepted this time, the logic of "Authorization code Grant Flow" in Oauth2 will be triggered, which means this plugin will request the access token to confirm whether this user is really logged in. After this confirmation, this plugin will redirect this user to the original url user wants to visit, which was remembered by us previously. The logged in status will also be remembered by session + +Next time this user want to visit url behind this route (for example, http://localhost:9080/anything/d), after discovering that this user have been authentication previously, this plugin won't redirect this user any more so that this user can visit whatever he wants under this route without being interfered Review comment: ```suggestion Next time this user want to visit url behind this route (for example, http://localhost:9080/anything/d), after discovering that this user has been authenticated previously, this plugin won't redirect this user anymore so that this user can visit whatever he wants under this route without being interfered ``` ########## File path: apisix/plugins/auth-casdoor.lua ########## @@ -0,0 +1,138 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +local core = require("apisix.core") +local cjson = require("cjson") +local http = require("resty.http") +local session = require("resty.session") +local string = require("string") +local log = core.log +local ngx = ngx + +local plugin_name = "auth-casdoor" +local schema = { + type = "object", + properties = { + casdoor_endpoint = {type = "string"}, + client_id = {type = "string"}, + client_secret = {type = "string"}, + callback_url = {type = "string"}, + test = {type = "boolean", default = false} + }, + required = { + "callback_url", "casdoor_endpoint", "client_id", "client_secret" + } +} + +local _M = {version = 0.1, priority = 2559, name = plugin_name, schema = schema} + +local function get_path(uri) + local without_query = uri:match("(.-)%?") or uri + return without_query:match(".-//[^/]+(/.*)") or without_query +end + +local function fetch_access_token(ctx, conf) + local args = core.request.get_uri_args(ctx) + if not args or not args.code or not args.state then + log.err() + return nil, "failed when accessing token. Invalid code or state" + end + local client = http.new() + local url = get_path(conf.casdoor_endpoint) .. + "/api/login/oauth/access_token" + + if conf.test then + url = get_path(conf.casdoor_endpoint) .. + "/casdoor_fake_access_token_api" + end + + local res, err = client:request_uri(url, { + method = "POST", + query = { + code = args.code, + grant_type = "authorization_code", + client_id = conf.client_id, + client_secret = conf.client_secret + } + }) + if not res then return nil, err end + local data, err = cjson.decode(res.body) + + if err or not data then return nil, err end + + if not data.access_token then + return nil, "failed when accessing token: no access_token contained" + end + + return data.access_token, nil +end + +function _M.check_schema(conf) + local ok, err = core.schema.check(schema, conf) + if not ok then return false, err end + -- check whether contains extra ? or / + local has_extra = string.find(conf.callback_url, "?", 1) + if has_extra then + return false, + "callback_url should not contain get parameters or end up with /" + end + + return true, nil +end + +function _M.access(conf, ctx) + -- log.info("hit auth-casdoor access") + local current_uri = ctx.var.uri + local session_obj_read = session.open() + -- step 1: check whether hits the callback + if get_path(current_uri) == get_path(conf.callback_url) then + local access_token, err = fetch_access_token(ctx, conf) + if access_token then + local original_url = session_obj_read.data.original_uri + if not original_url then + return 503, "no original_url found in session" + end + + local session_obj_write = session.start() + session_obj_write.data.access_token = access_token + session_obj_write:save() + ngx.redirect(original_url, 302) Review comment: Would be better to use this way: https://github.com/apache/apisix/blob/acf7a0cc7f05aa15de21eb1aac798566f45bcb66/apisix/plugins/redirect.lua#L215-L216 So we can have a common place to handle redirection, as we don't use `ngx.exit` directly. ########## File path: apisix/plugins/auth-casdoor.lua ########## @@ -0,0 +1,138 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +local core = require("apisix.core") +local cjson = require("cjson") +local http = require("resty.http") +local session = require("resty.session") +local string = require("string") +local log = core.log +local ngx = ngx + +local plugin_name = "auth-casdoor" +local schema = { + type = "object", + properties = { + casdoor_endpoint = {type = "string"}, + client_id = {type = "string"}, + client_secret = {type = "string"}, + callback_url = {type = "string"}, + test = {type = "boolean", default = false} + }, + required = { + "callback_url", "casdoor_endpoint", "client_id", "client_secret" + } +} + +local _M = {version = 0.1, priority = 2559, name = plugin_name, schema = schema} + +local function get_path(uri) + local without_query = uri:match("(.-)%?") or uri + return without_query:match(".-//[^/]+(/.*)") or without_query +end + +local function fetch_access_token(ctx, conf) + local args = core.request.get_uri_args(ctx) + if not args or not args.code or not args.state then + log.err() + return nil, "failed when accessing token. Invalid code or state" + end + local client = http.new() + local url = get_path(conf.casdoor_endpoint) .. + "/api/login/oauth/access_token" + + if conf.test then + url = get_path(conf.casdoor_endpoint) .. + "/casdoor_fake_access_token_api" + end + + local res, err = client:request_uri(url, { + method = "POST", + query = { + code = args.code, + grant_type = "authorization_code", + client_id = conf.client_id, + client_secret = conf.client_secret + } + }) + if not res then return nil, err end + local data, err = cjson.decode(res.body) + + if err or not data then return nil, err end + + if not data.access_token then + return nil, "failed when accessing token: no access_token contained" + end + + return data.access_token, nil +end + +function _M.check_schema(conf) + local ok, err = core.schema.check(schema, conf) + if not ok then return false, err end + -- check whether contains extra ? or / + local has_extra = string.find(conf.callback_url, "?", 1) + if has_extra then + return false, + "callback_url should not contain get parameters or end up with /" + end + + return true, nil +end + +function _M.access(conf, ctx) + -- log.info("hit auth-casdoor access") + local current_uri = ctx.var.uri + local session_obj_read = session.open() + -- step 1: check whether hits the callback + if get_path(current_uri) == get_path(conf.callback_url) then Review comment: The `ctx.var.uri` only contains path ########## File path: apisix/plugins/auth-casdoor.lua ########## @@ -0,0 +1,138 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +local core = require("apisix.core") +local cjson = require("cjson") +local http = require("resty.http") +local session = require("resty.session") +local string = require("string") +local log = core.log +local ngx = ngx + +local plugin_name = "auth-casdoor" +local schema = { + type = "object", + properties = { + casdoor_endpoint = {type = "string"}, Review comment: ```suggestion endpoint_addr = {type = "string"}, ``` would be better? ########## File path: docs/en/latest/plugins/auth-casdoor.md ########## @@ -0,0 +1,93 @@ +--- +title: auth-casdoor +--- + +<!-- +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--> + +## Summary + +- [**Name**](#name) +- [**Attributes**](#attributes) +- [**Metadata**](#metadata) +- [**How To Enable**](#how-to-enable) +- [**Test Plugin**](#test-plugin) +- [**Disable Plugin**](#disable-plugin) +- [**Examples**](#examples) + +## Name + +`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management + +## Attributes + +| Name | Type | Requirement | Default | Valid | Description | +| ----------- | ------ | ----------- | ------- | ----- | ------------------------------------------------------------ | +| casdoor_endpoint | string | required | | | The url of casdoor. | +| client_id | string | required | | | The client id in casdoor. | +| client_secret | string | required | | | The client secret in casdoor. | +| callback_url | string | required | | | The callback url which is used to receive state and code. | +|test|boolean|not required|false| |used for unit test, no need to set it for users| + +## How To Enable + +You can enable the plugin on any route by giving out all four attributes mentioned above. + +### Example + +```shell +curl "http://127.0.0.1:9080/apisix/admin/routes/1"; -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d ' +{ + "methods": ["GET"], + "uri": "/anything/*", + "plugins": { + "auth-casdoor": { + "casdoor_endpoint":"http://localhost:8000";, + "callback_url":"http://localhost:9080/anything/callback";, + "client_id":"7ceb9b7fda4a9061ec1c", + "client_secret":"3416238e1edf915eac08b8fe345b2b95cdba7e04" + } + }, + "upstream": { + "type": "roundrobin", + "nodes": { + "httpbin.org:80": 1 + } + } +}' + +``` + +In this example, using apisix's admin API we created a route "/anything/*" pointed to "httpbin.org:80", and with "auth-casdoor" enabled. This route is now under authentication protection of casdoor. + +#### explanations about parameters of this plugin + +In the configuration of "auth-casdoor" plugin we can see four parameters. + +The first one is "callback_url". This is exactly the callback url in OAuth2. It should be emphasized that this callback url **must belong to the "uri" you specified for the route**, for example, in this example, http://localhost:9080/anything/callback obviously belong to "/anything/*" Only by this way can the visit toward callback_url can be intercepted and utilized by the plugin(so that the plugin can get the code and state in Oauth2). The logic of callback_url is implemented competely by plugin so that there is no need to modify the server implement this callback. + +The second parameter "callback_url" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app. + +#### How it works? + +Suppose a new user who have never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo¶m2=bar), considering that "auth-casdoor" is enabled, this visit would be processed by "auth-casdoor" plugin first. After checking the session and confirming that this use hasn't been authentication, the visit will be intercepted. After remembering the original url user wants to visit, he will be redirected to the login page of Casdoor. Review comment: ```suggestion Suppose a new user who has never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo¶m2=bar), considering that "auth-casdoor" is enabled, this visit would be processed by "auth-casdoor" plugin first. After checking the session and confirming that this user hasn't been authenticated, the visit will be intercepted. With the original url user wants to visit kept, he will be redirected to the login page of Casdoor. ``` ########## File path: docs/en/latest/plugins/auth-casdoor.md ########## @@ -0,0 +1,93 @@ +--- +title: auth-casdoor +--- + +<!-- +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--> + +## Summary + +- [**Name**](#name) +- [**Attributes**](#attributes) +- [**Metadata**](#metadata) +- [**How To Enable**](#how-to-enable) +- [**Test Plugin**](#test-plugin) +- [**Disable Plugin**](#disable-plugin) +- [**Examples**](#examples) + +## Name + +`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management + +## Attributes + +| Name | Type | Requirement | Default | Valid | Description | +| ----------- | ------ | ----------- | ------- | ----- | ------------------------------------------------------------ | +| casdoor_endpoint | string | required | | | The url of casdoor. | +| client_id | string | required | | | The client id in casdoor. | +| client_secret | string | required | | | The client secret in casdoor. | +| callback_url | string | required | | | The callback url which is used to receive state and code. | +|test|boolean|not required|false| |used for unit test, no need to set it for users| + +## How To Enable + +You can enable the plugin on any route by giving out all four attributes mentioned above. + +### Example + +```shell +curl "http://127.0.0.1:9080/apisix/admin/routes/1"; -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d ' +{ + "methods": ["GET"], + "uri": "/anything/*", + "plugins": { + "auth-casdoor": { + "casdoor_endpoint":"http://localhost:8000";, + "callback_url":"http://localhost:9080/anything/callback";, + "client_id":"7ceb9b7fda4a9061ec1c", + "client_secret":"3416238e1edf915eac08b8fe345b2b95cdba7e04" + } + }, + "upstream": { + "type": "roundrobin", + "nodes": { + "httpbin.org:80": 1 + } + } +}' + +``` + +In this example, using apisix's admin API we created a route "/anything/*" pointed to "httpbin.org:80", and with "auth-casdoor" enabled. This route is now under authentication protection of casdoor. + +#### explanations about parameters of this plugin + +In the configuration of "auth-casdoor" plugin we can see four parameters. + +The first one is "callback_url". This is exactly the callback url in OAuth2. It should be emphasized that this callback url **must belong to the "uri" you specified for the route**, for example, in this example, http://localhost:9080/anything/callback obviously belong to "/anything/*" Only by this way can the visit toward callback_url can be intercepted and utilized by the plugin(so that the plugin can get the code and state in Oauth2). The logic of callback_url is implemented competely by plugin so that there is no need to modify the server implement this callback. + +The second parameter "callback_url" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app. Review comment: ```suggestion The second parameter "endpoint_addr" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app. ``` ########## File path: docs/en/latest/plugins/auth-casdoor.md ########## @@ -0,0 +1,93 @@ +--- +title: auth-casdoor +--- + +<!-- +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +--> + +## Summary + +- [**Name**](#name) +- [**Attributes**](#attributes) +- [**Metadata**](#metadata) +- [**How To Enable**](#how-to-enable) +- [**Test Plugin**](#test-plugin) +- [**Disable Plugin**](#disable-plugin) +- [**Examples**](#examples) + +## Name + +`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management + +## Attributes + +| Name | Type | Requirement | Default | Valid | Description | +| ----------- | ------ | ----------- | ------- | ----- | ------------------------------------------------------------ | +| casdoor_endpoint | string | required | | | The url of casdoor. | +| client_id | string | required | | | The client id in casdoor. | +| client_secret | string | required | | | The client secret in casdoor. | +| callback_url | string | required | | | The callback url which is used to receive state and code. | +|test|boolean|not required|false| |used for unit test, no need to set it for users| + +## How To Enable + +You can enable the plugin on any route by giving out all four attributes mentioned above. + +### Example + +```shell +curl "http://127.0.0.1:9080/apisix/admin/routes/1"; -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d ' +{ + "methods": ["GET"], + "uri": "/anything/*", + "plugins": { + "auth-casdoor": { + "casdoor_endpoint":"http://localhost:8000";, + "callback_url":"http://localhost:9080/anything/callback";, + "client_id":"7ceb9b7fda4a9061ec1c", + "client_secret":"3416238e1edf915eac08b8fe345b2b95cdba7e04" + } + }, + "upstream": { + "type": "roundrobin", + "nodes": { + "httpbin.org:80": 1 + } + } +}' + +``` + +In this example, using apisix's admin API we created a route "/anything/*" pointed to "httpbin.org:80", and with "auth-casdoor" enabled. This route is now under authentication protection of casdoor. + +#### explanations about parameters of this plugin + +In the configuration of "auth-casdoor" plugin we can see four parameters. + +The first one is "callback_url". This is exactly the callback url in OAuth2. It should be emphasized that this callback url **must belong to the "uri" you specified for the route**, for example, in this example, http://localhost:9080/anything/callback obviously belong to "/anything/*" Only by this way can the visit toward callback_url can be intercepted and utilized by the plugin(so that the plugin can get the code and state in Oauth2). The logic of callback_url is implemented competely by plugin so that there is no need to modify the server implement this callback. + +The second parameter "callback_url" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app. + +#### How it works? + +Suppose a new user who have never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo¶m2=bar), considering that "auth-casdoor" is enabled, this visit would be processed by "auth-casdoor" plugin first. After checking the session and confirming that this use hasn't been authentication, the visit will be intercepted. After remembering the original url user wants to visit, he will be redirected to the login page of Casdoor. + +After successfully logging in with username and password(or whatever method he use), Casdoor will redirect this user to the "callback_url" with GET parameter "code " and "state" specified. Because the "callback_url" is known by the plugin, so when the visit toward the "callback_url" is intercepted this time, the logic of "Authorization code Grant Flow" in Oauth2 will be triggered, which means this plugin will request the access token to confirm whether this user is really logged in. After this confirmation, this plugin will redirect this user to the original url user wants to visit, which was remembered by us previously. The logged in status will also be remembered by session Review comment: ```suggestion After successfully logging in with username and password(or whatever method he uses), Casdoor will redirect this user to the "callback_url" with GET parameter "code " and "state" specified. Because the "callback_url" is known by the plugin, when the visit toward the "callback_url" is intercepted this time, the logic of "Authorization code Grant Flow" in Oauth2 will be triggered, which means this plugin will request the access token to confirm whether this user is really logged in. After this confirmation, this plugin will redirect this user to the original url user wants to visit, which was kept by us previously. The logged-in status will also be kept in the session. ``` ########## File path: apisix/plugins/auth-casdoor.lua ########## @@ -0,0 +1,146 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +local core = require("apisix.core") +local cjson = require("cjson") +local http = require("resty.http") +local session = require("resty.session") +local log = core.log +local ngx = ngx + +local plugin_name = "auth-casdoor" +local schema = { + type = "object", + properties = { + casdoor_endpoint = { type = "string" }, + client_id = { type = "string" }, + client_secret = { type = "string" }, + callback_url = { type = "string" }, + test = { type= "boolean", default = false } + }, + required = { + "callback_url", + "casdoor_endpoint", + "client_id", + "client_secret" + } +} + +local _M = { + version = 0.1, + priority = 2559, + name = plugin_name, + schema = schema, +} + +local function get_path(uri) + local without_query = uri:match("(.-)%?") or uri + return without_query:match(".-//[^/]+(/.*)") or without_query +end + +local function fetch_access_token(conf) + local args = core.request.get_uri_args() + if not args.code or not args.state then + log.err() Review comment: The `err` doesn't have parameters in it ########## File path: apisix/plugins/auth-casdoor.lua ########## @@ -0,0 +1,138 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +local core = require("apisix.core") +local cjson = require("cjson") +local http = require("resty.http") +local session = require("resty.session") +local string = require("string") +local log = core.log +local ngx = ngx + +local plugin_name = "auth-casdoor" +local schema = { + type = "object", + properties = { + casdoor_endpoint = {type = "string"}, + client_id = {type = "string"}, + client_secret = {type = "string"}, + callback_url = {type = "string"}, + test = {type = "boolean", default = false} + }, + required = { + "callback_url", "casdoor_endpoint", "client_id", "client_secret" + } +} + +local _M = {version = 0.1, priority = 2559, name = plugin_name, schema = schema} + +local function get_path(uri) Review comment: We can use https://github.com/apache/apisix/blob/acf7a0cc7f05aa15de21eb1aac798566f45bcb66/apisix/plugins/http-logger.lua#L88 to get the path instead of writing own solution. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
