Vault Authentication plugin

Kong Enterprise only: This plugin is only available with a Kong Enterprise subscription. Please inquire about Kong Enterprise by contacting us, or start a free trial today.

Add authentication to a Service or Route with an access token and secret token. Credential tokens are stored securely via Vault. Credential lifecyles can be managed through the Kong Admin API, or independently via Vault.

Configuration Reference

You can configure this plugin using the Kong Admin API or through declarative configuration, which involves directly editing the Kong configuration file.

Enabling the plugin on a Service

Kong Admin API

Kubernetes

Declarative (YAML)

For example, configure this plugin on a Service by making the following request:

$ curl -X POST http://<admin-hostname>:8001/services/<service>/plugins \
    --data "name=vault-auth"  \
    --data "config.access_token_name=access_token" \
    --data "config.vault.id=<UUID>" \
    --data "config.secret_token_name=secret_token"

First, create a KongPlugin resource:

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: <vault-auth-example>
config: 
  access_token_name: access_token
  vault:
    id: <UUID>
  secret_token_name: secret_token
plugin: vault-auth

Next, apply the KongPlugin resource to a Service by annotating the Service as follows:

apiVersion: v1
kind: Service
metadata:
  name: <service>
  labels:
    app: <service>
  annotations:
    plugins.konghq.com: <vault-auth-example>
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: <service>
  selector:
    app: <service>

Note: The KongPlugin resource only needs to be defined once and can be applied to any Service, Consumer, or Route in the namespace. If you want the plugin to be available cluster-wide, create the resource as a KongClusterPlugin instead of KongPlugin.

For example, configure this plugin on a Service by adding this section to your declarative configuration file:

plugins:
- name: vault-auth
  service: <service>
  config: 
    access_token_name: access_token
    vault:
      id: <UUID>
    secret_token_name: secret_token

<service> is the id or name of the Service that this plugin configuration will target.

Enabling the plugin on a Route

Kong Admin API

Kubernetes

Declarative (YAML)

For example, configure this plugin on a Route with:

$ curl -X POST http://<admin-hostname>:8001/routes/<route>/plugins \
    --data "name=vault-auth"  \
    --data "config.access_token_name=access_token" \
    --data "config.vault.id=<UUID>" \
    --data "config.secret_token_name=secret_token"

First, create a KongPlugin resource:

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: <vault-auth-example>
config: 
  access_token_name: access_token
  vault:
    id: <UUID>
  secret_token_name: secret_token
plugin: vault-auth

Then, apply it to an ingress (Route or Routes) by annotating the ingress as follows:

apiVersion: networking/v1beta1
kind: Ingress
metadata:
  name: <route>
  annotations:
    plugins.konghq.com: <vault-auth-example>
spec:
  rules:
  - host: examplehostname.com
    http:
      paths:
      - path: /bar
        backend:
          serviceName: echo
          servicePort: 80

For example, configure this plugin on a Route by adding this section to your declarative configuration file:

plugins:
- name: vault-auth
  route: <route>
  config: 
    access_token_name: access_token
    vault:
      id: <UUID>
    secret_token_name: secret_token

<route> is the id or name of the Route that this plugin configuration will target.

Enabling the plugin globally

A plugin which is not associated to any Service, Route, or Consumer is considered global, and will be run on every request. Read the Plugin Reference and the Plugin Precedence sections for more information.

Kong Admin API

Kubernetes

Declarative (YAML)

For example, configure this plugin globally with:

$ curl -X POST http://<admin-hostname>:8001/plugins/ \
    --data "name=vault-auth"  \
    --data "config.access_token_name=access_token" \
    --data "config.vault.id=<UUID>" \
    --data "config.secret_token_name=secret_token"

Create a KongClusterPlugin resource and label it as global:

apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: <global-vault-auth>
  labels:
    global: \"true\"
config: 
  access_token_name: access_token
  vault:
    id: <UUID>
  secret_token_name: secret_token
plugin: vault-auth

For example, configure this plugin using the plugins: entry in the declarative configuration file:

plugins:
- name: vault-auth
  config: 
    access_token_name: access_token
    vault:
      id: <UUID>
    secret_token_name: secret_token

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

Form Parameter	Description
`name`	The name of the plugin to use, in this case `vault-auth`.
`service.id`	The ID of the Service the plugin targets.
`route.id`	The ID of the Route the plugin targets.
`enabled` default value: `true`	Whether this plugin will be applied.
`config.access_token_name` required default value: `access_token`	Describes an array of comma-separated parameter names where the plugin will look for an access token. The client must send the access token in one of those key names, and the plugin will try to read the credential from a header or the querystring parameter with the same name. note: the key names may only contain [a-z], [A-Z], [0-9], [_] and [-].
`config.vault.id` required	A reference to an existing `vault` object within the database. `vault` entities define the connection and authentication parameters used to connect to a Vault HTTP(S) API.
`config.secret_token_name` required default value: `secret_token`	Describes an array of comma-separated parameter names where the plugin will look for a secret token. The client must send the secret in one of those key names, and the plugin will try to read the credential from a header or the querystring parameter with the same name. note: the key names may only contain [a-z], [A-Z], [0-9], [_] and [-].
`config.key_in_body` optional default value: `false`	If enabled, the plugin will read the request body (if said request has one and its MIME type is supported) and try to find the key in it. Supported MIME types are `application/www-form-urlencoded`, `application/json`, and `multipart/form-data`.
`config.hide_credentials` optional default value: `false`	An optional boolean value telling the plugin to show or hide the credential from the upstream service. If `true`, the plugin will strip the credential from the request (i.e. the header or querystring containing the key) before proxying it.
`config.anonymous` optional	An optional string (consumer uuid) value to use as an “anonymous” consumer if authentication fails. If empty (default), the request will fail with an authentication failure `4xx`. Please note that this value must refer to the Consumer `id` attribute which is internal to Kong, and not its `custom_id`.
`config.run_on_preflight` optional default value: `true`	A boolean value that indicates whether the plugin should run (and try to authenticate) on `OPTIONS` preflight requests, if set to `false` then `OPTIONS` requests will always be allowed.

Usage

In order to use the plugin, you first need to create a Consumer to associate one or more credentials to. The Consumer represents a developer using the upstream service. Additionally, a Vault object must be created to represent the connection Kong will use to communicate with a Vault server, where access and secret tokens will be stored.

Create a Consumer

You need to associate a credential to an existing Consumer object. To create a Consumer, you can execute the following request:

$ curl -X POST http://kong:8001/consumers/ \
    --data "username=<USERNAME>" \
    --data "custom_id=<CUSTOM_ID>"
HTTP/1.1 201 Created

{
    "username":"<USERNAME>",
    "custom_id": "<CUSTOM_ID>",
    "created_at": 1472604384000,
    "id": "7f853474-7b70-439d-ad59-2481a0a9a904"
}

parameter	default	description
`username` semi-optional		The username of the Consumer. Either this field or `custom_id` must be specified.
`custom_id` semi-optional		A custom identifier used to map the Consumer to another database. Either this field or `username` must be specified.

A Consumer can have many credentials.

If you are also using the ACL plugin and allowed lists with this service, you must add the new consumer to an allowed group. See ACL: Associating Consumers for details.

Create a Vault

A Vault object represents the connection between Kong and a Vault server. It defines the connection and authentication information used to communicate with the Vault API. This allows different instances of the vault-auth plugin to communicate with different Vault servers, providing a flexible deployment and consumption model.

Vault objects can be created via the following HTTP request:

$ curl -X POST http://kong:8001/vaults \
  --data name=kong-auth \
  --data mount=kong-auth \
  --data protocol=http \
  --data host=127.0.0.1 \
  --data port=8200
  --data token=s.m3w9gdV0uMDYFpMgEWSB2mtM
HTTP/1.1 201 Created

{
    "created_at": 1550538643,
    "host": "127.0.0.1",
    "id": "d3da058d-0acb-49c2-b7fe-72b3e9fd4b0a",
    "mount": "kong-auth",
    "name": "kong-auth",
    "port": 8200,
    "protocol": "http",
    "token": "s.m3w9gdV0uMDYFpMgEWSB2mtM",
    "updated_at": 1550538643
}

This assumes a Vault server is accessible via 127.0.0.1:8200, and that a version 1 KV secrets engine has been enabled at kong-auth. Vault KV secrets engine documentation is available via the Vault documentation.

Create an Access/Secret Token Pair

vault-auth credentials are defined as a pair of tokens: an access token that identifies the owner of the credential, and a secret token that is used to authenticate ownership of the access token.

Token pairs can be managed either via the Kong Admin API, or independantly via direct access with Vault. Token pairs must be associated with an existing Kong Consumer. Creating a token pair with the Kong Admin API can be done via the following request:

$ curl -X POST http://kong:8001/vaults/{vault}/credentials/{consumer}
HTTP/1.1 201 Created

{
    "data": {
        "access_token": "v3cOV1jWglS0PFOrTcdr85bs1GP0e2yM",
        "consumer": {
            "id": "64063284-e3b5-48e7-9bca-802251c32138"
        },
        "created_at": 1550538920,
        "secret_token": "11XYyybbu3Ty0Qt4ImIshPGQ0WsvjLzl",
        "ttl": null
    }
}

When the access_token or secret_token values are not provided, token values will be automatically generated via a cryptographically-secure random number generator (CSPRNG).

Integrating Vault objects with Vault-Auth plugins

Vault objects are treated as foreign references in plugin configs, creating a seamless lifecycle relationship between Vault instances and plugins with which they’re associated. vault-auth plugins require an association with a Vault object, which can be defined with the following HTTP request during plugin creation:

$ curl -X POST http://kong:8001/plugins \
  --data name=vault-auth \
  --data config.vault.id=<uuid>
HTTP/1.1 201 Created

{
  "created_at": 1550539002,
  "config": {
    "tokens_in_body": false,
    "secret_token_name": "secret_token",
    "run_on_preflight": true,
    "vault": {
      "id": "d3da058d-0acb-49c2-b7fe-72b3e9fd4b0a"
    },
    "anonymous": null,
    "hide_credentials": false,
    "access_token_name": "access_token"
  },
  "id": "b4d0cbb7-bff2-4599-ba19-67c705c15b9a",
  "service": null,
  "enabled": true,
  "run_on": "first",
  "consumer": null,
  "route": null,
  "name": "vault-auth"
}

Where <uuid> is the id of an existing Vault object.

Using Vault credentials

Simply make a request with the access_token and secret_token as querystring parameters:

$ curl http://kong:8000/{proxy path}?access_token=<access token>&secret_token=<secret token>

Or in a header:

$ curl http://kong:8000/{proxy path} \
    -H 'access_token: <access_token>' \
    -H 'secret_token: <secret_token>'

Deleting an Access/Secret Token Pair

Existing Vault credentials can be removed from the Vault server via the following API:

$ curl -X DELETE http://kong:8001/vaults/{vault}/credentials/token/{access token}

HTTP/1.1 204 No Content

Token TTL

When reading a token from Vault, Kong will search the responding KV value for the presence of a ttl field. When this is present, Kong will respect the advisory value of the ttlfield and store the value of the credential in cache for only as long as the ttl field defines. This allows tokens created directly in Vault, outside of the Kong Admin API, to be periodically refreshed by Kong.

Extra-Kong Token Pairs

Kong can read access/token secret pairs that have been created directly in Vault, outside of the Kong Admin API. Currently vault-auth supports creating and reading credentials based on the Vault v1 KV engine. Create Vault KV secret values must contain the following fields:

{
  access_token: <string>
  secret_token: <string>
  created_at: <integer>
  updated_at: <integer>
  ttl: <integer> (optional)
  consumer: {
    id: <uuid>
  }
}

Additional fields within the secret are ignored. The key must be the access_token value; this is the identifier by which Kong queries the Vault API to fetch the credential data. See the Vault documentation for further information on the KV v1 secrets engine.

vault-auth token pairs can be created with the Vault HTTP API or the vault write command:

$ vault write kong-auth/foo - <<EOF
{
  "access_token": "foo",
  "secret_token": "supersecretvalue",
  "consumer": {
    "id": "ce67c25e-2168-4a09-81e5-e06187a2384f"
  },
  "ttl": 86400
}
EOF

About this Plugin
Made by
Categories	Authentication
Bundled with...
Kong Enterprise 2.1.x 1.5.x 1.3-x 0.36-x 0.35-x