Description

Hello, I am using the Ingress Controller and I am trying to support the following scenario using OIDC

• ClientID A should have access to Endpoints A,B
• ClientID B should have access to Endpoints B,C

All of them should be of type "client_credentials"

And on top of a test route, I have the following definition:

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: echoserver-multiple-apisix
  namespace: ${kubernetes_namespace_v1.echonamespace2.metadata.0.name}
spec:
  http:
  - name: echohttp
    match:
      hosts:
      - echo.k8s.orb.local
      paths:
      - "/echo*"
    backends:
    - serviceName: echoserver2-service
      servicePort: 80
    plugins:

      - name: "openid-connect"
        enable: true
        config:
          client_id: "apisix2"
          client_secret: "..."
          discovery: "http://keycloak-proxy.keycloak.svc.cluster.local/realms/apisixrealm/.well-known/openid-configuration"
          introspection_endpoint: "http://keycloak-proxy.keycloak.svc.cluster.local/realms/apisixrealm/protocol/openid-connect/token/introspect"
          realm: "apisixrealm"
          scope: "route1scope"

I am using the OIDC plugin and Keycloak as my authentication provider. Although APISIX can provide access to the endpoints, with tokens accessed it fails to deny access to clients that don't have the required scope. No matter what scope I put in the scope parameter, it always allows anyone with a valid token (but without a scope) to access the route. Perhaps this is a relevant issue: #1272

Therefore, I have two questions:

• For the scenario originally described, can I have multiple OIDC plugins with different client IDs and secrets on top of a route to achieve what I want? (since multiple clients must be able to access the same route)
• For the issue where the scopes are not taken into account, is there something I am missing or can do differently?
  • How can I restrict an API to specific scopes with the openid-connect plugin?