Adding Authorization to APIs on Kong API Gateway with Docker

Docker v1.19+ and Docker Compose installed for Docker-Based Kong Deployments.

Access to an SecureAuth SaaS tenant

Service to be protected by Kong Authorizer is deployed (this instruction allows you to deploy a mock service for testing purposes).

Clone the docker-kong project.

Add the following steps to your Kong Gateway's Dockerfile to make sure the kong-acp-plugin is installed.

USER root

RUN apk add gcc musl-dev

RUN  luarocks install kong-plugin-acp                  

As a result, the content in the customize/Dockerfile file should look similar to the following:

ARG KONG_BASE=kong:2.8

FROM ${KONG_BASE} AS build

ARG PLUGINS
ENV INJECTED_PLUGINS=${PLUGINS}

ARG TEMPLATE=empty_file
ENV TEMPLATE=${TEMPLATE}

ARG ROCKS_DIR=empty_file
ENV ROCKS_DIR=${ROCKS_DIR}

ARG KONG_LICENSE_DATA
ENV KONG_LICENSE_DATA=${KONG_LICENSE_DATA}

COPY $TEMPLATE /custom_nginx.conf
COPY $ROCKS_DIR /rocks-server
COPY packer.lua /packer.lua

USER root

RUN /usr/local/openresty/luajit/bin/luajit /packer.lua -- "$INJECTED_PLUGINS"

FROM ${KONG_BASE}

USER root

RUN apk add gcc musl-dev

RUN  luarocks install kong-plugin-acp

# Workarounds used:
#  1 - the "custom_nginx.conf*" wildcard ensures it doesn't fail if it doesn't exist
#  2 - "RUN true", see https://stackoverflow.com/questions/51115856/docker-failed-to-export-image-failed-to-create-image-failed-to-get-layer/62409523#62409523

# replace the entrypoint, add the custom template if it exists
COPY --from=build /docker-entrypoint.sh /old-entrypoint.sh /custom_nginx.conf* /
RUN true

# add the Lua files (.lua)
COPY --from=build /usr/local/share/lua/5.1 /usr/local/share/lua/5.1
RUN true

# add the compiled libraries (.so)
COPY --from=build /usr/local/lib/lua/5.1 /usr/local/lib/lua/5.1
RUN true

# add the Luarocks manifest
COPY --from=build /usr/local/lib/luarocks/rocks-5.1 /usr/local/lib/luarocks/rocks-5.1
RUN true

HEALTHCHECK --interval=10s --timeout=10s --retries=10 CMD kong health

USER kong                  

In terminal, navigate to the /customize directory within your cloned project and build your image with the following command:

docker build \
--build-arg PLUGINS="kong-http-to-https,kong-upstream-jwt,kong-plugin-acp" \
--build-arg "KONG_LICENSE_DATA=$KONG_LICENSE_DATA" \
--tag "kong-acp" .                  

In your SecureAuth tenant, go to the workspace of your choice.

Select Authorization > Gateways > CREATE GATEWAY > Kong.

Provide a name and a description for your Kong Authorizer.

Optionally, enable the Create and bind services automatically check box.

Follow the Quick Start instruction. Download the package for your Authorizer and check the instructions in the section below.

Unzip the package with the downloaded Kong Authorizer.

In the .env file, set the KONG_ADMIN_URL to the URL of your Kong Admin API.

In the terminal, navigate to the directory with your Kong Authorizer and execute the following commands:

cat credentials.txt | docker login docker.cloudentity.io --username acp --password-stdin                  

and

docker-compose up

The first command logins to SecureAuth docker with the credentials provided in the credentials.txt file in your Kong Authorizer package.

The docker-compose up spins up a Docker container with the Kong Authorizer for you. In the logs for the Kong Authorizer, you should see that it starts the authorizer reload. At this point, however, your authorizer is not yet running in the same network as your Kong Gateway, so it is not possible for the authorizer to communicate with the gateway.

Connect your authorizer to the same network that your Kong Gateway uses.

In general, you can use a method of your choice to connect your authorizer to the network. You can, for example, execute the following command when the container with your Kong Authorizer is running:

docker network connect {network} {container}                  

For example: docker network kong-network 1babdf8b72a6