Authentication and Authorization in Kong Manager
Kong Manager enables users with admin accounts to access Kong entities such as services, plugins, and consumers.
Kong Gateway comes packaged with authentication plugins that can be used
to secure Kong Manager.
To enable to an authentication plugin for only Kong Manager, you need to set the following properties in
admin_gui_authto the desired authentication type (for example,
admin_gui_session_confwith a session secret
- Optionally configure
admin_gui_auth_confwith custom configuration for your authentication type
The configuration details depend on your authentication type.
Kong Manager currently supports the following authentication plugins:
In addition to the authentication plugins above, the Sessions plugin is required when RBAC is enabled. It sends HTTP cookies to authenticate client requests and maintain session information.
Note: Kong Manager does not directly offer 2FA, MFA, OTP, CAPTCHA, or reCAPTCHA. However, if you configure Kong Manager to use OIDC authentication, then you can provide secondary authentication via your OIDC provider.
The Sessions plugin (configured with
admin_gui_session_conf) requires a secret and is configured securely by default.
- Under all circumstances, the
secretmust be manually set to a string.
- If using HTTP instead of HTTPS,
cookie_securemust be manually set to
- If using different domains for the Admin API and Kong Manager,
cookie_same_sitemust be set to
Learn more about these properties in Session Security in Kong Manager, and see example configurations.
Access control with roles and workspaces
Many organizations have strict security requirements. For example, organizations need the ability to segregate the duties of an administrator to ensure that a mistake or malicious act by one administrator doesn’t cause an outage. Kong Gateway provides a number of security capabilities to help customers secure the administration environment.
Workspaces enable an organization to segment objects and admins into namespaces. The segmentation allows teams of admins sharing the same Kong Gateway cluster to adopt roles for interacting with specific objects. For example, one team (Team A) may be responsible for managing a particular service, whereas another team (Team B) may be responsible for managing another service. Teams should only have the roles they need to perform the administrative tasks within their specific workspaces.
Kong Gateway does all of this through Role-Based Access Control (RBAC). All administrators can be given specific roles, whether you are using Kong Manager or the Admin API, which control and limit the scope of administrative privileges within specific workspaces.
User types in Kong Manager:
Admins: An admin belongs to a workspace and should have at least one role with a set of permissions. If an admin is in a workspace without a role, they can’t see or interact with anything. Admins can manage entities inside workspaces, including users and their roles.
- Super admins: Specialized admins with the ability to:
- Manage all workspaces
- Further customize permissions
- Create entirely new roles
- Invite or deactivate admins
- Assign or revoke admin roles
- RBAC users: RBAC users without administrator permissions. They have access to manage Kong Gateway, but can’t adjust teams, groups, or user permissions.
Admins are assigned roles that have clearly defined permissions. In Kong Manager, limiting permissions also restricts the visibility of the application interface and navigation.