apache
help request: failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported
Description
The documentation for the multi-auth plugin says:
This plugin provides a flexible authentication mechanism by iterating through the list of authentication plugins specified in the auth_plugins attribute. It allows multiple consumers to share the same route while using different authentication methods. For example, one consumer can authenticate using basic authentication, while another consumer can authenticate using JWT.
However when setting it up with openid-connect (which to my knowledeg is a auth plugin) I get the following message:
{"error_msg":"failed to check the configuration of plugin multi-auth err: openid-connect plugin is not supported"}
Is the openid-connect some kind of exception?
Environment
I am using this docker image: apache/apisix:3.9.1-redhat
Same for the authz-keycloak plugin:
{"error_msg":"failed to check the configuration of plugin multi-auth err: authz-keycloak plugin is not supported"}
I just looked at the source of the plugin and it seems like the problem is just that the open-idconnect plugin doesn't have the type set to "auth" in its _M object. Is that the only problem? Or are there other issues related because the plugin does authentication in a different way to the other plugins? They just seem to return nil on their rewrite method if the request is fine.
I've stumbled upon this problem and also on the missing "auth" type in the _M object. Did you find any solution @jonathan-dev?
I ended up adjusting the source code of the plugin to my need and loaded it as a custom plugin which wasn't all that hard to do
I found a solution for my problem by implementing two basically identical routes /api/my-service/*
The first route has OIDC enabled and this extra vars:
"vars": [
[
"arg_apikey",
"!",
"~~",
"."
]
]
The second route has key-auth enabled and this extra vars:
"vars": [
[
"arg_apikey",
"~~",
"."
]
]
This approach uses pattern matching to figure out which route the request should take. If there is the request parameter "apikey=ANYSTRING" present, second route is used. If there is no request parameter apikey present, the first route is used.
It's not great and it would be cool to have multi-auth work out of the box, but it works.
This plugin provides a flexible authentication mechanism by iterating through the list of authentication plugins specified in the auth_plugins attribute.
authentication plugins have type = 'auth' in plugin defined code.
Is this problem solved? I tried to use multi-auth plugin with some key-auth and openid-connect using docker image version 3.12.0-debian. But the problem is still occurring
openid-connect is not an auth plugin, so it cannot be used in multi-auth.