AWS Cognito an an authorizer for an APISIX route with openid-connect plugin?

[eduard93]

Is it possible to use the AWS Cognito User Pool as an authorizer on an APISIX route?
I tried to configure openid-connect, but it seems it requires a token introspection endpoint, which AWS Cognito does not provide.
Has anyone had any luck with this setup?

[eduard93]

Some errors I have in logs:

2024/10/16 19:32:23 [warn] 58#58: *98 [lua] plugin.lua:963: decrypt_conf(): failed to decrypt the conf of plugin [openid-connect] key [client_secret], err: decrypt ssl key failed, context: ngx.timer
 
2024/10/16 19:51:35 [error] 53#53: *138204 [lua] openid-connect.lua:533: phase_func(): OIDC introspection failed: no endpoint URI for introspection, client: 172.25.0.1, server: _, request: "GET / HTTP/1.1", host: "web1.lvh.me:9080"

[dosubot[bot]]

To modify the policy.csv file to allow any user in the testgroup to perform any requests on any path, you can update it as follows:

policy.csv:

p, testgroup, *, *

This policy line specifies that any user in the testgroup is allowed to perform any action (*) on any object (*) ^[1].

To continue talking to Dosu, mention @dosu.

[eduard93]

@dosu. I looked at authz-casbin documentation and there's no token_claims field to set. The only related attribute I see is username with the following description: header in the request that will be used in the request to pass the username (subject).

After I verify the JWT token in openid-connect plugin, how can I take cognito:groups property from the decoded token and add it as a header field to use with authz-casbin username attribute?

[dosubot[bot]]

To extract the cognito:groups property from a decoded JWT token and add it as a header field for use with the authz-casbin plugin's username attribute, you can use the serverless-pre-function plugin in APISIX. This plugin allows you to write a custom Lua function to manipulate request headers based on JWT claims. Here's how you can achieve this:

1. Configure the openid-connect Plugin: Ensure that the openid-connect plugin is configured to verify the JWT token.

2. Use the serverless-pre-function Plugin: Write a Lua function to extract the cognito:groups claim and set it as a request header.

Here's an example configuration:

{
  "uri": "/your-api-endpoint",
  "plugins": {
    "openid-connect": {
      "client_id": "${CLIENT_ID}",
      "client_secret": "${CLIENT_SECRET}",
      "discovery": "https://cognito-idp.${AWS_REGION}.amazonaws.com/${USERPOOL_ID}/.well-known/openid-configuration",
      "bearer_only": true,
      "use_jwks": true
    },
    "serverless-pre-function": {
      "phase": "rewrite",
      "functions": ["return function(conf, ctx)
        local core = require('apisix.core')
        local jwt = require('resty.jwt')
        local jwt_token = core.request.header(ctx, 'Authorization')
        if jwt_token then
          local _, _, jwt_token_only = string.find(jwt_token, 'Bearer%s+(.+)')
          if jwt_token_only then
            local jwt_obj = jwt:load_jwt(jwt_token_only)
            if jwt_obj.valid then
              local groups = jwt_obj.payload['cognito:groups']
              if groups and #groups > 0 then
                core.request.set_header(ctx, 'X-User-Groups', table.concat(groups, ','))
              end
            end
          end
        end
      end"]
    },
    "authz-casbin": {
      "model_path": "/path/to/model.conf",
      "policy_path": "/path/to/policy.csv",
      "username": "X-User-Groups"
    }
  },
  "upstream": {
    "type": "roundrobin",
    "nodes": {
      "your-upstream-service:80": 1
    }
  }
}

In this configuration:

• The serverless-pre-function plugin extracts the cognito:groups claim from the JWT token and sets it as a header named X-User-Groups.
• The authz-casbin plugin is configured to use the X-User-Groups header as the username attribute for authorization decisions ^[1][2].

To continue talking to Dosu, mention @dosu.

[eduard93]

@dosu thank you. Here's what I have working so far:

{
  "uri": "/*",
  "name": "web1",
  "host": "web1.lvh.me",
  "plugins": {
    "authz-casbin": {
      "model": "[request_definition]\nr = sub, obj, act\n\n[policy_definition]\np = sub, obj, act\n\n[role_definition]\ng = _, _\n\n[policy_effect]\ne = some(where (p.eft == allow))\n\n[matchers]\nm = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && keyMatch(r.act, p.act)",
      "policy": "p, testgroup, *, *",
      "username": "X-User-Groups"
    },
    "openid-connect": {
      "bearer_only": true,
      "client_id": "CLIENTID",
      "client_secret": "CLIENT_SECRET",
      "discovery": "https://cognito-idp.us-east-2.amazonaws.com/POOL_ID/.well-known/openid-configuration",
      "use_jwks": true
    },
    "serverless-pre-function": {
      "functions": [
        "return function(conf, ctx)\n        local core = require('apisix.core')\n        local jwt = require('resty.jwt')\n        local jwt_token = core.request.header(ctx, 'Authorization')\n        if jwt_token then\n          local _, _, jwt_token_only = string.find(jwt_token, 'Bearer%s+(.+)')\n          if jwt_token_only then\n            local jwt_obj = jwt:load_jwt(jwt_token_only)\n            if jwt_obj.valid then\n              local groups = jwt_obj.payload['cognito:groups']\n              if groups and #groups > 0 then\n                core.request.set_header(ctx, 'X-User-Groups', table.concat(groups, ','))\n              end\n            end\n          end\n        end\n      end"
      ],
      "phase": "rewrite"
    }
  },
  "service_id": "1",
  "status": 1
}

It does work. serverless-pre-function adds X-User-Groups header into a request which is being used by authz-casbin plugin as a username. However there is an issue. If the user belongs to more than one group the X-User-Groups header would be set to, for example, group1,group2,testgroup. But authz-casbin policy/model expects an exact match on a username. Is it possible for a user to belong in any number of groups and for authz-casbin plugin to check only if the username includes testgroup?

[dosubot[bot]]

To handle scenarios where a user belongs to multiple groups and you want the authz-casbin plugin to check if the X-User-Groups header includes a specific group like testgroup, you can modify the Casbin model to use a custom matcher function. Here's how you can adjust your configuration:

1. Modify the Casbin Model: Update the matchers section in your model to use a custom function that checks for partial matches in the X-User-Groups header.

Updated model.conf:

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = regexMatch(r.sub, p.sub) && keyMatch(r.obj, p.obj) && keyMatch(r.act, p.act)

2. Update the Policy: Ensure your policy allows access based on the presence of testgroup in the X-User-Groups header.

Updated policy.csv:

p, .*testgroup.*, *, *

In this configuration:

• The regexMatch function is used in the matchers section to allow for partial matches using regular expressions. This will check if testgroup is part of the X-User-Groups header value.
• The policy line p, .*testgroup.*, *, * specifies that any request with testgroup in the X-User-Groups header is allowed to perform any action on any object.

This setup should allow users who belong to testgroup among other groups to access the API, as the authz-casbin plugin will check for the presence of testgroup in the X-User-Groups header using a regular expression.

To continue talking to Dosu, mention @dosu.