Use Bearer authentication (jwt) to get access to admin API

[aousair]

Hello,

I would like to use a jwt (Json Web token) as Bearer authentication to get access to admin API instead of X-API-KEY. I already tried it on my local branch and it works well. Now I would like to share that idea with you.
In attachment you have a zip file contains 3 files :

• the modified admin/init.lua

• the config file conf/config.yaml

• the new file admin/jwt-check.lua

Please let me know if the idea can be interesting because I would like to use it for my project.

Thank you.

Best regards

aousair
admin_auth.zip

[aousair]

admin/init.lua

local function check_auth(ctx)
    local token = core.request.header(ctx, "Authorization")
    if token then
        return check_jwt(ctx)
    end
    return check_token(ctx)
end

local function run()
    local api_ctx = {}
    core.ctx.set_vars_meta(api_ctx)
    ngx.ctx.api_ctx = api_ctx

    local ok, err = check_auth(api_ctx)
    if not ok then
        core.log.error("failed to check auth: ", err)
        core.response.exit(401, { error_msg = "failed to check auth" })
    end

conf/config.yaml

deployment:
  role: traditional
  role_traditional:
    config_provider: etcd
  admin:
    admin_key:
      - name: admin
        key: edd1c9f034335f136f87ad84b625c8f1  # using fixed API token has security risk, please update it when you deploy to production environment
        role: admin
    jwt_check:
      jwt_cert: /path/to/ca-cert/public_key_file.pem

admin/jwt-check.lua

--
-- File contains the necessary functions to decode and validate a jwt
--

local require = require
local core = require("apisix.core")
local sub_str  = string.sub
local jwt      = require("resty.jwt")
local smatch   = string.match
local open     = io.open
local ngx_ssl = require("ngx.ssl")

local function rtrim(str)
    return smatch(str, "^(.-)%s*$")
end

local function read_file(path)
    core.log.debug("jwt-check.read_file called")

    local file = open(path, "rb")
    if not file then
        return nil, "File cannot be opened"
    end
    local content = file:read("*a")
    file:close()
    return rtrim(content)
end

local function validate_jwt(jwt_token)
    core.log.debug("jwt-check.validate_jwt called")

    local local_conf = core.config.local_conf()
    local public_key_path = core.table.try_read_attr(local_conf, "deployment", "admin", "jwt_check", "jwt_cert")
    local public_key_pem = read_file(public_key_path)

    local jwt_obj = jwt:verify(public_key_pem, jwt_token)
    --core.log.error("jwt_obj: ", core.json.delay_encode(jwt_obj))
    if jwt_obj == nil or not jwt_obj.verified then
        return nil, "failed to validate JWT token"
    end
    return jwt_obj
end

local function fetch_jwt_token(ctx)
    core.log.debug("jwt-check.fetch_jwt_token called")

    local token = core.request.header(ctx, "Authorization")
    if not token then
        return nil, "authorization header not available"
    end

    local prefix = sub_str(token, 1, 7)
    if prefix == 'Bearer ' or prefix == 'bearer ' then
        return sub_str(token, 8)
    end

    return nil
end

local function set_user_infos(jwt_obj)
    core.log.debug("jwt-check.set_user_infos called")
    core.ctx.auth = {
        user = { login = jwt_obj.payload.sub }
    }
end

local function check_jwt(ctx)
    core.log.debug("jwt-check.check_jwt called")

    local jwt_token, err = fetch_jwt_token(ctx)
    if not jwt_token then
        return false, "failed to fetch JWT token "..err
    end

    local jwt_obj = validate_jwt(jwt_token)
    if jwt_obj == nil or not jwt_obj.valid then
        core.log.error("JWT token invalid")
        return false
    end

    set_user_infos(jwt_obj)

    return true
end

local _M = {}

function _M.check_jwt(ctx)
    return check_jwt(ctx)
end

return _M