基于APISIX的ABAC模型鉴权插件开发

plugins:
...
  - serverless-post-function
  - ext-plugin-post-req
  - auth-bios

-- 引入一堆依赖
local core = require("apisix.core")
local m_redis = require("apisix.plugins.auth-bios.redis")
...

-- 标识插件名称
local plugin_name = "auth-bios"

-- 定义插件配置参数
local schema = {
    type = "object",
    properties = {
        -- 一堆配置参数
        redis_host = { type = "string" },
        redis_port = { type = "integer", default = 6379 },
        redis_password = { type = "string" },
        ...
    },
    -- 必选参数列表
    required = { "redis_host" }
}

-- 定义插件信息
local _M = {
    version = 0.1,
    -- 优先级，官方推荐1~99，过高的优先级先抢夺一些基础插件的优先执行权
    priority = 5001,
    -- 由于需要与consumer配合，故设置成auth，详见：https://apisix.apache.org/zh/docs/apisix/architecture-design/consumer
    type = 'auth',
    name = plugin_name,
    schema = schema,
}

-- check_schema方法在安装插件时调用，用于检查插件是否合法
function _M.check_schema(conf)
    -- 此方法会检查插件配置是否合法（E.g. 是否缺少必选参考）
    local check_ok, check_err = core.schema.check(schema, conf)
    if not check_ok then
        core.log.error("Configuration parameter error")
        return false, check_err
    end
    -- 此方法亦可以用于全局初始化，E.g. 建立redis连接
    local _, redis_err = m_redis.init(conf.redis_host, conf.redis_port, conf.redis_database, conf.redis_timeout, conf.redis_password)
    if redis_err then
        core.log.error("Connect redis error", redis_err)
        return false, redis_err
    end
    ...
    -- 如果检查通过返回true
    return true
end

-- rewrite方法在每次请求命中插件时调用，也是插件处理的核心逻辑
function _M.rewrite(conf, ctx)
    -- 这里调用了 auth-bios 目录下的各个具体处理逻辑
    -- 先根据请求入参获取请求身份（谁发起的请求，可以是人、租户、应用、设备等）及请求的资源（基于uri）
    local ident_code, ident_message = m_ident.ident(conf, ctx)
    if ident_code ~= 200 then
        return ident_code, ident_message
    end
    -- 然后判断该身份有没有访问对应资源的权限
    local auth_code, auth_message = m_auth.auth(ctx.ident_info)
    if auth_code ~= 200 then
        return auth_code, auth_message
    end
    -- 如果有权限则组装请求信息传向目标服务
    core.request.set_header(ctx, conf.ident_flag, ngx_encode_base64(json.decode({
        res_action = ctx.ident_info.resource_action,
        res_uri = ctx.ident_info.resource_uri,
        app_id = ctx.ident_info.app_id,
        tenant_id = ctx.ident_info.tenant_id,
        account_id = ctx.ident_info.account_id,
        token = ctx.ident_info.token,
        token_kind = ctx.ident_info.token_kind,
        ak = ctx.ident_info.ak,
        roles = ctx.ident_info.roles,
        groups = ctx.ident_info.groups,
    })))
end

-- 返回插件信息
return _M

use t::APISIX 'no_plan';

no_long_string();
no_root_location();
no_shuffle();
run_tests;

__DATA__
=== TEST 1: test redis
--- config
    location /t {
        content_by_lua_block {
            local m_utils = require("apisix.plugins.auth-bios.utils")
            local m_redis = require("apisix.plugins.auth-bios.redis")
            local m_redis1 = require("apisix.plugins.auth-bios.redis")
            m_redis.init("127.0.0.1", 6379, 1, 1000, "123456")
            m_redis1.set("test", "测试1")
            ngx.say(m_redis.get("test"))
            m_redis.hset("test_hash","api://xx/?1","{\"a\":\"xx1\"}")
            m_redis.hset("test_hash","api://xx/?2","{\"a\":\"xx2\"}")
            m_redis.hset("test_hash","api://xx/?3","{\"a\":\"xx3\"}")
            m_redis.hset("test_hash","api://xx/?4","{\"a\":\"xx4\"}")
            m_redis.hset("test_hash","api://xx/?5","{\"a\":\"xx5\"}")
            m_redis.hscan("test_hash","*",2, function(k,v) ngx.say(k..":"..v) end)
            m_redis.hscan("not_exist","*",2, function(k,v) ngx.say(k..":"..v) end)
        }
    }
--- request
GET /t
--- response_body
测试1
api://xx/?1:{"a":"xx1"}
api://xx/?2:{"a":"xx2"}
api://xx/?3:{"a":"xx3"}
api://xx/?4:{"a":"xx4"}
api://xx/?5:{"a":"xx5"}
--- no_error_log
[error]

export PERL5LIB=.:$PERL5LIB

TEST_NGINX_BINARY=/usr/bin/openresty prove -Itest-nginx/lib -r t/plugin/auth-bios/redis.t

# initialize NGINX config file and etcd
make init

# start Apache APISIX server
make run

# stop Apache APISIX server gracefully
make quit

# stop Apache APISIX server immediately
make stop

# 添加upstream
curl "http://127.0.0.1:9080/apisix/admin/upstreams/1" -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d '
{
  "type": "roundrobin",
  "nodes": {
    "httpbin.org:80": 1
  }
}'

# 添加route
curl "http://127.0.0.1:9080/apisix/admin/routes/1" -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d '
{
  "uri": "/cache/**",
  "upstream_id": "1"
}'

# 测试成功
curl -i -X GET "http://127.0.0.1:9080/cache/1"

# 添加全局插件（需要开启Redis）
curl "http://127.0.0.1:9080/apisix/admin/global_rules/1" -H "Content-Type: application/json" -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d '
{
  "plugins": {
    "auth-bios": {
      "redis_host": "127.0.0.1",
      "redis_password": "123456",
      "redis_database": 1
    }
  }
}'

# 获取全局插件列表
curl http://127.0.0.1:9080/apisix/admin/global_rules -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1'

# 测试失败，缺少 BIOS-Host
curl -i -X GET "http://127.0.0.1:9080/cache/1"
# 测试成功
curl -i -X GET "http://127.0.0.1:9080/cache/1" -H 'BIOS-Host: app1.tenant1'

# 测试失败，Token错误
curl -i -X GET "http://127.0.0.1:9080/cache/1" -H 'BIOS-Host: app1.tenant1' -H 'BIOS-Token: token001'
# 测试成功（先执行单元测试）
curl -i -X GET "http://127.0.0.1:9080/cache/1" -H 'BIOS-Host: app1.tenant1' -H 'BIOS-Token: tokenxxx'