6 ms·

This is a great article and I love HAproxy. Even so much that I wrote a REST-like wrapper for it a couple of years ago to turn HAproxy into an API gateway. It t

by tnolet 8y ago

This is a great article and I love HAproxy. Even so much that I wrote a REST-like wrapper for it a couple of years ago to turn HAproxy into an API gateway. It touched many of the points in the article. Maybe useful for people in the field https://github.com/magneticio/vamp-router https://github.com/magneticio/vamp-router

Natsu 8y ago
Am I wrong, or is there still nothing that handles security in the API Gateway? For example, suppose you want to do OAuth in the gateway instead of building it into every API. I couldn't see anything to handle a use case like that. The best I see is that it can probably handle one-way SSL, but I'm not clear on how it would handle mutual authentication or verification of client certs (pinning, CRLs, or OCSP). It's a lot of work to build that into APIs separately and a lot of people who use API Gateways prefer to have the gateway itself handle security.
- bedis9 8y ago
  This is part of part-2 of our blog post about api gateway with haproxy. It will feature token validation in Lua and much more fancy things..
- tnolet 8y ago
  Correct, my old project did not include authentication.
- rzzzt 8y ago
  Kong does handle security in that layer: https://docs.konghq.com/0.14.x/auth/ https://docs.konghq.com/0.14.x/auth/
  - dannyfriar82 8y ago
    im not sure Kong supports mtls or cert pinning. https://github.com/Kong/kong/issues/2048 https://github.com/Kong/kong/issues/2048 i dont think it's able to hash your secret tokens either - rather stores them in plaintext. https://github.com/Kong/kong/issues/1237 https://github.com/Kong/kong/issues/1237 this kind of rules Kong out for any serious applications AFAIK - especially considering that an API Gateway is supposed to be a security product. istio, tyk, traefik support that out of box.
    - fosk 8y ago
      Marco, CTO of Kong here. Static mTLS has been supported since 3 years almost, while dynamic mTLS is being supported with Kong 1.0 (required for Service Mesh). Kong itself has been used in highly regulated industries, including financial, healthcare and governmental (including military branches) institutions. When it comes to enforcing strong security OpenID Connect or JWT authentications are almost always better options. Since Kong is built on top of NGINX, anything NGINX supports by extension Kong also supports + Kong Plugins.
      - dannyfriar82 8y ago
        Thanks for response. Please correct me if I am wrong - I'm making a few deductions / assumptions based on previous research evaluating OS gateways. MTLS & Cert Pinning: It looks like GH is out of date? Could you send me a link to the docs for configuring kong + mtls please? I am sure that kong is deployed in highly regulated industries. Are they using open src version of the product? regardless of whether they are using paid or open src - are they using Kong for user/identity management or a 3rd party service and hooking that in with OIDC? OIDC/JWT: yes i agree that these options are typically a better but that means I need 3rd party IdP to issue tokens, rather than Kong handling user/token mgmt? My understanding is that Kong does not issue JWTs, simply validates the signature? OIDC support to my understanding is only avail in Enterprise version rather than CE version? So that means I need community plugin if I want OIDC - and this community plugin will not be supported by Kong? With JWT - i believe Kong simply validates the signature using the Public Key / Shared Secret. Are these secrets stored encrypted / securely within Kong? If I simply wanted Kong to handle my user mgmt whether basic auth / api key or I had a legacy system which still required support, then I would need to accept the fact that Kong will store credentials such as usernames / passwords in plaintext?
      - geezerjay 8y ago
        > Kong itself has been used in highly regulated industries, Was it used in any application that actually was covered by any regulation enforcing authentication and authorization to the point that kong could directly determine if an implementation does or does not comply with the regulation? Or was it simply used in highly regulated industries like car stickers are used in the highly regulated auto industry?
- KassKrout 8y ago
  You can do this and expand HAProxy capabilities with LUA. For example, authenticating via OAuth was already done by a HAProxy contributor and he detailed this here: https://bl.duesterhus.eu/20180119/ https://bl.duesterhus.eu/20180119/

by tnolet 8y ago

Natsu 8y ago

Am I wrong, or is there still nothing that handles security in the API Gateway? For example, suppose you want to do OAuth in the gateway instead of building it into every API. I couldn't see anything to handle a use case like that. The best I see is that it can probably handle one-way SSL, but I'm not clear on how it would handle mutual authentication or verification of client certs (pinning, CRLs, or OCSP). It's a lot of work to build that into APIs separately and a lot of people who use API Gateways prefer to have the gateway itself handle security.

bedis9 8y ago
This is part of part-2 of our blog post about api gateway with haproxy. It will feature token validation in Lua and much more fancy things..
tnolet 8y ago
Correct, my old project did not include authentication.
rzzzt 8y ago
Kong does handle security in that layer: https://docs.konghq.com/0.14.x/auth/ https://docs.konghq.com/0.14.x/auth/
- dannyfriar82 8y ago
  im not sure Kong supports mtls or cert pinning. https://github.com/Kong/kong/issues/2048 https://github.com/Kong/kong/issues/2048 i dont think it's able to hash your secret tokens either - rather stores them in plaintext. https://github.com/Kong/kong/issues/1237 https://github.com/Kong/kong/issues/1237 this kind of rules Kong out for any serious applications AFAIK - especially considering that an API Gateway is supposed to be a security product. istio, tyk, traefik support that out of box.
  - fosk 8y ago
    Marco, CTO of Kong here. Static mTLS has been supported since 3 years almost, while dynamic mTLS is being supported with Kong 1.0 (required for Service Mesh). Kong itself has been used in highly regulated industries, including financial, healthcare and governmental (including military branches) institutions. When it comes to enforcing strong security OpenID Connect or JWT authentications are almost always better options. Since Kong is built on top of NGINX, anything NGINX supports by extension Kong also supports + Kong Plugins.
    - dannyfriar82 8y ago
      Thanks for response. Please correct me if I am wrong - I'm making a few deductions / assumptions based on previous research evaluating OS gateways. MTLS & Cert Pinning: It looks like GH is out of date? Could you send me a link to the docs for configuring kong + mtls please? I am sure that kong is deployed in highly regulated industries. Are they using open src version of the product? regardless of whether they are using paid or open src - are they using Kong for user/identity management or a 3rd party service and hooking that in with OIDC? OIDC/JWT: yes i agree that these options are typically a better but that means I need 3rd party IdP to issue tokens, rather than Kong handling user/token mgmt? My understanding is that Kong does not issue JWTs, simply validates the signature? OIDC support to my understanding is only avail in Enterprise version rather than CE version? So that means I need community plugin if I want OIDC - and this community plugin will not be supported by Kong? With JWT - i believe Kong simply validates the signature using the Public Key / Shared Secret. Are these secrets stored encrypted / securely within Kong? If I simply wanted Kong to handle my user mgmt whether basic auth / api key or I had a legacy system which still required support, then I would need to accept the fact that Kong will store credentials such as usernames / passwords in plaintext?
    - geezerjay 8y ago
      > Kong itself has been used in highly regulated industries, Was it used in any application that actually was covered by any regulation enforcing authentication and authorization to the point that kong could directly determine if an implementation does or does not comply with the regulation? Or was it simply used in highly regulated industries like car stickers are used in the highly regulated auto industry?
KassKrout 8y ago
You can do this and expand HAProxy capabilities with LUA. For example, authenticating via OAuth was already done by a HAProxy contributor and he detailed this here: https://bl.duesterhus.eu/20180119/ https://bl.duesterhus.eu/20180119/