CAS Authentication and multiple backends

[LukMas]

Hi!

We are evaluating different solutions for our API Gateway. One big problem that we have is related to the authentication. We are constrained to use CAS (plans to move to something different are there, but it's not in a close future).

Up to now we always developed our applications either as a single application or a backend + frontend couple. The CAS authentication with both solutions works flawless, following the standard CAS behaviour.

But, as more we code, more we see the need to reduce the duplication of the APIs (in the backend + frontend solution), hence the need of an API Gateway.
Here comes the problem: how could we configure APISIX to support the CAS authentication correctly? For our backend + frontend application we do this:

• the user goes to a protected URL
• the frontend checks the rights, if login is required...
• redirects to the CAS server with the service set as a backend part of the application (plus a know path to accept the login)
• after the login the CAS servers response contains a location that is the backend service plus the path for login
• the backend, in the handler for the login path, stores the cookie and returns back to the frontend to a given page (/home)
• in the frontend the /home page is the one designated to handle the successful login, after this the user could move in any protected page (anyway any API call is protected with the cookie)

Before deep diving into the configuration of all the possible components, only to find out that the CAS plugin cannot support this, I would like to know from you if this behaviour could be simulates/performed using the APISIX Gateway.

[dosubot[bot]]

Hey @LukMas! I'm here to help you with your API Gateway authentication question. If you need assistance with anything else, feel free to ask!

To configure APISIX to support CAS authentication correctly for your backend and frontend applications, you need to enable the cas-auth plugin on the specific routes you want to protect. Here is an example configuration:

curl http://127.0.0.1:9180/apisix/admin/routes/cas1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '  
{  
    "methods": ["GET", "POST"],  
    "host" : "127.0.0.1",  
    "uri": "/anything/*",  
    "plugins": {  
          "cas-auth": {  
              "idp_uri": "http://127.0.0.1:8080/realms/test/protocol/cas",  
              "cas_callback_uri": "/anything/cas_callback",  
              "logout_uri": "/anything/logout"  
          }  
    },  
    "upstream": {  
        "type": "roundrobin",  
        "nodes": {  
            "httpbin.org": 1  
        }  
    }  
}'

Explanation:

1. idp_uri: The URI of the Identity Provider (IdP) for CAS authentication.
2. cas_callback_uri: The URI to which the IdP will redirect after a successful login, with the CAS ticket as a GET parameter.
3. logout_uri: The URI to trigger the logout process.

Steps:

1. Enable the Plugin: Use the above curl command to enable the cas-auth plugin on the desired route.
2. Redirect to Login: When a user accesses the route, they will be redirected to the IdP login page if no login session exists.
3. Callback Handling: After successful login, the IdP will redirect the user to the cas_callback_uri with a CAS ticket. If the ticket is verified, a login session is created.
4. Logout Handling: Users can visit the logout_uri to start the logout process, which will redirect them to the IdP for logout.

Additional Notes:

• The cas_callback_uri and logout_uri should be either fully qualified addresses (e.g., http://127.0.0.1:9080/anything/logout) or path-only (e.g., /anything/logout). It is recommended to use path-only to maintain consistency.
• These URIs need to be captured by the route where the current APISIX is located. For example, if the uri of the current route is /api/v1/*, cas_callback_uri can be filled in as /api/v1/cas_callback.

This configuration ensures that both your backend and frontend applications are protected by CAS authentication through APISIX.

To remove the cas-auth plugin, you can delete the corresponding JSON configuration from the plugin configuration. APISIX will automatically reload, and you do not have to restart for this to take effect.

curl http://127.0.0.1:9180/apisix/admin/routes/cas1  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '  
{  
    "methods": ["GET", "POST"],  
    "uri": "/anything/*",  
    "plugins": {},  
    "upstream": {  
        "type": "roundrobin",  
        "nodes": {  
            "httpbin.org:80": 1  
        }  
    }  
}'  

This setup should help you simulate the CAS authentication behavior you described using APISIX ^[1][2][3].

To continue talking to Dosu, mention @dosu.