basic_auth: add support for per-route filter #33335

jewertow · 2024-04-04T09:52:58Z

Commit Message: "basic_auth: add support for per-route filter"
Additional Description:
Risk Level: medium
Testing: unit, integration, manual
Docs Changes: added
Release Notes: added
Platform Specific Features: -
Fixes #32550

Here you can find configuration and steps for manual tests.

repokitteh-read-only · 2024-04-04T09:53:06Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @mattklein123
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #33335 was opened by jewertow.

see: more, trace.

wbpcode · 2024-04-04T10:14:22Z

api/envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto

+    // Disable the basic auth filter for this particular vhost or route.
+    // If disabled is specified in multiple per-filter-configs, the most specific one will be used.
+    bool disabled = 1 [(validate.rules).bool.const = true];


Prefer the general way to disable a filter in specific route or vh, see https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/http/http_filters#route-based-filter-chain

My implementation follows the approach with disabled field, because BasicAuth is enabled on all routes by default. What do you suggest?

You can check the doc I posted above. It have provided example about how to disable a filter on any route or vh. It a general feature that Envoy provided and should be used preferably.

I meant that I read the doc, but I don't understand what you mean, because another option is to make filter disabled on routes by default and enable it selectively, but this approach would break existing configs. "Prefer the general way" - I did not find term "general" in that doc, so I don't know what you mean.

This is exactly what I implemented.

This is a general feature of Envoy to disable a filter in specific route. And all filters could use it directly. The config envoy.config.route.v3.FilterConfig is a common wrapper that will be handled with special logic.

You needn't to add a new disabled field in your filter's config.

Okay... Now I understand it and will remove this field.

Check this doc, you can get more detail about the wrapper and the only one drawback of this mechanism https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-filterconfig

wbpcode · 2024-04-04T10:53:12Z

cc @zhaohuabing as code owner

jewertow · 2024-04-04T11:12:52Z

api/envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto

+    bool disabled = 1 [(validate.rules).bool.const = true];
+
+    // Username-password pairs for this route.
+    config.core.v3.DataSource users = 2 [(validate.rules).message.required = true, (udpa.annotations.sensitive) = true];


I think I will have to add a wrapper struct for users and forward_username_header to make these fields mutually exclusive with disabled, right?

Do you think that forward_username_header should be supported by per-route filter? Or should it be general setting for the filter?

zhaohuabing · 2024-04-08T03:14:23Z

docs/root/configuration/http/http_filters/basic_auth_filter.rst

+            "@type": type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuthPerRoute
+            users:
+              inline_string: |-
+                admin:{SHA}0DPiKuNIrrVmD8IUCuw1hQxNqZc=


Nit: could we use the same masked password as in the previous example?

Suggested change

admin:{SHA}0DPiKuNIrrVmD8IUCuw1hQxNqZc=

admin:{SHA}hashed_admin_password

zhaohuabing · 2024-04-08T04:41:34Z

This looks good. Just a tiny nit on the doc.

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

jewertow · 2024-04-08T21:39:37Z

I'm sorry for the force-push, but a conflict in changelogs/current.yaml occurred.

wbpcode

Thanks for you contribution and some comments are added.

/wait

wbpcode · 2024-04-09T01:53:38Z

changelogs/current.yaml

@@ -463,6 +463,9 @@ new_features:
    Added maximum gRPC message size that is allowed to be received in Envoy gRPC. If a message over this limit is received,
    the gRPC stream is terminated with the RESOURCE_EXHAUSTED error. This limit is applied to individual messages in the
    streaming response and not the total size of streaming response. Defaults to 0, which means unlimited.
+- area: filters
+  change: |
+    Added :ref:`the Basic Auth per-route filter <envoy_v3_api_msg_extensions.filters.http.basic_auth.v3.BasicAuthPerRoute>`.


Added :ref:`per-route configuration support to the Basic Auth filter <envoy_v3_api_msg_extensions.filters.http.basic_auth.v3.BasicAuthPerRoute>`.

wbpcode · 2024-04-09T02:12:40Z

test/extensions/filters/http/basic_auth/basic_auth_integration_test.cc

+    initialize();
+  }
+
+  void initializePerRouteFilter(std::string yaml_config) {


nit: const std::string& yaml_config

wbpcode · 2024-04-09T02:34:25Z

source/extensions/filters/http/basic_auth/basic_auth_filter.cc

+  auto users = config_->users();
+  if (route_specific_settings != nullptr) {
+    users = route_specific_settings->users();
+  }


I think a reference wrapper or something should be used here to avoid to copy the whole user map. It's too expensive for a single request.

Thanks! I missed that due to auto and I didn't notice that it's not UserMap& as the method return type. I changed users to be a pointer.

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

wbpcode · 2024-04-09T11:35:49Z

source/extensions/filters/http/basic_auth/basic_auth_filter.cc

@@ -85,6 +84,16 @@ Http::FilterHeadersStatus BasicAuthFilter::decodeHeaders(Http::RequestHeaderMap&
  return Http::FilterHeadersStatus::Continue;
 }

+bool BasicAuthFilter::validateUser(const UserMap* users, absl::string_view username,


Thanks for you quick response. Please just keep using const UserMap& users in this method because it should never be null. :)

/wait

wbpcode · 2024-04-09T11:38:57Z

source/extensions/filters/http/basic_auth/basic_auth_filter.cc

+  const UserMap* users = &config_->users();
+  if (route_specific_settings != nullptr) {
+    users = &route_specific_settings->users();


nit: Prefer reference_wrapper because it never be null. But pointer is also OK if you prefer it.

I do not prefer pointers. I used the pointer to reassign users inside the if statement, and I couldn't do that with reference_wrapper.

I think reference_wraper also could do the reassign? But anyway, it's fine.

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

wbpcode · 2024-04-09T11:55:55Z

LGTM.Thanks.

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

jewertow · 2024-04-09T15:22:09Z

@wbpcode I had to fix release notes format, could you approve again?

* basic_auth: add per-route filter Signed-off-by: Jacek Ewertowski <jewertow@redhat.com> --------- Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

jewertow requested a review from wbpcode as a code owner April 4, 2024 09:52

repokitteh-read-only bot added the api label Apr 4, 2024

repokitteh-read-only bot assigned mattklein123 Apr 4, 2024

wbpcode reviewed Apr 4, 2024

View reviewed changes

jewertow force-pushed the basic-auth-per-route branch from eaddeb3 to 7449b1b Compare April 4, 2024 11:09

jewertow commented Apr 4, 2024

View reviewed changes

mattklein123 assigned wbpcode and unassigned mattklein123 Apr 4, 2024

zhaohuabing reviewed Apr 8, 2024

View reviewed changes

jewertow requested a review from wbpcode April 8, 2024 08:44

jewertow added 16 commits April 8, 2024 23:36

basic_auth: add per-route filter

d6212c5

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Handle disabled per-route basic auth filter

d230196

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Add an integration test for disabled basic auth per route

fa3353e

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Implement validation users specified in per-route filter

1572e8f

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Improve configuration example for basic auth

e62901d

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Add example configuration for per-route basic auth filter

5a48326

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Make UserMap a const field

5fd230b

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Remove unnecessary headers

eec6c6a

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Add a release note

97325f6

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Fix bugs from rebase

fa6244f

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Remove field disabled from BasicAuthPerRoute filter

6665784

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Update docs

cd5c321

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Fix code format

de94b7b

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Fix code format

b9b27c9

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Add BasicAuthPerRoute to extenstions metadata

48389d8

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Change password format in the docs

b302d4b

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

jewertow force-pushed the basic-auth-per-route branch from faca8b5 to b302d4b Compare April 8, 2024 21:38

wbpcode requested changes Apr 9, 2024

View reviewed changes

repokitteh-read-only bot added the waiting label Apr 9, 2024

Make users a pointer to avoid copying UserMap

c707d28

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

repokitteh-read-only bot removed the waiting label Apr 9, 2024

jewertow added 2 commits April 9, 2024 13:23

Change initializePerRouteFilter to take string reference

c353e5a

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

Change release note

2b0b306

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

wbpcode reviewed Apr 9, 2024

View reviewed changes

repokitteh-read-only bot added the waiting label Apr 9, 2024

wbpcode reviewed Apr 9, 2024

View reviewed changes

Change validateUsers to take UserMap reference, not a pointer

46842e5

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

repokitteh-read-only bot removed the waiting label Apr 9, 2024

wbpcode previously approved these changes Apr 9, 2024

View reviewed changes

repokitteh-read-only bot removed the api label Apr 9, 2024

wbpcode enabled auto-merge (squash) April 9, 2024 11:56

Fix release notes format

4cda087

Signed-off-by: Jacek Ewertowski <jewertow@redhat.com>

auto-merge was automatically disabled April 9, 2024 15:21
Head branch was pushed to by a user without write access

jewertow dismissed wbpcode’s stale review via 4cda087 April 9, 2024 15:21

repokitteh-read-only bot added the api label Apr 9, 2024

jewertow requested a review from wbpcode April 9, 2024 15:21

wbpcode approved these changes Apr 10, 2024

View reviewed changes

repokitteh-read-only bot removed the api label Apr 10, 2024

wbpcode merged commit 8d2df82 into envoyproxy:main Apr 10, 2024
54 of 56 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

basic_auth: add support for per-route filter #33335

basic_auth: add support for per-route filter #33335

jewertow commented Apr 4, 2024

repokitteh-read-only bot commented Apr 4, 2024

wbpcode Apr 4, 2024

jewertow Apr 4, 2024

wbpcode Apr 4, 2024

jewertow Apr 4, 2024

wbpcode Apr 4, 2024

jewertow Apr 4, 2024

wbpcode Apr 4, 2024 •

edited

Loading

jewertow Apr 4, 2024

wbpcode Apr 4, 2024

wbpcode commented Apr 4, 2024

jewertow Apr 4, 2024

jewertow Apr 4, 2024

zhaohuabing Apr 8, 2024 •

edited

Loading

jewertow Apr 8, 2024

zhaohuabing commented Apr 8, 2024

jewertow commented Apr 8, 2024

wbpcode left a comment

wbpcode Apr 9, 2024

jewertow Apr 9, 2024

wbpcode Apr 9, 2024

jewertow Apr 9, 2024

wbpcode Apr 9, 2024

jewertow Apr 9, 2024

wbpcode Apr 9, 2024 •

edited

Loading

jewertow Apr 9, 2024

wbpcode Apr 9, 2024

jewertow Apr 9, 2024

wbpcode Apr 10, 2024

wbpcode commented Apr 9, 2024

jewertow commented Apr 9, 2024

	admin:{SHA}0DPiKuNIrrVmD8IUCuw1hQxNqZc=
	admin:{SHA}hashed_admin_password

basic_auth: add support for per-route filter #33335

basic_auth: add support for per-route filter #33335

Conversation

jewertow commented Apr 4, 2024

repokitteh-read-only bot commented Apr 4, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wbpcode Apr 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wbpcode commented Apr 4, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zhaohuabing Apr 8, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zhaohuabing commented Apr 8, 2024

jewertow commented Apr 8, 2024

wbpcode left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wbpcode Apr 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wbpcode commented Apr 9, 2024

jewertow commented Apr 9, 2024

wbpcode Apr 4, 2024 •

edited

Loading

zhaohuabing Apr 8, 2024 •

edited

Loading

wbpcode Apr 9, 2024 •

edited

Loading