Skip to content
Kong Logo | Kong Docs Logo
search
  • We're Hiring!
  • Docs
    • Kong Gateway
    • Kong Konnect
    • Kong Mesh
    • Plugin Hub
    • decK
    • Kubernetes Ingress Controller
    • Insomnia
    • Kuma

    • Docs contribution guidelines
  • Plugin Hub
  • Support
  • Community
  • Kong Academy
Early Access
  • Kong Gateway
  • Kong Konnect
  • Kong Mesh
  • Plugin Hub
  • decK
  • Kubernetes Ingress Controller
  • Insomnia
  • Kuma

  • Docs contribution guidelines
    • Overview of Konnect
    • Architecture
    • Network Resiliency and Availability
    • Port and Network Requirements
    • Compatibility
    • Stages of Software Availability
    • Release Notes
      • Control Plane Upgrades FAQ
      • Supported Installation Options
    • Overview
    • Access a Konnect Account
    • Set up a Runtime
    • Configure a Service
    • Implement and Test the Service
      • Publish and Consume Services
      • Register Applications
    • Import Kong Gateway Entities into Konnect
    • Overview
      • Overview
      • Dashboard
      • Manage Runtime Groups with UI
      • Manage Runtime Groups with decK
      • Installation Options
      • Install with Docker
      • Install on Kubernetes
      • Install on Linux
      • Install on AWS
      • Install on Azure
      • Upgrade a Runtime Instance to a New Version
      • Renew Certificates
      • Runtime Parameter Reference
      • Overview
      • Runtime Configuration
    • Create Consumer Groups
      • Overview
      • Set Up and Use a Vault in Konnect
    • Plugin Ordering Reference
    • Troubleshoot
    • Overview
      • Konnect Services
      • Service Versions
      • Service Implementations
      • Manage Service Documentation
      • Overview
      • Configure a Plugin on a Service
      • Configure a Plugin on a Route
    • Overview
    • Access the Dev Portal
    • Sign Up for a Dev Portal Account
      • Manage Developer Access
      • Manage Application Registration Requests
      • Manage Application Connections
      • Auto Approve Dev and App Registrations
      • Azure OIDC
      • Application Overview
      • Enable and Disable App Registration
        • Okta
        • Curity
        • Auth0
      • Create, Edit, and Delete an Application
      • Register an Application with a Service
      • Generate Credentials for an Application
    • Customize Dev Portal
    • Troubleshoot
    • Introduction to Analytics
    • Summary Dashboard
    • Analyze Services and Routes
    • Generate Reports
    • Troubleshoot
      • Manage a Konnect Account or Plan
      • Change to a Different Plan
      • Manage Payment Methods and Invoices
      • Overview
        • Overview
        • Manage Teams
        • Teams Reference
        • Roles Reference
      • Manage Users
      • Set up SSO with OIDC
      • Set up SSO with Okta
    • Account and Org Deactivation
    • Troubleshoot
    • Overview
      • API Documentation
      • Identity Integration Guide
      • API Documentation
      • Overview
      • Nodes
      • Data Plane Certificiates
        • Services
        • Routes
        • Consumers
        • Plugins
        • Upstreams
        • Certificates
        • CA Certificates
        • SNIs
        • Targets
        • Vaults
      • API Spec
      • Filtering

github-edit-pageEdit this page

report-issueReport an issue

enterprise-switcher-iconSwitch to OSS

On this page
  • Support for any runtime group
  • Prerequisites
  • Enable app registration with key authentication
  • Enable app registration with OpenID Connect
    • OpenID Connect configuration parameters
  • Disable application registration for a service
    • Differences between runtime groups
    • Known limitations
Kong Konnect
  • Home
  • Kong Konnect
  • Dev Portal
  • Applications
  • Enable or Disable Application Registration for a Service

Enable or Disable Application Registration for a Service

To grant developers access to register an application, you must enable application registration for a service version. When you enable application registration, Kong Konnect enables plugins automatically to support the desired mode, either key authentication or OpenID Connect. These plugins run inside the Kong Gateway runtime instances to support application registration for the service and are managed by Kong Konnect.

Support for any runtime group

App registration is fully supported in the default runtime group, using application consumers and the acl plugin. We are rolling out full support in any non-default runtime group, using the konnect-application-auth plugin that was created for Kong Gateway 3.0.

Note: The default runtime group is the one that is first created in each region when you create an organization. Although it can be renamed, it will always be the oldest runtime group in the region. See default runtime group for additional context.

Prerequisites

  • A service that is versioned and published to the Konnect Dev Portal so that it appears in the catalog.

  • The service version can be in any runtime group, as long as the following conditions are met:

    • Service versions not in the default runtime group must be proxied with a version of Kong Gateway >= 3.0

    • Service versions in the default runtime group can be proxied with any version of Kong Gateway

  • The service version must have an implementation.

  • If you are using OpenID Connect for your authorization:

    • Set up your application, claims, and scopes in your OpenID identity provider. Refer to your IdP/OP provider’s documentation for instructions.

    • Edit the Reference ID field in the Dev Portal Update Application dialog to match to your third-party OAuth2 claim.

Note: For instructions on configuring Konnect declaratively, read our declarative guide.

Enable app registration with key authentication

To enable app registration with key authentication, from the Konnect menu, click servicehub icon Service Hub, select a service, and follow these steps:

  1. Click Versions to select a version.

  2. From the Version actions drop-down menu, select Enable app registration.

  3. Select key-auth from the Auth Type list.

  4. Optional: click to enable Auto Approve for application registration requests.

  5. Click Enable.

    This version of the service package now includes a read-only entry for the konnect-application-auth plugin.

Note: If the service version is in the default runtime group, it will instead receive read-only entries for the acl and key-auth plugins to provide support for Kong Gateway versions less than 3.0.

Enable app registration with OpenID Connect

To enable app registration with OpenID Connect, from the Konnect menu, click servicehub icon Service Hub, select a service, and follow these steps:

  1. Click Versions to select a version.

  2. From the Version actions drop-down menu, select Enable app registration.

  3. Select openid-connect from the Auth Type list.

    Refer to the configuration parameters section for information about each field.

  4. Click Enable.

    This versions of this service packages now includes read-only entries for the konnect-application-auth and openid-connect plugins.

Note: If the service version is in the default runtime group, it will instead receive read-only entries for the acl and openid-connect plugins to provide support for Kong Gateway versions less than 3.0.

OpenID Connect configuration parameters

Form Parameter Description Required
Issuer The issuer URL from which the OpenID Connect configuration can be discovered. For example: https://dev-1234567.okta.com/oauth2/default. True
Scopes The scopes to be requested from the OpenID Provider. Enter one or more scopes separated by spaces, for example: open_id myscope1. False
Credential claims Name of the claim that maps to the unique client id in the identity provider. True
Auth method The supported authentication method(s) you want to enable. This field should contain only the authentication methods that you need to use. Individual entries must be separated by commas. Available options: password, client_credentials, authorization_code, bearer, introspection, kong_oauth2, refresh_token, session. True
Hide Credentials Default: disabled
Hide the credential from the upstream service. If enabled, the plugin strips the credential from the request header, query string, or request body, before proxying it.
False
Auto Approve Default: disabled
Automatically approve developer application requests for an application.
False

Note: In the default runtime group, Credential claim is used as a Consumer claim which identifies a consumer. In non-default runtime groups, the Credential claim should be mapped to a claim that contains the unique clientId or applicationId in the identity provider.

For more background information about OpenID Connect plugin parameters, see Important Configuration Parameters.

Disable application registration for a service

Disabling application registration removes all plugins that were initially enabled through application registration for this service. To remove a plugin by disabling application registration, follow these steps:

  1. Click a service to open the Service menu.

  2. From the Service menu, select Version to display all of the registered versions.

  3. Click the version you intend to disable.

  4. From the Version actions drop-down menu, select Disable app registration.

  5. Click Disable from the pop-up modal.

You can re-enable application registration at any time.

Differences between runtime groups

The konnect-application-auth plugin manages access control and API key authentication for app registration and replaces the need for the acl and key-auth plugins. It is used in every non-default runtime group.

In the default runtime group, applications are linked to Kong Gateway consumers and use the acl plugin to control access between an application’s consumers and a service version. In all other runtime groups, applications are not linked to Kong Gateway consumers.

Known limitations

The internal konnect-application-auth plugin only supports Kong Gateway 3.0+. If you need to use a version of Kong Gateway before 3.0, you must create your service version in the default runtime group, which still supports consumer mapping with the acl plugin.

The konnect-application-auth plugin does not connect applications to Kong Gateway consumers. Therefore, any applications created through the app registration process in any non-default runtime group currently don’t support rate limiting plugins. This will be addressed in a future release.

If you don’t use any rate limiting plugins, we recommend upgrading your runtime instances to Kong Gateway version 3.0+ to ensure future compatibility with the konnect-application-auth plugin, which has a built-in replacement for the acl plugin.

Thank you for your feedback.
Was this page useful?
  • Kong
    THE CLOUD CONNECTIVITY COMPANY

    Kong powers reliable digital connections across APIs, hybrid and multi-cloud environments.

    • Company
    • Customers
    • Events
    • Investors
    • Careers Hiring!
    • Partners
    • Press
    • Contact
  • Products
    • Kong Konnect
    • Kong Gateway
    • Kong Mesh
    • Get Started
    • Pricing
  • Resources
    • eBooks
    • Webinars
    • Briefs
    • Blog
    • API Gateway
    • Microservices
  • Open Source
    • Install Kong Gateway
    • Kong Community
    • Kubernetes Ingress
    • Kuma
    • Insomnia
  • Solutions
    • Decentralize
    • Secure & Govern
    • Create a Dev Platform
    • API Gateway
    • Kubernetes
    • Service Mesh
Star
  • Terms•Privacy
© Kong Inc. 2023