1. Key-Authentication
2. Rate-limiting

Key-Authentication Plugin

This Key Authentication plugin can be added to a service or a route. Consumers can add their Apikey either in a querystring parameter or a header to authenticate their requests. Plugins registered can be viewed at http://localhost:8001/plugins.

Adding key-auth plugin to the service

You should provide service_id(d4079539–45d0–4798–96a8–6ac39d86b6cb) or service_name (testApi) of that specific service to register the key-auth plugin. Get the service details at http://localhost:8001/services. Register the key-auth plugin to the service with the following cQuery.

curl -X POST http://localhost:8001/services/testApi/plugins \
--data "name=key-auth"
Response:
{“created_at”:1536501460000,”config”:{“key_in_body”:false,”run_on_preflight”:true,”anonymous”:””,”hide_credentials”:false,”key_names”:[“apikey”]},”id”:”0fe22dc7–1bae-4a94–9841-d66469a1faaf”,”enabled”:true,”service_id”:”d4079539–45d0–4798–96a8–6ac39d86b6cb”,”name”:”key-auth”}

The above response clearly tells us to pass “apikey” has to pass as header or querystring parameter.

Now see what happens, if we access our API

curl -i -X GET --url http://localhost:8000/api/v1/test2 --header 'Host: localhost'
Response:
HTTP/1.1 401 Unauthorized
{"message":"No API key found in request"}

Our consumers needs“apikey” to access the service. Lets set apikey to each consumer we registered with the following query.

curl -X POST http://localhost:8001/consumers/consumer1/key-auth --data ""
Response:
{"id":"508bee01-613b-4f21-8ced-b098395e0a47","created_at":1536498848000,"key":"M1PyCiEee7QbI44FWC24G4WK7Bb4vZgm","consumer_id":"abd67a95-a247-4141-b329-d74fe6d3fb06"}

Pass the “key” as header or querystring parameter to access the service

curl -i -X GET --url http://localhost:8000/api/v1/test2 --header 'Host: localhost' --header 'apikey: M1PyCiEee7QbI44FWC24G4WK7Bb4vZgm'
HTTP/1.1 200 OK
Response:
{“message”:”second end point \”test2\” is called”,”status_code”:200}

Consumer keys can be accessed at http://localhost:8001/consumers/consumer1/key-auth

Adding key-auth plugin to route

delete the key-auth plugin of the service and lets add on the route to test.

curl -i -X DELETE http://localhost:8001/plugins/0fe22dc7-1bae-4a94-9841-d66469a1faaf

set key-auth plugin to the route /api/v1/test1 with the following query.

curl -X POST http://localhost:8001/routes/668ac4ab-4226-45f7-9067-e30c032a840f/plugins --data "name=key-auth"
Response:
{"created_at":1536508484000,"config":{"key_in_body":false,"run_on_preflight":true,"anonymous":"","hide_credentials":false,"key_names":["apikey"]},"id":"048d6fcc-f1f0-4f04-b3a4-584754871dd8","enabled":true,"route_id":"668ac4ab-4226-45f7-9067-e30c032a840f","name":"key-auth"}

Now you can access route /api/v1/test2 without authentication and route /api/v1/test1 with authentication, since we just set the authentication on this route. Lets test this

$ curl -i -X GET --url http://localhost:8000/api/v1/test1 --header 'Host: localhost'
HTTP/1.1 401 Unauthorized
{"message":"No API key found in request"}

The above query passed without apikey and response is 401 Unauthorized

$ curl -i -X GET --url http://localhost:8000/api/v1/test2 --header 'Host: localhost'
HTTP/1.1 200 OK
{"message":"second end point \"test2\" is called","status_code":200}

The above query passed without apikey and the response is 200 OK.Because we added key-auth plugin only on /api/v1/test1 route.

$ curl -i -X GET --url http://localhost:8000/api/v1/test1 --header 'Host: localhost' --header 'apikey: M1PyCiEee7QbI44FWC24G4WK7Bb4vZgm'
HTTP/1.1 200 OK
{"message":"first end point \"test1\" is called","status_code":200}

Here we conclude that we can provide a specific route of the API to specific consumer with key-auth plugin.

Rate Limiting Plugin

This plugin helps us to restrict consumer making requests to our API/Service in a given period of time(seconds, minute, hour, month, year).

This plugin can be enable on a service or route or consumer with consumer_id.

Enabling on Service  –  restricts every consumer making requests to the service.

Enabling on route  – restricts every consumer making requests to the specific route of the service.

Enabling on consumer  –  restricts only that specified consumer making requests to any routes of the service.

Adding rate-limiting to the service:

$ curl -X POST http://localhost:8001/services/testApi/plugins \
--data "name=rate-limiting" \
--data "config.minute=2" \
--data "config.hour=100"

Response:{“created_at”:1536558895000,”config”:{“minute”:2,”policy”:”cluster”,”redis_timeout”:2000,”hide_client_headers”:false,”hour”:100,”limit_by”:”consumer”,”redis_port”:6379,”redis_database”:0,”fault_tolerant”:true},”id”:”38586082–7619–4bf7-b418-afcc65d37f28",”enabled”:true,”service_id”:”d4079539–45d0–4798–96a8–6ac39d86b6cb”,”name”:”rate-limiting”}

This plugin is by-default limit by consumer. From the query above, we can send only 2 requests per minute and 100 per hour.
Response from Kong after exceeding limit is {“message”:”API rate limit exceeded”}.

Lets test this by simple python script.

import requests
from time import sleep
for i in range(1,10):
response = requests.get(“http://localhost:8000/api/v1/test1?apikey=M1PyCiEee7QbI44FWC24G4WK7Bb4vZgm")
print(response.ok, response.text)
sleep(1)

Similarly you can play around with this rate-limiting plugin on consumer or route of the service too. Specify the consumer_id in the following query to add rate-limiting plugin to the consumer.

$ curl -X POST http://localhost:8001/plugins \
--data "name=rate-limiting" \
--data "consumer_id={consumer_id}" \
--data "config.second=5" \
--data "config.hour=10000"

To add rate-limiting plugin on the route of the service, you need to add the route_id to the following query.

$ curl -X POST http://localhost:8001/routes/{route_id}/plugins \
--data "name=rate-limiting" \
--data "config.minute=2" \
--data "config.hour=100"

The post Key Authentication and Rate Limiting plugins of Kong on Flask API appeared first on Turbolab Technologies.

Lets break down the tutorial into two parts:

Part 1

1. Set up the Flask API. Follow this repo.
2. Register our Flask API as service in Kong.
3. Register our endpoints of Flask API as routes in Kong.
4. Create Consumers for our Kong service.

Part 2

1. Apply Kong plugins on the services/routes/consumers.
   Detailed work on plugins are discussed in next part.

Set up the Flask API

We need an API to proceed further into the discussion. So, lets setup Flask API from this link. Steps needed to install are clearly mentioned in that git repo.

Else, you can proceed if you have an API without setting up the Flask API mentioned above.

http://localhost:5055 is the domain and port(service) and /api/v1/test1, /api/v1/test2 are the endpoints(routes) which are used to communicate with the Flask API.

Register our Flask API as service in Kong:

Kong restful framework makes our job easy for Administration purposes. One can check the registered services at http://localhost:8001/services

You can register our Flask API as service in Kong with the below query

curl -i -X POST \
--url http://localhost:8001/services/ \
--data 'name=testApi' \
--data 'url=http://localhost:5055'
Response: {“host”:”localhost”,”created_at”:1536467002,”connect_timeout”:60000,”id”:”d4079539–45d0–4798–96a8–6ac39d86b6cb”,”protocol”:”http”,”name”:”testApi”,”read_timeout”:60000,”port”:5055,”path”:null,”updated_at”:1536467002,”retries”:5,”write_timeout”:60000}

Register end points of Flask API as routes in KONG

We registered our Flask APIs domain and port as a service. The end points of Flask API are the key to communicate. So, lets register them as routes in Kong. One can check registered routes of the service at http://localhost:8001/routes

Register the route /api/v1/test1 to the service with the following query
curl -i -X POST \
--url http://localhost:8001/services/testApi/routes \
--data 'hosts[]=localhost' \
--data 'paths[]=/api/v1/test1' \
--data 'strip_path=false' \
--data 'methods[]=GET'

Same way, register the other endpoint too. Confirm the two endpoints here. Make sure that service id matches to their respective/routes.

Now our requests to API forwards through Kong Gateway at port 8000. since, Kong handles proxy requests on port :8000

Check our API response at 8000
curl -i -X GET \
--url http://localhost:8000/api/v1/test1 \
--header 'Host: localhost'
Response:
HTTP/1.1 200 OK
{"message":"first end point \"test1\" is called","status_code":200}

Create consumers for our service

Now we just registered our API to Kong. We will have consumers sending multiple requests to our Flask API when it goes to public. How can we set Security and control over API? It can be achieved by adding Kong plugins like Authentication and rate-limiting on services or routes. To test these Kong plugins, we need some consumers. We can register the consumers with username and id with the following query.

$ curl -X POST http://localhost:8001/consumers --data "username=consumer1" --data "custom_id=101"
Response:{"custom_id":"101","created_at":1536496865,"username":"consumer1","id":"abd67a95-a247-4141-b329-d74fe6d3fb06"}
$ curl -X POST http://localhost:8001/consumers --data "username=consumer2" --data "custom_id=102"
Response:{"custom_id":"102","created_at":1536496883,"username":"consumer2","id":"57f1a4dd-c551-43ff-9e06-56501f0d39ac"}

One can check registered consumers of the service(s)/route(s) at http://localhost:8001/consumers

Flask API registered to KONG service and follow this discussion about applying plugins like Key-Authentication and Rate-Limiting.

Installation of Kong has discussed in here.

Key Authentication and Rate Limiting plugins of Kong on Flask API

The post Registering the API as service in KONG appeared first on Turbolab Technologies.

[/et_pb_text]
[/et_pb_column]
[/et_pb_row]
[/et_pb_section]

The post Kong API Gateway Installation Guide for beginners appeared first on Turbolab Technologies.