Adding Authorization to APIs on Kong API Gateway with Kubernetes and Helm Charts

Your service is up and running. Now it is time to apply access control with SecureAuth.

Your Kong Authorizer is now set up and ready for deployment.

In the Settings tab, you'll find essential credentials such as client ID, client secret, and issuer URL. These credentials are automatically generated by SecureAuth for the authorizer's client application within the System workspace of your tenant. They are vital for authenticating with the SecureAuth authorization server, which is a necessary step for operations like retrieving policy definitions.

SecureAuth provides a dedicated Helm Chart for deploying the Kong Authorizer.

Your authorizer is up and running. If you enabled the Create and bind services automatically option, the authorizer discovers the APIs deployed on Kong Gateway, pushes them to SecureAuth platform, and automatically creates a Service.

To attach the SecureAuth Kong Plugin in a DB-less Kong Gateway setup, add plugins declaration with the SecureAuth Kong Plugin configuration as part of the config setting. See example:

dblessConfig:
  configMap: ""
  config: |
    _format_version: "1.1"
    plugins:
      - name: acp
        config:
          api_group_id: example-service
          auth_url: https://kong-authorizer.cl-kong-authorizer.svc:9003/authorize
          ssl_verify: false
    services:
      - name: example-service
        url: http://httpbin.default.svc:80
        routes:
          - name: anything
            paths:
              - "/anything"
            methods:
              - GET
              - POST
              - DELETE
              - PUT
            strip_path: false            

Note the api_group_id being set to the same value as the service name.

# acp
acp:
    reload_interval: 1m0s # reload interval
    reload_timeout: 30s # reload configuration timeout
    issuer_url: https://localhost:8443/sample/system # issuer url
    client_id: bqesdrc4m4co2s81mpu0 # client id
    client_secret: LH6mAb6PNljvjYMIF-A5RP2bElA5a5bnQah8sG0fsLA # client secret
    tenant_id: "" # tenant id
    server_id: "" # server id
# http client
http_client:
    timeout: 10s # http client timeout
    retry_wait_min: 0s # minimum time to wait between retries
    retry_wait_max: 0s # maximum time to wait between retries
    retry_max: 0 # maximum number of retries
    root_ca: "" # root ca that this client should trust (defaults to system root ca)
    insecure_skip_verify: false # disable cert verification
    disable_follow_redirects: false # disable follow redirects
    disable_retry: true # disable retry
# metrics
metrics:
    enabled: false # enable metrics endpoint
    port: 9000 # metrics endpoint port
# analytics
analytics:
    enabled: true # when enabled, events are sent to audit log
    # event format
    event_format:
        include_policy_output: false # when enabled, policy evaluation output is sent to audit log
    # sampling
    sampling:
        probability: 1 # Probability of an event to be published (0.0-1.0)
        batch_inverval: 1s # Max duration to wait for a batch to publish
        batch_limit: 100 # Max number of events in a batch
        limit: 5 # Max number of batches per second to be published
        timeout: 5s # Timeout for a single batch to send
        workers: 8 # Number of sending workers
# cache
cache:
    ttl: 10s # ttl
    max_size: 100 # max size
# logging config
logging:
    level: info # log level severity
# token echange config
token_exchange:
    enabled: false # enable token exchange
    # cache
    cache:
        ttl: 1m0s # ttl
        max_size: 1000 # max size
    # inject config (supported only for istio authorizer)
    inject:
        mode: "" # Defines what token should be sent to the target service when token is exchanged
        # headers config
        headers:
            exchanged_token: "" # Defines the name of the header that contains an exchanged token.
            original_token: "" # Defines the name of the header that contains an original token.
            strip_bearer: false # Allows to strip the bearer prefix in headers
# enforcement config
enforcement:
    allow_unknown: false # allow requests with no matching rule
# discovery config
discovery:
    enabled: true # when true, API discovery is enabled
    timeout: 10s # discovery process timeout
    interval: 30s # how often discovery is performed
# http server
http_server:
    port: 9003 # http port
    dangerous_disable_tls: false # diables TLS
    # certificate configuration
    certificate:
        password: "" # key passphrase
        cert_path: "" # path to the certificate PEM file
        key_path: "" # path to the key PEM file
        cert: "" # base64 encoded cert PEM
        key: "" # base64 encoded key PEM
        generated_key_type: ecdsa # type for generated key if cert and key are not provided (rsa or ecda)
    client_auth_type: 0 # client auth type
# kong
kong:
    admin_url: "" # kong admin url indicates the Kong Admin API
    admin_token: "" # kong admin token for RBAC authentication to Kong Admin API
    admin_username: "" # kong admin username for Basic Auth to Kong Admin API
    admin_password: "" # kong admin password for Basic Auth to Kong Admin API
    admin_client_id: "" # kong admin client ID for OAuth2 authentication to the Kong Admin API
    admin_client_secret: "" # kong admin client secret for OAuth2 authentication to the Kong Admin API
    admin_issuer_url: "" # kong admin issuer url for OAuth2 authentication to the Kong Admin API
    # http client used to access the Kong Admin API
    http_client:
        timeout: 0s # http client timeout
        retry_wait_min: 0s # minimum time to wait between retries
        retry_wait_max: 0s # maximum time to wait between retries
        retry_max: 0 # maximum number of retries
        root_ca: "" # root ca that this client should trust (defaults to system root ca)
        insecure_skip_verify: true # disable cert verification
        disable_follow_redirects: false # disable follow redirects
        disable_retry: false # disable retry            

For most up to date reference, use the helm show values acp/kong-authorizer command in your terminal.

## kong-authorizer image parameters
##
image:
  ## Image repository
  ##
  repository: docker.cloudentity.io/kong-authorizer

  ## Image pull policy
  ##
  pullPolicy: IfNotPresent

  ## Image tag (immutable tags are recommended, default is the chart appVersion)
  ##
  tag: ""

## Number of desired pod replicas if deployAsDaemonSet set to false.
##
replicaCount: 1

## Autoscaling parameters if deployAsDaemonSet set to false.
##
autoscaling:
  ## Enable autoscaling
  ##
  enabled: false

  ## Define mix replica count
  ##
  # minReplicas: 0

  ## Define max replica count
  ##
  # maxReplicas: 1

  ## The average CPU usage of a all pods in a deployment
  ##
  # targetCPUUtilizationPercentage: ""

  ## The average memory usage of a all pods in a deployment
  ##
  # targetMemoryUtilizationPercentage: ""

  ## Custom scaling behavior
  ##
  #  behavior: {}


## A map with annotations
##
podAnnotations: []

## kong-authorizer image registry secret names as an array
##
imagePullSecrets:
  - name: docker.cloudentity.io

## Pod security context
##
podSecurityContext:
  fsGroup: 1000
  runAsGroup: 1000
  runAsNonRoot: true
  runAsUser: 1000
  seccompProfile:
    type: RuntimeDefault

## Container security context
##
containerSecurityContext:
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  seccompProfile:
    type: RuntimeDefault

## String to fully override kong-authorizer.fullname
##
# fullnameOverride: ""

## Service account to use by the kong-authorizer
##
serviceAccount:
  ## Specifies whether a service account should be created
  ##
  create: true
  ## Annotations to add to the service account
  ##
  annotations: {}
  ## The name of the service account to use.
  ## If not set and create is true, a name is generated using the fullname template
  ##
  name: ""

## Issuer URL of your tenant's ACP system workspace
##
## When using kong-authorizer in single-tenant mode, this should point
## to the system workspace of your tenant.
## i.e. "http://authz.cloudentity.io/yourtenant/system"
##
## If you're using multi-tenant kong-authorizer this should point
## to the `system` workspace of your `system` tenant.
## i.e. "http://yourdomain.com/system/system"
##
issuerURL: "https://acp.acp-system:8443/default/system"

## Vanity Domain
## If the issuerURL uses a vanity domain, you will need to specify the tenantID,
## and if the domain is per-server, then you must also specify the serverID.
##
tenantID: ""
serverID: ""

## Pod resources definition
resources: {}
  # requests:
  #   cpu: 10m
  #   memory: 48Mi
  # limits:
  #   cpu: 100m
  #   memory: 96Mi

## Credentials for your ACP kong-authorizer
##
##
clientCredentials:
  ## Default dummy values
  ## You can provide credentials generated by ACP for your kong gateway.
  ##
  clientID: "c7c7mgmvd3ibf6k124n0"
  clientSecret: "TuIEmSWHtU-0ftOO7445nccomqu71V4Wcv4SW3fzviM"

## kong-authorizer config file from secret
##
secretConfig:
  ## Specifies whether a kubernetes secret should be created.
  ## For production setup, please create the secret (ideally encrypted) manually
  ## parameter to integrate with kong-authorizer
  ##
  create: true

  ## The name of the client secret to use
  ## If not set and create is true, a name is generated using the fullname template
  ##
  # name: ""

## node selector for pod assignment
##
## nodeSelector: {}

## Affinity for pod assignment
##
affinity: {}
  # nodeAffinity:
  #   requiredDuringSchedulingIgnoredDuringExecution:
  #   nodeSelectorTerms:
  #     - matchExpressions:
  #         - key: authorizer
  #           operator: In
  #           values:
  #             - "true"

## Tolerations for pod assignment
##
tolerations: []
#- key: authorizer
#  value: "true"
#  effect: NoSchedule

## Kong-authorizer pod topology spread constraints
##
# topologySpreadConstraints: {}

## Logging configuration
##
logging:
  ## log level
  ##
  level: info

## Authorizer discovery configuration
##
discovery:
  ##  When true, API discovery is enabled
  ##
  enabled: true

## Enforcement configuration
##
enforcement:
  ## allow requests with no matching rule
  ##
  allowUnknown: false

## Kong configuration
##
kong:
  ## Admin portal URL
  admin_url: http://kong-kong-admin.kong-system:8001

service:
  ## kong-authorizer service type
  ##
  type: ClusterIP

  ## kong-authorizer service HTTP port
  ##
  port: 9003
  name: http
  # appProtocol: https

ingress:
  ## Enables the Ingress for kong-authorizer.
  ## This is only needed when Kong runs outside the cluster.
  ##
  enabled: false

  ## Ingress class name
  # className: nginx

  ## Ingress annotations
  ##
  # annotations:

  ## Ingress hostnames with paths
  ##
  hosts:
    - host: kong-authorizer.kong-authorizer
      paths:
        - path: /authorize

  ## Ingress TLS configuration
  ## Secrets must be manually created in the namespace
  tls: []
  #  - secretName: kong-authorizer-tls
  #    hosts:
  #      - kong.domain.com

## Token exchange settings
##
tokenExchange:
  ## Enable token exchange (temporary until acp 2.0 is released)
  ##
  enabled: false

  ## Token exchange inject settings
  inject:
    ## Inject mode, defines what token should be send to the target service
    ## One of: InjectOriginalToken, InjectExchangedToken, InjectBothTokens
    ##
    mode: "InjectExchangedToken"

    headers:
      ## Original token header name
      ##
      originalToken: ""

      ## Exchanged token header name
      ##
      exchangedToken: "Authorization"

      ## strip bearer token
      ##
      stripBearer: false

## ACP http client configuration
##
# httpClient:
#   ## Set the ca.crt to the CA certificate used by ACP.
#   ## If you're exposing ACP with your own custom (not publicly trusted) certificates, Kong Authorizer needs to trust them.
#   ##
#   rootCa: |
#     -----BEGIN CERTIFICATE-----
#     -----END CERTIFICATE-----

## Additional kong-authorizer ConfigMap entries
## The data should match kong-authorizer configuration options
## https://docs.authorization.cloudentity.com/guides/developer/protect/kong/authz_config_reference/
##
# extraConfig: {}            

While discovering services, Kong Authorizer may need to authenticate to Kong Gateway Admin APIs using one of the below methods depending on your gateway configuration.

To simulate an external IDP, we will use a separate workspace as an external token service.

In a real world scenario, you would skip this step - instead, you would just add the Third Party Token Service as a trusted IDP in the workspace where the Kong Gateway and Authorizer are connected.

In this section, we will connect the external token service as IDP (token service). We will use the generic OIDC IDP template, to connect our mock external token service. In real world, you would connect any OIDC-based IDP.

You can see that the token exchange is enabled for the configured Identity Provider. Here, you can control which IDPs are trusted for this authorizer.

For detailed information about Kong Authorizer configuration, see the Configure Kong Authorizer section.

Token exchange in Kong Authorizer is controlled by the following settings in Kong Authorizer values.yaml file:

## Token exchange settings
##
tokenExchange:
  ## Enable token exchange (temporary until acp 2.0 is released)
  ##
  enabled: false

  ## Token exchange inject settings
  inject:
    ## Inject mode, defines what token should be send to the target service
    ## One of: InjectOriginalToken, InjectExchangedToken, InjectBothTokens
    ##
    mode: "InjectExchangedToken"

    headers:
      ## Original token header name
      ##
      originalToken: ""

      ## Exchanged token header name
      ##
      exchangedToken: "Authorization"

      ## strip bearer token
      ##
      stripBearer: false            

As you can see, you can configure which tokens are used when accessing the APIs:

Your Kong Authorizer is now capable of exchanging access tokens.

If you followed this article, so far we did not check for access tokens when applying access control in Kong Authorizer. We need to create an authorization policy, apply it to one of our discovered APIs, and check if external tokens are exchanged correctly.

curl http://localhost:8000/anything/anywhere -v \
  -H "Authorization: Bearer $AT"            

HTTP/1.1 200 OK
< Content-Type: application/json
< Content-Length: 2720
< Connection: keep-alive
< Server: gunicorn/19.9.0
< Date: Thu, 09 Nov 2023 13:45:18 GMT
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Credentials: true
< X-Kong-Upstream-Latency: 2
< X-Kong-Proxy-Latency: 527
< Via: kong/3.4.1.1-enterprise-edition
<
{
  "args": {},
  "data": "",
  "files": {},
  "form": {},
  "headers": {
    "Accept": "*/*",
    "Authorization": "Bearer eyJhbGciOiJFUzI1NiIsImtpZCI6IjI0ODkwMDYxNzU2NDcyNjQ2Mzk5NjY1NDgzMzM0ODk1NjQ4ODA0MSIsInR5cCI6IkpXVCJ9.eyJhY3IiOiIwIiwiYWlkIjoiZGVtbyIsImFtciI6WyJwd2QiXSwiYXVkIjpbImI0OWY5NTFlOWU5NDQ2YWI4MGM2YzVlOTBiNTEyYzRkIiwic3BpZmZlOi8vYWNtZS1vcmcuZXUuYXV0aHouY2xvdWRlbnRpdHkuaW8vYWNtZS1vcmcvZGVtby9kZW1vLXByb2ZpbGUiXSwiZXhwIjoxNjk5NTQxMTE3LCJpYXQiOjE2OTk1Mzc1MTcsImlkcCI6IjE5NzA4MjlkNmQxNDQ1YTA5Yzg4MjZkZjM2NTM3ZTY1IiwiaXNzIjoiaHR0cHM6Ly9hY21lLW9yZy5ldS5hdXRoei5jbG91ZGVudGl0eS5pby9hY21lLW9yZy9kZW1vIiwianRpIjoiZjFmZTU2MGYtZDJiNS00NGQ0LWE4ZjktZTJiZTJmNWExZjU5IiwibmJmIjoxNjk5NTM3NTE3LCJzY3AiOlsiZW1haWwiLCJwcm9maWxlIl0sInN0IjoicHVibGljIiwic3ViIjoiM2Q0ODNmYmE1MzgxZWM2NDIwOTAwMjYzMTU3OWJiZjRhNjA3MDgxYzk3YTE4ZmM2YzJmZjdlNDVkYTkyMzRlYiIsInRpZCI6ImFjbWUtb3JnIn0.Ax6gI9b6j5_SSWV_FzQ5B4snqjb6OCy2BwRTYVbLEYZkRzpmWPTf5DOYaosbCwRyQd1Yt0KG5W9oXV4LnuAkyg",
    "Connection": "keep-alive",
    "Ext-Token-Service": "Bearer eyJhbGciOiJFUzI1NiIsImtpZCI6IjE5NjcyODQwNDE1NzI3MjgwMjcxNjY3NTA1MjQ3NjIyOTgyOTg1MyIsInR5cCI6IkpXVCJ9.eyJhY3IiOiIxIiwiYWlkIjoiZXh0ZXJuYWwtdG9rZW4tc2VydmljZSIsImFtciI6WyJwd2QiXSwiYXVkIjpbImV4dGVybmFsLXRva2VuLXNlcnZpY2UtZGVtbyIsInNwaWZmZTovL2FjbWUtb3JnLmV1LmF1dGh6LmNsb3VkZW50aXR5LmlvL2FjbWUtb3JnL2V4dGVybmFsLXRva2VuLXNlcnZpY2UvZXh0ZXJuYWwtdG9rZW4tc2VydmljZS1wcm9maWxlIiwic3BpZmZlOi8vYWNtZS1vcmcuZXUuYXV0aHouY2xvdWRlbnRpdHkuaW8vYWNtZS1vcmcvZXh0ZXJuYWwtdG9rZW4tc2VydmljZS9leHRlcm5hbC10b2tlbi1zZXJ2aWNlLW9hdXRoMiIsInNwaWZmZTovL2FjbWUtb3JnLmV1LmF1dGh6LmNsb3VkZW50aXR5LmlvL2FjbWUtb3JnL2V4dGVybmFsLXRva2VuLXNlcnZpY2UvZXh0ZXJuYWwtdG9rZW4tc2VydmljZS11c2VyLXByaXZhY3ktY29uc2VudCJdLCJleHAiOjE2OTk1NDAyNzksImlhdCI6MTY5OTUzNjY3OSwiaWRwIjoiYWM1MjYwMTVkYjYwNDYwN2I0MzA2Nzk1YzdmYzViYjYiLCJpc3MiOiJodHRwczovL2FjbWUtb3JnLmV1LmF1dGh6LmNsb3VkZW50aXR5LmlvL2FjbWUtb3JnL2V4dGVybmFsLXRva2VuLXNlcnZpY2UiLCJqdGkiOiIxNGJiZjcyYy03NzUyLTQ4YWItYjk3Mi0zNzE5YjlkODYzMzIiLCJuYmYiOjE2OTk1MzY2NzksInNjcCI6WyJlbWFpbCIsImludHJvc3BlY3RfdG9rZW5zIiwibGlzdF9jbGllbnRzX3dpdGhfYWNjZXNzIiwibWFuYWdlX2NvbnNlbnRzIiwib2ZmbGluZV9hY2Nlc3MiLCJvcGVuaWQiLCJwcm9maWxlIiwicmV2b2tlX2NsaWVudF9hY2Nlc3MiLCJyZXZva2VfdG9rZW5zIiwidmlld19jb25zZW50cyJdLCJzdCI6InB1YmxpYyIsInN1YiI6IjVjMTg5NjVmNjVmOWI2YTFlNDFlZDI0YWUwOGZlZDk2OTU2MTE2MTVhMzBmNTZhZDlkYjRjNmUxZDg2NDA2NjgiLCJ0aWQiOiJhY21lLW9yZyJ9.DcAVK__Uw_DluVBEX59Y_GQvfox13HqkJQZZ1qvXY4g-ENyA8JptwzZLUAuH49Ad7683SYcKSb8z2E8E7s7ong",
    "Host": "httpbin.default.svc",
    "User-Agent": "curl/7.77.0",
    "X-Forwarded-Host": "localhost",
    "X-Forwarded-Path": "/anything/anywhere"
  },
  "json": null,
  "method": "GET",
  "origin": "127.0.0.1",
  "url": "http://localhost/anything/anywhere"
}
* Connection #0 to host localhost left intact            

SecureAuth Kong Authorizer caches exchanged access tokens for a defined time period.

To adjust the amount of tokens cached and how long they stay cached, configure the cache.ttl and cache.max_size settings for your authorizer:

token_exchange:
    enabled: true # enable token exchange
    # cache
    cache:
        ttl: 1m0s # ttl
        max_size: 1000 # max size            

When the cache's max size is reached, the least recently used token is revoked.

When ready, pass the configuration as part of the extraConfig section for your authorizer deployment values.yaml file and redeploy the authorizer. See example:

extraConfig:
  token_exchange:
    cache:
        ttl: 1m0s # ttl
        max_size: 1000 # max size