Skip to content

feat(openid-connect): allow set headers in introspection request#11090

Merged
moonming merged 10 commits into
apache:masterfrom
yuweizzz:oidc
Apr 16, 2024
Merged

feat(openid-connect): allow set headers in introspection request#11090
moonming merged 10 commits into
apache:masterfrom
yuweizzz:oidc

Conversation

@yuweizzz

Copy link
Copy Markdown
Contributor

Description

Fixes #10601

allow set headers in introspection request.

Checklist

  • I have explained the need for this PR and the problem it solves
  • I have explained the changes or the new features added to this PR
  • I have added tests corresponding to this change
  • I have updated the documentation to reflect this change
  • I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

@shreemaan-abhishek

Copy link
Copy Markdown
Contributor

could you please explain about the use cases where this feature would be helpful in the linked issue thread?

@yuweizzz

yuweizzz commented Mar 28, 2024

Copy link
Copy Markdown
Contributor Author

this pr allows provide extra HTTP headers when talks to the OpenID Connect introspection endpoint, In other API gateway has this feature alrealy, like traefik. and some oauth libs has this feature too, like oauthlib.

@shreemaan-abhishek

Copy link
Copy Markdown
Contributor

@yuweizzz please fix the linter

@yuweizzz

yuweizzz commented Apr 1, 2024

Copy link
Copy Markdown
Contributor Author

done.

Comment thread apisix/plugins/openid-connect.lua Outdated
Comment thread t/plugin/openid-connect6.t Outdated
Comment thread t/plugin/openid-connect6.t
Comment thread t/plugin/openid-connect6.t
Comment thread t/plugin/openid-connect6.t Outdated
Comment thread t/plugin/openid-connect6.t
| cache_segment | string | False | | | Optional name of a cache segment, used to separate and differentiate caches used by token introspection or JWT verification. |
| introspection_interval | integer | False | 0 | | TTL of the cached and introspected access token in seconds. |
| introspection_expiry_claim | string | False | | | Name of the expiry claim, which controls the TTL of the cached and introspected access token. The default value is 0, which means this option is not used and the plugin defaults to use the TTL passed by expiry claim defined in `introspection_expiry_claim`. If `introspection_interval` is larger than 0 and less than the TTL passed by expiry claim defined in `introspection_expiry_claim`, use `introspection_interval`. |
| introspection_addon_headers | string[] | False | | | Array of strings. Used in Append extras headers to the introspection http request, If configured header not exist in origin request, it will be ignore. |

@kayx23 kayx23 Apr 9, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| introspection_addon_headers | string[] | False | | | Array of strings. Used in Append extras headers to the introspection http request, If configured header not exist in origin request, it will be ignore. |
| introspection_addon_headers | string[] | False | | | Array of strings. Used to append additional header values to the introspection HTTP request. If the specified header does not exist in origin request, value will not be appended. |

This is for appending header value right?

@yuweizzz

Copy link
Copy Markdown
Contributor Author

any update?

@juzhiyuan
juzhiyuan requested a review from bzp2010 April 15, 2024 23:44
@moonming
moonming merged commit 59b50b6 into apache:master Apr 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

help request: How to set header to introspection endpoint used within OIDC plugin?

5 participants