Secure your Services Using Authentication

1. Access your Kong Manager instance and your default workspace.
2. Go to the Routes page and select the mocking route you created.
3. Click View.
4. On the Scroll down and select the Plugins tab, then click Add a Plugin.
5. In the Authentication section, find the Key Authentication plugin and click Enable.

6. In the Create new key-auth plugin dialog, the plugin fields are automatically scoped to the route because the plugin is selected from the mocking Routes page.

   For this example, this means that you can use all of the default values.

7. Click Create.

   Once the plugin is enabled on the route, key-auth displays under the Plugins section on the route’s overview page.

Now, if you try to access the route without providing an API key, the request will fail, and you’ll see the message "No API key found in request".

Before Kong proxies requests for this route, it needs an API key. For this example, since you installed the Key Authentication plugin, you need to create a consumer with an associated key first.

Call the Admin API on port 8001 and configure plugins to enable key authentication. For this example, apply the plugin to the /mock route you created:

curl -X POST http://localhost:8001/routes/mocking/plugins \
  --data name=key-auth

http :8001/routes/mocking/plugins \
  name=key-auth

Try to access the service again:

curl -i http://localhost:8000/mock

http :8000/mock

Since you added key authentication, you should be unable to access it:

HTTP/1.1 401 Unauthorized
...
{
    "message": "No API key found in request"
}

Before Kong proxies requests for this route, it needs an API key. For this example, since you installed the Key Authentication plugin, you need to create a consumer with an associated key first.

1. Under the mocking route in the routes section of the kong.yaml file, add a plugin section and enable the key-auth plugin:

    plugins:
    - name: key-auth
   

   Your file should now look like this:

    _format_version: "1.1"
    services:
    - host: httpbin.konghq.com
      name: example_service
      port: 80
      protocol: http
      routes:
      - name: mocking
        paths:
        - /mock
        strip_path: true
        plugins:
        - name: key-auth
    plugins:
    - name: rate-limiting
      config:
        minute: 5
        policy: local
    - name: proxy-cache
      config:
        content_type:
        - "application/json; charset=utf-8"
        cache_ttl: 30
        strategy: memory
   

2. Sync the configuration:

    deck sync
   

Now, if you try to access the route at http://localhost:8000/mock without providing an API key, the request will fail, and you’ll see the message "No API key found in request".

Before Kong proxies requests for this route, it needs an API key. For this example, since you installed the Key Authentication plugin, you need to create a consumer with an associated key first.

1. In Kong Manager, go to API Gateway > Consumers.
2. Click New Consumer.
3. Enter the Username and Custom ID. For this example, use consumer for each field.
4. Click Create.
5. On the Consumers page, find your new consumer and click View.
6. Scroll down the page and click the Credentials tab.
7. Click New Key Auth Credential.
8. Set the key to apikey and click Create.

The new Key Authentication ID displays on the Consumers page under the Credentials tab.

To create a consumer, call the Admin API and the consumer’s endpoint. The following creates a new consumer called consumer:

curl -i -X POST http://localhost:8001/consumers/ \
  --data username=consumer \
  --data custom_id=consumer

http :8001/consumers \
  username=consumer \
  custom_id=consumer

Once provisioned, call the Admin API to provision a key for the consumer created above. For this example, set the key to apikey.

curl -i -X POST http://localhost:8001/consumers/consumer/key-auth \
  --data key=apikey

http :8001/consumers/consumer/key-auth \
  key=apikey

If no key is entered, Kong automatically generates the key.

Result:

HTTP/1.1 201 Created
...
{
    "consumer": {
        "id": "2c43c08b-ba6d-444a-8687-3394bb215350"
    },
    "created_at": 1568255693,
    "id": "86d283dd-27ee-473c-9a1d-a567c6a76d8e",
    "key": "apikey"
}

You now have a consumer with an API key provisioned to access the route.

1. Add a consumers section to your kong.yaml file and create a new consumer:

    consumers:
    - custom_id: consumer
      username: consumer
      keyauth_credentials:
      - key: apikey
   

   Your file should now look like this:

    _format_version: "1.1"
    services:
    - host: httpbin.konghq.com
      name: example_service
      port: 80
      protocol: http
      routes:
      - name: mocking
        paths:
        - /mock
        strip_path: true
        plugins:
        - name: key-auth
    consumers:
    - custom_id: consumer
      username: consumer
      keyauth_credentials:
      - key: apikey
    plugins:
    - name: rate-limiting
      config:
        minute: 5
        policy: local
    - name: proxy-cache
      config:
        content_type:
        - "application/json; charset=utf-8"
        cache_ttl: 30
        strategy: memory
   

2. Sync the configuration:

    deck sync
   

You now have a consumer with an API key provisioned to access the route.

To validate the Key Authentication plugin, access your route through your browser by appending ?apikey=apikey to the url:

http://localhost:8000/mock?apikey=apikey

To validate the Key Authentication plugin, access the mocking route again, using the header apikey with a key value of apikey.

curl -i http://localhost:8000/mock/anything \
  -H 'apikey:apikey'

http :8000/mock/anything apikey:apikey

You should get an HTTP/1.1 200 OK message in response.

1. Go to the Plugins page and click on View for the key-auth row.
2. Use the toggle at the top of the page to switch the plugin from Enabled to Disabled.

Find the plugin ID and copy it:

curl -X GET http://localhost:8001/routes/mocking/plugins/

http :8001/routes/mocking/plugins

Output:

"id": "2512e48d9-7by0-674c-84b7-00606792f96b"

Disable the plugin:

curl -X PATCH http://localhost:8001/routes/mocking/plugins/{<plugin-id>} \
  --data enabled=false

http -f patch :8001/routes/mocking/plugins/{<plugin-id>} \
  enabled=false

1. Disable the key-auth plugin in the kong.yaml file by setting enabled to false:

    plugins:
    - name: key-auth
      enabled: false
   

2. Sync the configuration:

    $ deck sync