authz-casdoor

Authenticates users against a Casdoor instance.

Category AuthenticationAdd it to Route, Service, Consumer, Consumer group, Global rule, Plugin configEngine plugin authz-casdoorPriority 2559

What it does

authz-casdoor signs people in at Casdoor, an identity provider, before their browser reaches the route's backend. The people live in Casdoor, not on a consumer, and the gateway signs them in as the Casdoor application under Client ID and Client secret. Casdoor sends the browser back to the Callback URL with a sign-in code, and the gateway answers that address itself, so its path has to be one the route serves.

A browser without a session is answered 302 and sent to the sign-in page of the Casdoor at Endpoint address. Authentication explains callers who sign in at an identity provider.

When to use it

• Staff open an internal web application behind the gateway in a browser, and their accounts are kept in the company's Casdoor.
• Several applications of the company already sign people in at Casdoor, and the gateway joins them as one more Casdoor application.
• A backend that has no sign-in of its own should be reached only by people who signed in first.

Not for an OpenID Connect provider or bearer tokens on API calls — see openid-connect (Authenticates users against an OpenID Connect provider), a SAML identity provider — see saml-auth (Authenticates users with a SAML identity provider) or an API key a program sends on every call — see key-auth (Authenticates consumers with an API key sent in a header or query parameter).

Set it up

Send visitors to Casdoor to sign in before they reach the service

The callback path must be one this route serves, since the gateway answers it itself.

Set Endpoint address to https://casdoor.example.com, set Client ID to api-gateway, set Client secret to <secret> and set Callback URL to https://api.example.com/casdoor/callback.

authz-casdoor · as the console saves it

{
  "endpoint_addr": "https://casdoor.example.com",
  "client_id": "api-gateway",
  "client_secret": "<secret>",
  "callback_url": "https://api.example.com/casdoor/callback"
}

Things to know

• Endpoint address — A browser without a session is answered 302 with a Location that starts with this address and goes on with /login/oauth/authorize?.
• Endpoint address — An address without its scheme, http:// or https://, is refused when you save.
• Endpoint address — An address that carries a query string is refused when you save.
• Client ID — The session cookie is named after a digest of this value, so changing it signs every browser holding one out.
• Client secret — A configuration without a client secret is refused when you save.
• Callback URL — An address without a path, http://gateway.example.com for example, is refused when you save.
• Callback URL — An address that ends in a slash is refused when you save.
• AdviceRegister the same Callback URL for the application in Casdoor, and serve the route over HTTPS only.
• On a consumer or a consumer group it runs only after the consumer has been identified by a credential; it does not identify the consumer itself.

Settings

The fields as the console shows them, section by section.

Endpoint addressendpoint_addrstringRequired

pattern

^https?://[^%?]*[^/%?]$

· example https://casdoor.example.com/sso

Client IDclient_idstringRequired

Client secretclient_secretstringRequired

The client secret Casdoor issued for this application. Stored on the engine and shown only to roles that manage this object.

Callback URLcallback_urlstringRequired

The full address Casdoor sends the sign-in code back to, such as https://gw.example.com/callback. The gateway answers this path itself. It needs a path, cannot end in a slash and cannot carry a query string. An address without a path is stored, and every request then answers 503.

pattern

^[^%?]+//[^/%?]+/[^%?]*[^/%?]$

· example https://gateway.example.com/casdoor/callback

Every plugin also has Enabled, Priority, Filter, Error response and Pre-function: see Plugin execution settings.