Kong Oauth2 - client_credentials 授权

为Kong 添加 OAuth2 授权，应用通过消费者获取token，然后携带 token 进行API的访问。
第一步：为服务添加OAuth2 插件

 curl -X POST http://localhost:8001/services/testservice.com/plugins \
    --data "name=oauth2"  \
    --data "config.scopes=email" \
    --data "config.scopes=phone" \
    --data "config.scopes=address" \
    --data "config.mandatory_scope=true" \
    --data "config.provision_key=<autogenerated>" \
    --data "config.token_expiration=7200" \
    --data "config.enable_authorization_code=false" \
    --data "config.enable_client_credentials=false" \
    --data "config.enable_implicit_grant=false" \
    --data "config.enable_password_grant=true" \
    --data "config.global_credentials=false"

　　

curl -X POST http://127.0.0.1:8001/services/example-service/plugins --data "name=oauth2" --data "config.enable_client_credentials=true"

{"next":null,"data":[{"config":{"enable_implicit_grant":false,"scopes":null,"provision_key":"GnHXGrjWkKPsta3Ku7DwfSCR59AuLtmH","enable_client_credentials":true,"anonymous":null,"enable_authorization_code":false,"token_expiration":7200,"refresh_token_ttl":1209600,"global_credentials":false,"reuse_refresh_token":false,"auth_header_name":"authorization","mandatory_scope":false,"pkce":"lax","enable_password_grant":false,"hide_credentials":false,"accept_http_if_already_terminated":false},"created_at":1620532376,"id":"60972ba3-b893-4e27-8ec2-9eb6f3d13bf4","service":{"id":"c29f8693-fc5f-4d66-9eb6-ad02ea103ab4"},"consumer":null,"name":"oauth2","protocols":["grpc","grpcs","http","https"],"enabled":true,"tags":null,"route":null}]}

查看：
curl http://localhost:8001/services/example-service/plugins
{"next":null,"data":[{"config":{"enable_implicit_grant":false,"scopes":null,"provision_key":"GnHXGrjWkKPsta3Ku7DwfSCR59AuLtmH","enable_client_credentials":true,"anonymous":null,"enable_authorization_code":false,"token_expiration":7200,"refresh_token_ttl":1209600,"global_credentials":false,"reuse_refresh_token":false,"auth_header_name":"authorization","mandatory_scope":false,"pkce":"lax","enable_password_grant":false,"hide_credentials":false,"accept_http_if_already_terminated":false},"created_at":1620532376,"id":"60972ba3-b893-4e27-8ec2-9eb6f3d13bf4","service":{"id":"c29f8693-fc5f-4d66-9eb6-ad02ea103ab4"},"consumer":null,"name":"oauth2","protocols":["grpc","grpcs","http","https"],"enabled":true,"tags":null,"route":null}]}

第二步：创建消费者
curl -X POST http://localhost:8001/consumers/ --data "username=user123"

{"tags":null,"created_at":1620533284,"id":"3b6dcac2-370f-43ee-ae7f-d77412201b72","custom_id":null,"username":"user123"}[root@ecs-325a-0004 ~]#

第三步：为消费者创建OAuth2认证
curl http://localhost:8001/consumers/3b6dcac2-370f-43ee-ae7f-d77412201b72/oauth2 --data "name=test"

{"client_id":"gtLhLsanfoKAy4X4UUswh0E0p4pbaZ5G","redirect_uris":null,"created_at":1620534712,"id":"a1a24289-b85e-436d-8380-36bc47d41b14","client_secret":"JtKyU39k9LQ02bIOdjEgYnMpFrbfzpM6","consumer":{"id":"3b6dcac2-370f-43ee-ae7f-d77412201b72"},"name":"testA1","tags":null,"hash_secret":false,"client_type":"confidential"}

第四步：获取授权token 注意是：https 请求 这是OAuth2 必须的
curl -k -X POST https://example.com:8443/oauth2/token --data "grant_type=client_credentials" --data "client_id=gtLhLsanfoKAy4X4UUswh0E0p4pbaZ5G" --data "client_secret=JtKyU39k9LQ02bIOdjEgYnMpFrbfzpM6" --data "response_type=token"

{"expires_in":7200,"access_token":"gb3dAopOXy1Eje7Wx2GysYXv6Bp0Sb9H","token_type":"bearer"}

第五步：携带token访问 服务
curl -v  http://example.com:8000/ --header "Authorization:bearer gb3dAopOXy1Eje7Wx2GysYXv6Bp0Sb9H"

curl  -k -v  https://example.com:8443/ --header "Authorization:bearer gb3dAopOXy1Eje7Wx2GysYXv6Bp0Sb9H"

如果不携带：

{"error_description":"The access token is missing","error":"invalid_request"}

 

参考资料：

https://docs.konghq.com/hub/kong-inc/oauth2/