Support multiple authentication methods

The default behavior for Kong Gateway authentication plugins is to require credentials for all requests even if a request has been authenticated through another plugin. Configure an anonymous Consumer on your authentication plugins to set authentication options.

Create two Consumers that use different authentication methods:

• consumer-1 uses basic-auth
• consumer-2 uses key-auth

1. Create a secret to add a basic-auth credential for consumer-1:

    echo '
    apiVersion: v1
    kind: Secret
    metadata:
      name: consumer-1-basic-auth
      namespace: kong
      labels:
        konghq.com/credential: basic-auth
    stringData:
        username: consumer-1
        password: consumer-1-password
    ' | kubectl apply -f -
   

   Copied to clipboard!

2. Create a secret to add a key-auth credential for consumer-2:

    echo '
    apiVersion: v1
    kind: Secret
    metadata:
      name: consumer-2-key-auth
      namespace: kong
      labels:
        konghq.com/credential: key-auth
    stringData:
      key: consumer-2-password
    ' | kubectl apply -f -
   

   Copied to clipboard!

3. Create a Consumer named consumer-1:

   echo "
   apiVersion: configuration.konghq.com/v1
   kind: KongConsumer
   metadata:
     name: consumer-1
     namespace: kong
     annotations:
       kubernetes.io/ingress.class: kong
   username: consumer-1
   credentials:
   - consumer-1-basic-auth
   " | kubectl apply -f -
   

   Copied to clipboard!

4. Create a Consumer named consumer-2:

   echo "
   apiVersion: configuration.konghq.com/v1
   kind: KongConsumer
   metadata:
     name: consumer-2
     namespace: kong
     annotations:
       kubernetes.io/ingress.class: kong
   username: consumer-2
   credentials:
   - consumer-2-key-auth
   " | kubectl apply -f -
   

   Copied to clipboard!

Once the Consumers and credentials are created, you can add authentication plugins to your Service.

First, create a key-auth plugin. Notice the anonymous configuration option, which means that if no credentials match, the consumer named anonymous is assigned to the request:

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: key-auth
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  anonymous: anonymous
plugin: key-auth
" | kubectl apply -f -

As Consumer 2 is using basic-auth, we also need to create a basic-auth plugin:

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: basic-auth
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  anonymous: anonymous
plugin: basic-auth
" | kubectl apply -f -

Next, apply the KongPlugin resource by annotating the service resource:

kubectl annotate -n kong service echo konghq.com/plugins=key-auth,basic-auth --overwrite

Your endpoints are now secure, but neither Consumer can access the endpoint when providing valid credentials. This is because each plugin will verify the Consumer using it’s own authentication method.

To allow multiple authentication methods, create an anonymous Consumer which is the default user if no valid credentials are provided:

echo "
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: anonymous
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
username: anonymous
" | kubectl apply -f -

All requests to the API will now succeed as the anonymous Consumer is being used as a default.

To secure the API once again, add a request termination plugin to the anonymous Consumer that returns HTTP 401:

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: request-termination
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  message: Authentication required
  status_code: 401
plugin: request-termination
" | kubectl apply -f -

Next, apply the KongPlugin resource by annotating the KongConsumer resource:

kubectl annotate -n kong  anonymous konghq.com/plugins=request-termination

To route HTTP traffic, you need to create an HTTPRoute or an Ingress resource pointing at your Kubernetes Service.

echo "
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: echo
  namespace: kong
  annotations:
    konghq.com/strip-path: 'true'
spec:
  parentRefs:
  - name: kong
    namespace: kong
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /echo
    backendRefs:
    - name: echo
      kind: Service
      port: 1027
" | kubectl apply -f -

echo "
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echo
  namespace: kong
  annotations:
    konghq.com/strip-path: 'true'
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - path: /echo
        pathType: ImplementationSpecific
        backend:
          service:
            name: echo
            port:
              number: 1027
" | kubectl apply -f -

Once the resource has been reconciled, you’ll be able to call the /echo endpoint and Kong Gateway will route the request to the echo service.

Let’s check that authentication works.

Try to access the Gateway Service via the /anything Route using a nonsense API key:

curl "$PROXY_IP/echo" \
     -H "apikey:nonsense"

curl "$PROXY_IP/echo" \
     -H "apikey:nonsense"

The request should now fail with a 401 response and your configured error message, as this Consumer is considered anonymous.

You should get the same result if you try to access the Route without any API key:

curl "$PROXY_IP/echo"

curl "$PROXY_IP/echo"

Finally, try accessing the Route with the configured basic auth credentials:

curl "$PROXY_IP/echo" \
     -u consumer-1:consumer-1-password

curl "$PROXY_IP/echo" \
     -u consumer-1:consumer-1-password

This time, authentication should succeed with a 200.