Kong Gateway - 03 基于网关服务的OAuth2验证（OAuth2 Authentication Code Grant 授权码模式）

其他 2018-05-08 21:47:58 阅读次数: 4

https://getkong.org/plugins/oauth2-authentication

我们演示还是用books 的Restful api数据接口，把Kong Gateway - 01范例中PostgresSQL中的kong数据库删掉，

导入一个已经配置好的干干净净的后台数据库kong-20180427.bak

（参看安装篇 How to Install kong-community-edition On Cent OS 7）

[root@contoso ~]# pg_dump --help  
[root@contoso ~]# psql --help  
[root@contoso ~]# dropdb --help  
[root@contoso ~]# createdb --help 
[root@contoso ~]# kong stop  # kong 服务必须先停止运行
[root@contoso ~]# dropdb -h 127.0.0.1 -p 5432 -U postgres kong   # 删除kong数据库  
Password: 123456  
[root@contoso ~]# createdb -h 127.0.0.1 -p 5432 -U postgres kong   # 创建kong数据库  
Password: 123456  
[root@contoso ~]# psql -h 127.0.0.1 -p 5432 -U postgres -d kong < /opt/kong-20180427.bak   # 恢复kong数据库  
Password for user postgres: 123456
[root@contoso ~]# kong start

Kong started

用Kong配置一个book服务
在安装并启动Kong之后，使用Kong的管理API端口8001添加一个名称为book的服务
[root@contoso ~]# curl -i -X POST \
--url http://localhost:8001/services/ \
--data 'name=book' \
--data 'url=http://contoso.com/v1/books'

HTTP/1.1 201 Created
Date: Sun, 06 May 2018 16:25:47 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "host": "contoso.com", 
    "created_at": 1525595147, 
    "connect_timeout": 60000, 
    "id": "2d3d56de-02c4-4517-b786-2dc4037bf23d", 
    "protocol": "http", 
    "name": "book", 
    "read_timeout": 60000, 
    "port": 80, 
    "path": "/v1/books", 
    "updated_at": 1525595147, 
    "retries": 5, 
    "write_timeout": 60000
}
以下几条命令不必执行，以后会用到
查询已分配了服务名称的路由列表
curl -i -X GET \
--url http://localhost:8001/services/book/routes

查询所有路由列表
curl -i -X GET \
--url http://localhost:8001/routes

根据路由id查询1条路由
curl -i -X GET \
--url http://localhost:8001/routes/4e0ddea7-ec70-41b9-bdd1-9b7c893b8ede 

根据路由id删除1条路由
curl -i -X DELETE \
--url http://localhost:8001/routes/4e0ddea7-ec70-41b9-bdd1-9b7c893b8ede
 
根据id,hosts修改1条路由，根据同一名称的book服务，配置methods参数无
法用不同的路由来区分控制器方法的权限，故不用设置methods参数;
修改路由的方式无法设置参数的null值，我们只能删掉路由，然后创建路由来实现
curl -i -X PATCH \
--url http://localhost:8001/routes/4e0ddea7-ec70-41b9-bdd1-9b7c893b8ede \
--data 'hosts[]=contoso.com' \
--data 'paths[]=/v1/books'
添加一个路由（paths[]的值必须与book服务中的/v1/books一致）
使book服务暴露出来以供用户访问，book服务没必要添加多个路由。
[root@contoso ~]# curl -i -X POST \
--url http://localhost:8001/services/book/routes \
--data 'hosts[]=contoso.com' \
--data 'paths[]=/v1/books' 
HTTP/1.1 201 Created
Date: Sun, 06 May 2018 16:27:51 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525595271, 
    "strip_path": true, 
    "hosts": [
        "contoso.com"
    ], 
    "preserve_host": false, 
    "regex_priority": 0, 
    "updated_at": 1525595271, 
    "paths": [
        "/v1/books"
    ], 
    "service": {
        "id": "2d3d56de-02c4-4517-b786-2dc4037bf23d"
    }, 
    "methods": null, 
    "protocols": [
        "http", 
        "https"
    ], 
    "id": "bacfd048-dbcc-453a-bbce-a29e8d3f86b7"
}
通过Kong在8000端口暴露出来的服务地址获得所有的书籍
[root@contoso ~]# curl -i -X GET \
--url http://localhost:8000/v1/books \
--header 'Host: contoso.com' 
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 244
Connection: keep-alive
Date: Sun, 06 May 2018 16:28:40 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 29
X-Kong-Proxy-Latency: 49
Via: kong/0.13.1

[
    {
        "id": 1, 
        "title": "Fashion That Changed the World", 
        "author": "Jennifer Croll"
    }, 
    {
        "id": 2, 
        "title": "Brigitte Bardot - My Life in Fashion", 
        "author": "Henry-Jean Servat and Brigitte Bardot"
    }, 
    {
        "id": 3, 
        "title": "The Fashion Image", 
        "author": "Thomas Werner"
    }
]
curl http://localhost:8001/services/book
curl http://localhost:8001/services/book/plugins

为book服务启用OAuth 2.0 Authentication插件,并激活授权码模式
[root@contoso ~]# curl -i -X POST \
--url http://localhost:8001/services/book/plugins \
--data "name=oauth2"  \
--data "config.scopes=email,phone,address" \
--data "config.mandatory_scope=true" \
--data "config.enable_authorization_code=true" 

HTTP/1.1 201 Created
Date: Sun, 06 May 2018 16:30:11 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525624193000, 
    "config": {
        "refresh_token_ttl": 1209600, 
        "scopes": [
            "email", 
            "phone", 
            "address"
        ], 
        "mandatory_scope": true, 
        "provision_key": "5o5KnTRlpySbf7ViwYSkWPAZZ4vufSwe", 
        "hide_credentials": false, 
        "enable_authorization_code": true, 
        "enable_implicit_grant": false, 
        "global_credentials": false, 
        "accept_http_if_already_terminated": false, 
        "enable_password_grant": false, 
        "enable_client_credentials": false, 
        "anonymous": "", 
        "token_expiration": 7200, 
        "auth_header_name": "authorization"
    }, 
    "id": "acacd3e0-1c16-4301-8572-51221b46e997", 
    "enabled": true, 
    "service_id": "2d3d56de-02c4-4517-b786-2dc4037bf23d", 
    "name": "oauth2"
}
添加1个username为jack的消费者，{custom_id}参数可省略，此参数是个自定义唯一标识，
它作用是把消费者jack映射到另外一个数据库上
[root@contoso ~]# curl -i -X POST \
--url http://localhost:8001/consumers/  \
--data "username=jack" 
HTTP/1.1 201 Created
Date: Sun, 06 May 2018 16:33:14 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525624395000, 
    "username": "jack", 
    "id": "786d2951-2744-4de2-bcf2-448b6b0ac954"
}
为消费者jack创建1个名称为Book App的应用，redirect_uri参数定义发送code和state的回调地址
参数{client_id}和{client_secret}可自定义，省略时由系统随机生成
[root@contoso ~]# curl -i -X POST \
--url http://localhost:8001/consumers/jack/oauth2/ \
--data "name=Book App" \
--data "redirect_uri=http://getkong.org/" 
HTTP/1.1 201 Created
Date: Sun, 06 May 2018 16:34:16 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "client_id": "LzFEyMMaQyRIHsSsqfonZfofQIHigOF4", 
    "created_at": 1525624457000, 
    "id": "4858dcb0-9f2b-4d6e-acc5-c76f9ac5ca17", 
    "redirect_uri": [
        "http://getkong.org/"
    ], 
    "name": "Book App", 
    "client_secret": "YhCHW7xISxmTPd41qJFkjDkcsurVADUV", 
    "consumer_id": "786d2951-2744-4de2-bcf2-448b6b0ac954"
}
根据{client_id}查询消费者的应用程序信息
[root@contoso ~]# curl -i -X GET \
--url http://localhost:8001/oauth2 \
--data "client_id=LzFEyMMaQyRIHsSsqfonZfofQIHigOF4" 
HTTP/1.1 200 OK
Date: Sun, 06 May 2018 16:35:17 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "total": 1, 
    "data": [
        {
            "created_at": 1525624457000, 
            "client_id": "LzFEyMMaQyRIHsSsqfonZfofQIHigOF4", 
            "id": "4858dcb0-9f2b-4d6e-acc5-c76f9ac5ca17", 
            "redirect_uri": [
                "http://getkong.org/"
            ], 
            "name": "Book App", 
            "client_secret": "YhCHW7xISxmTPd41qJFkjDkcsurVADUV", 
            "consumer_id": "786d2951-2744-4de2-bcf2-448b6b0ac954"
        }
    ]
}
通过Kong在8000端口暴露出来的服务地址读一条书籍记录，实际上是通过Kong在转
发我的请求，不管是读1条记录还读所有书籍记录，我们都无权获得数据
[root@contoso ~]# curl -i -X GET \
--url http://localhost:8000/v1/books/2 \
--header 'Host: contoso.com' 
HTTP/1.1 401 Unauthorized
Date: Sun, 06 May 2018 16:35:55 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: kong/0.13.1
WWW-Authenticate: Bearer realm="service"

{
    "error_description": "The access token is missing", 
    "error": "invalid_request"
}
很显然，命令中没有提供访问令牌，此命令已经无法访问书籍接口了，
键-值对{username:password}字符串 [email protected]:123456
它的Base64编码值等于amFja0Bob3RtYWlsLmNvbSUzQTEyMzQ1Ng==

curl http://localhost:8001/consumers/jack/oauth2

你的Web应用终端将验证由客户端发送的username和password,

如果验证成功此客户端将发送由参数{client_id},{response_type},
{scope},{provision_key},{authenticated_userid},{state}
构成的POST请求获得一个code值，必须带上header头参数Authorization

{state}客户端的当前状态,可以指定任意值,认证服务器会原封不动地返回这个值
{scope}表示申请的权限范围
{authenticated_userid}已授予权限的终端登录用户userid

[root@contoso ~]# curl -i -X POST \
--url https://localhost:8443/v1/books/oauth2/authorize \
--header "Authorization: Basic amFja0Bob3RtYWlsLmNvbSUzQTEyMzQ1Ng==" \
--header 'Host: contoso.com' \
--data "client_id=LzFEyMMaQyRIHsSsqfonZfofQIHigOF4" \
--data "response_type=code" \
--data "scope=email%20address" \
--data "provision_key=5o5KnTRlpySbf7ViwYSkWPAZZ4vufSwe" \
--data "authenticated_userid=1206" \
--data "state=xyz"  --insecure 
HTTP/1.1 200 OK
Date: Sun, 06 May 2018 16:40:25 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: kong/0.13.1
cache-control: no-store
pragma: no-cache

{"redirect_uri":"http:\/\/getkong.org\/?code=QEdYs44He66RewGGE4KVDxp2nm0mgweS&state=xyz"}
客户继续发送第2个由参数{grant_type},{client_id},{client_secret},{code}
构成的POST请求去申请一个访问令牌和刷新令牌
{code}值获得令牌后立即失效，即{code}值只能用一次

[root@contoso ~]# curl -i -X POST \
--url https://localhost:8443/v1/books/oauth2/token \
--header "Host: contoso.com" \
--data "grant_type=authorization_code" \
--data "client_id=LzFEyMMaQyRIHsSsqfonZfofQIHigOF4" \
--data "client_secret=YhCHW7xISxmTPd41qJFkjDkcsurVADUV" \
--data "code=QEdYs44He66RewGGE4KVDxp2nm0mgweS" --insecure 
HTTP/1.1 200 OK
Date: Sun, 06 May 2018 16:41:32 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: kong/0.13.1
cache-control: no-store
pragma: no-cache

{
    "refresh_token": "Wj51vhdah1Ow9VGl6VTIZZKYqvlln8iv", 
    "token_type": "bearer", 
    "access_token": "90zG0QVO9m921iS51dLAFGMJnNky7IgK", 
    "expires_in": 7200
}
现在我们已经用一个随机的code交换获得了一个访问令牌和一个刷新令牌
这样就有可以访问书籍这个接口了
[root@contoso ~]# curl -i -X GET \
--url https://localhost:8443/v1/books \
--header "Authorization: Bearer 90zG0QVO9m921iS51dLAFGMJnNky7IgK" \
--header 'Host: contoso.com' --insecure 
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 244
Connection: keep-alive
Date: Sun, 06 May 2018 16:43:22 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 25
X-Kong-Proxy-Latency: 44
Via: kong/0.13.1

[
    {
        "id": 1, 
        "title": "Fashion That Changed the World", 
        "author": "Jennifer Croll"
    }, 
    {
        "id": 2, 
        "title": "Brigitte Bardot - My Life in Fashion", 
        "author": "Henry-Jean Servat and Brigitte Bardot"
    }, 
    {
        "id": 3, 
        "title": "The Fashion Image", 
        "author": "Thomas Werner"
    }
]
[root@contoso ~]# curl -i -X GET \
--url http://localhost:8000/v1/books/2 \
--header "Authorization: Bearer 90zG0QVO9m921iS51dLAFGMJnNky7IgK" \
--header 'Host: contoso.com' 
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 106
Connection: keep-alive
Date: Sun, 06 May 2018 16:44:18 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 27
X-Kong-Proxy-Latency: 0
Via: kong/0.13.1

[
    {
        "id": 2, 
        "title": "Brigitte Bardot - My Life in Fashion", 
        "author": "Henry-Jean Servat and Brigitte Bardot"
    }
]

使用一个刷新令牌去获得一个新的访问令牌和一个更新的刷新令牌，前面的刷新令牌与访问令牌就立即作废了

[root@contoso ~]# curl -i -X POST https://localhost:8443/v1/books/oauth2/token \

--header 'Host: contoso.com' \
--data "grant_type=refresh_token" \
--data "client_id=LzFEyMMaQyRIHsSsqfonZfofQIHigOF4" \
--data "client_secret=YhCHW7xISxmTPd41qJFkjDkcsurVADUV" \
--data "refresh_token=Wj51vhdah1Ow9VGl6VTIZZKYqvlln8iv" --insecure 
HTTP/1.1 200 OK
Date: Sun, 06 May 2018 16:45:25 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: kong/0.13.1
cache-control: no-store
pragma: no-cache

{
    "refresh_token": "0mKdeGqC4LZRzNNwlhNj5OyaAZXRajZp", 
    "token_type": "bearer", 
    "access_token": "XNURzUlIi4gtwkjZPeWkQrv0QMZnUFET", 
    "expires_in": 7200
}

用更新的访问令牌去删除一条书籍数据

[root@contoso ~]# curl -i -X DELETE \

--url https://localhost:8443/v1/books/2 \
--header "Authorization: Bearer XNURzUlIi4gtwkjZPeWkQrv0QMZnUFET" \
--header 'Host: contoso.com'  --insecure 
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 34
Connection: keep-alive
Date: Sun, 06 May 2018 16:48:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 32
X-Kong-Proxy-Latency: 3
Via: kong/0.13.1

{"message":"deleted successfully"}
用更新的访问令牌去新增一条书籍数据
[root@contoso ~]# curl -i -X POST \
--url https://localhost:8443/v1/books \
--header "Authorization: Bearer XNURzUlIi4gtwkjZPeWkQrv0QMZnUFET" \
--header 'Host: contoso.com' \
--data 'title=TiDB in Action' \
--data 'author=Tomson'  --insecure 
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 35
Connection: keep-alive
Date: Sun, 06 May 2018 16:48:47 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 29
X-Kong-Proxy-Latency: 0
Via: kong/0.13.1

{"message":"inserted successfully"}

猜你喜欢

转载自blog.csdn.net/zhengzizhi/article/details/80221977
今日推荐
基于大语言模型的开源知识库问答系统 MaxKB GitHub Star 数量突破 5,000 个！
美国拟限制 AI 大模型出口中国和俄罗斯
苹果将与 OpenAI 达成协议，将 ChatGPT 应用于 iPhone
openKylin 社区生态委员会第六次会议圆满召开
阿里云正式发布通义千问 2.5
Python 3.13 发布首个 Beta：实验性自由线程模式和 JIT、改进交互式解释器
Stack Overflow 拿我的代码去训练 AI 大模型，还封了我的账号
Pop!_OS 的 COSMIC 桌面完成 App Store 上架工作
《2024 年一季度互联网投融资运行情况》研究报告
报告：Django 仍然是 74% 开发者的首选
15 年前上了“FFmpeg 耻辱柱”，今天他还得谢谢咱——腾讯QQPlayer一雪前耻？
TIOBE 5 月榜单：Fortran “复活”进入 Top 10
周排行
记一下去大梅沙的准备（2018-05-26）
Spring 注解 事务
基于HTTP协议的客户端缓存
阿里云rds 备份和还原
[PHP] 几个拖慢 PHP 程序/API 运行速度的点
python 代码风格------------PEP8规则
js控制json生成菜单——自制菜单（一）
将字符串: 'k:1|k1:2|k2:3|k3:4 ' ,处理成 python 字典: {'k':1, 'k1':2, ...}
微信小程序转支付宝小程序
Qt551.窗口滚动条
每日归档
更多
2024-05-13(18)
2024-05-12(0)
2024-05-11(38)
2024-05-10(38)
2024-05-09(35)
2024-05-08(42)
2024-05-07(14)
2024-05-06(40)
2024-05-05(0)
2024-05-04(7)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022