Kong Gateway - 11 基于网关服务的ACL访问控制列表黑名单

同一服务名称 book 不允许即创建白名单访问控制列表又创建黑名单访问控制列表

启用服务的白名单&黑名单配置文件时，它们俩是不允许同时定义的，我们应该树立这样一种认知不在黑名单中即使没定义白名单，我们也把黑名单之外的所有用户归类为白名单用户

故ACL必须分两篇来发布，本范例中使用了

Kong Gateway - 01 基于网关服务的基本验证（Basic Authentication）

9种验证方式当中的1种方式而已，我们当然可以用剩余的8种验证方式之一来取代basic-auth，强调一点的是ACL必须与9种验证结合使用，不然book服务我们将不能消费访问它

用Kong配置一个book服务
在安装并启动Kong之后，使用Kong的管理API端口8001添加一个名称为book的服务
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/services/ \
--data 'name=book' \
--data 'url=http://contoso.com/v1/books'

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 02:30:31 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.

{
    "host": "contoso.com", 
    "created_at": 1525890631, 
    "connect_timeout": 60000, 
    "id": "dca12a5d-10c4-4bf9-8a49-500c3935cae5", 
    "protocol": "http", 
    "name": "book", 
    "read_timeout": 60000, 
    "port": 80, 
    "path": "/v1/books", 
    "updated_at": 1525890631, 
    "retries": 5, 
    "write_timeout": 60000
}


添加一个路由（paths[]的值必须与book服务中的/v1/books一致）
使book服务暴露出来以供用户访问，book服务没必要添加多个路由。
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/services/book/routes \
--data 'hosts[]=contoso.com' \
--data 'paths[]=/v1/books'

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 02:30:49 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525890649, 
    "strip_path": true, 
    "hosts": [
        "contoso.com"
    ], 
    "preserve_host": false, 
    "regex_priority": 0, 
    "updated_at": 1525890649, 
    "paths": [
        "/v1/books"
    ], 
    "service": {
        "id": "dca12a5d-10c4-4bf9-8a49-500c3935cae5"
    }, 
    "methods": null, 
    "protocols": [
        "http", 
        "https"
    ], 
    "id": "80569820-4d8c-4565-9c3c-b5e0475b0122"    // {route_id} = id
}


[[email protected] ~]# curl -i -X GET \
--url http://localhost:8000/v1/books \
--header 'Host: contoso.com'

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 244
Connection: keep-alive
Date: Thu, 10 May 2018 02:35:04 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 100
X-Kong-Proxy-Latency: 34
Via: kong/0.13.1

[
    {
        "id": 1, 
        "title": "Fashion That Changed the World", 
        "author": "Jennifer Croll"
    }, 
    {
        "id": 2, 
        "title": "Brigitte Bardot - My Life in Fashion", 
        "author": "Henry-Jean Servat and Brigitte Bardot"
    }, 
    {
        "id": 3, 
        "title": "The Fashion Image", 
        "author": "Thomas Werner"
    }
]


[[email protected] ~]# curl -i -X GET \
--url http://localhost:8001/services/book/routes

HTTP/1.1 200 OK
Date: Thu, 10 May 2018 02:35:38 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "next": null, 
    "data": [
        {
            "created_at": 1525890649, 
            "strip_path": true, 
            "hosts": [
                "contoso.com"
            ], 
            "preserve_host": false, 
            "regex_priority": 0, 
            "updated_at": 1525890649, 
            "paths": [
                "/v1/books"
            ], 
            "service": {
                "id": "dca12a5d-10c4-4bf9-8a49-500c3935cae5"
            }, 
            "methods": null, 
            "protocols": [
                "http", 
                "https"
            ], 
            "id": "80569820-4d8c-4565-9c3c-b5e0475b0122"    // {route_id} = id
        }
    ]
}


--------------------------------------------------------------------------------

为book服务的路由{route_id}启动Basic验证插件
URL格式：http://localhost:8001/routes/{route_id}/plugins
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/routes/80569820-4d8c-4565-9c3c-b5e0475b0122/plugins \
--data "name=basic-auth"  \
--data "config.hide_credentials=true"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 02:39:15 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525919954000, 
    "config": {
        "hide_credentials": true, 
        "anonymous": ""
    }, 
    "id": "1e8c30f2-282f-4401-8258-6e5dac2a6b54", 
    "enabled": true, 
    "route_id": "80569820-4d8c-4565-9c3c-b5e0475b0122", 
    "name": "basic-auth"
}


========================================================================================= 

添加第1个username为jack的消费者，{custom_id}参数可省略，此参数是个自定义唯一标识，
它作用是把消费者jack映射到另外一个数据库上
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/consumers/  \
--data "username=jack"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 02:41:40 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525920101000, 
    "username": "jack", 
    "id": "14af98df-237a-4555-bc00-580db0b26032"
}


为第1个用户jack启用Basic验证插件
URL格式：http://localhost:8001/consumers/{username or consumer_id}/basic-auth
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/consumers/jack/basic-auth \
--data "[email protected]" \
--data "password=123456"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 02:43:00 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525920181000, 
    "id": "cbb0c2b4-cb85-4899-995a-6681cfdb400f", 
    "username": "[email protected]", 
    "password": "349cc2755232a4746d2973f3bcb87b1d3fa7be55", 
    "consumer_id": "14af98df-237a-4555-bc00-580db0b26032"
}


在线base64编码工具http://tool.oschina.net/encrypt?type=3
键-值对{username:password}字符串
[email protected]:123456 左边的键-值对字符串BASE64编码结果为：
amFja0Bob3RtYWlsLmNvbToxMjM0NTY=
使用用户jack的Basic验证方式访问书籍数据接口
[[email protected] ~]# curl -i -X GET \
--url http://localhost:8000/v1/books/1 \
--header "Authorization: Basic amFja0Bob3RtYWlsLmNvbToxMjM0NTY=" \
--header 'Host: contoso.com'

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 77
Connection: keep-alive
Date: Thu, 10 May 2018 02:44:51 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 51
X-Kong-Proxy-Latency: 45
Via: kong/0.13.1

[{"id":1,"title":"Fashion That Changed the World","author":"Jennifer Croll"}]

=========================================================================================

添加第2个username为john的消费者，{custom_id}参数可省略，此参数是个自定义唯一标识，
它作用是把消费者john映射到另外一个数据库上
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/consumers/  \
--data "username=john" \
--data "custom_id=abc12345"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 02:47:29 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "custom_id": "abc12345", 
    "created_at": 1525920449000, 
    "username": "john", 
    "id": "73f0a0b2-1bf0-45fa-adbf-36b7fcde0929"
}


为第2个用户john启用Basic验证插件
URL格式：http://localhost:8001/consumers/{username or consumer_id}/basic-auth
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/consumers/john/basic-auth \
--data "[email protected]" \
--data "password=123456"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 02:48:54 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525920535000, 
    "id": "491a39df-d90a-4f42-933e-24662cfbac07", 
    "username": "[email protected]", 
    "password": "b80b4aedd1a25a9803859f07b836f518541ab81e", 
    "consumer_id": "73f0a0b2-1bf0-45fa-adbf-36b7fcde0929"
}


在线base64编码工具http://tool.oschina.net/encrypt?type=3
键-值对{username:password}字符串
[email protected]:123456 左边的键-值对字符串BASE64编码结果为：
am9obkBob3RtYWlsLmNvbToxMjM0NTY=
使用用户john的Basic验证方式访问书籍数据接口
[[email protected] ~]# curl -i -X GET \
--url http://localhost:8000/v1/books/2 \
--header "Authorization: Basic am9obkBob3RtYWlsLmNvbToxMjM0NTY=" \
--header 'Host: contoso.com'

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 106
Connection: keep-alive
Date: Thu, 10 May 2018 02:50:35 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 25
X-Kong-Proxy-Latency: 40
Via: kong/0.13.1

[{"id":2,"title":"Brigitte Bardot - My Life in Fashion","author":"Henry-Jean Servat and Brigitte Bardot"}]

=========================================================================================

添加第3个username为cathy的消费者，{custom_id}参数可省略，此参数是个自定义唯一标识，
它作用是把消费者cathy映射到另外一个数据库上
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/consumers/  \
--data "username=cathy"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 02:52:07 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{"created_at":1525920728000,"username":"cathy","id":"3fdb9381-d7fd-4f1c-a7ce-f4ea86d9aae2"}


为第3个用户cathy启用Basic验证插件
URL格式：http://localhost:8001/consumers/{username or consumer_id}/basic-auth
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/consumers/cathy/basic-auth \
--data "[email protected]" \
--data "password=123456"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 02:52:28 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525920748000, 
    "id": "cca66a54-ed18-458f-8c7c-73ea935eecd9", 
    "username": "[email protected]", 
    "password": "6cfa32217d05a53174453837799bf8f6a9a03aac", 
    "consumer_id": "3fdb9381-d7fd-4f1c-a7ce-f4ea86d9aae2"
}


在线base64编码工具http://tool.oschina.net/encrypt?type=3
键-值对{username:password}字符串
[email protected]:123456 左边的键-值对字符串BASE64编码结果为：
Y2F0aHlAaG90bWFpbC5jb206MTIzNDU2
使用用户cathy的Basic验证方式访问书籍数据接口
[[email protected] ~]# curl -i -X GET \
--url http://localhost:8000/v1/books/3 \
--header "Authorization: Basic Y2F0aHlAaG90bWFpbC5jb206MTIzNDU2" \
--header 'Host: contoso.com'

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 63
Connection: keep-alive
Date: Thu, 10 May 2018 02:53:26 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 38
X-Kong-Proxy-Latency: 31
Via: kong/0.13.1

[{"id":3,"title":"The Fashion Image","author":"Thomas Werner"}]

*****************************************************************************************


为book服务启用ACL访问控制列表插件，并且定义黑名单group3和group4
URL格式：http://localhost:8001/services/{service}/plugins
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/services/book/plugins \
--data "name=acl"  \
--data "config.blacklist=group3, group4"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 03:03:15 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525921395000, 
    "config": {
        "blacklist": [
            "group3", 
            "group4"
        ]
    }, 
    "id": "edcf403d-9bf4-46ae-84f3-cfccc34d56f1", 
    "enabled": true, 
    "service_id": "dca12a5d-10c4-4bf9-8a49-500c3935cae5", 
    "name": "acl"
}


为book服务的路由{route_id}启动ACL访问控制列表插件，并且定义黑名单group3和group4
URL格式：http://localhost:8001/routes/{route_id}/plugins 
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/routes/80569820-4d8c-4565-9c3c-b5e0475b0122/plugins \
--data "name=acl"  \
--data "config.blacklist=group3, group4"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 03:05:53 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "created_at": 1525921551000, 
    "config": {
        "blacklist": [
            "group3", 
            "group4"
        ]
    }, 
    "id": "ae051c27-340c-4e20-a440-9e32721a2a6d", 
    "enabled": true, 
    "route_id": "80569820-4d8c-4565-9c3c-b5e0475b0122", 
    "name": "acl"
}

即使建立黑名单列表group3和group4，只要没把用户jack、john和cathy任何一个人关联到黑名单group3或者黑名单group4
那么以下命令依然可以访问book服务：

curl -i -X GET \
--url http://localhost:8000/v1/books/1 \
--header "Authorization: Basic amFja0Bob3RtYWlsLmNvbToxMjM0NTY=" \
--header 'Host: contoso.com'


curl -i -X GET \
--url http://localhost:8000/v1/books/2 \
--header "Authorization: Basic am9obkBob3RtYWlsLmNvbToxMjM0NTY=" \
--header 'Host: contoso.com'


curl -i -X GET \
--url http://localhost:8000/v1/books/3 \
--header "Authorization: Basic Y2F0aHlAaG90bWFpbC5jb206MTIzNDU2" \
--header 'Host: contoso.com'


我们如何把不按照我们业务规则或者带攻击性的用户加入黑名单？
答：我们现在可以使用以下命令将黑名单组group4关联到消费者jack：
URL格式：http://localhost:8001/consumers/{consumer_id or username}/acls
[[email protected] ~]# curl -i -X POST \
--url http://localhost:8001/consumers/jack/acls \
--data "group=group4"

HTTP/1.1 201 Created
Date: Thu, 10 May 2018 03:17:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{
    "group": "group4", 
    "created_at": 1525922278000, 
    "id": "bf3d30cc-67c5-4b05-b6bf-7a75f551aa64", 
    "consumer_id": "14af98df-237a-4555-bc00-580db0b26032"
}


以下命令执行结果表明：加入白名单的用户jack有权访问书籍数据接口
在线base64编码工具http://tool.oschina.net/encrypt?type=3
键-值对{username:password}字符串
[email protected]:123456 左边的键-值对字符串BASE64编码结果为：
amFja0Bob3RtYWlsLmNvbToxMjM0NTY=
使用用户jack的Basic验证方式访问书籍数据接口
[[email protected] ~]# curl -i -X GET \
--url http://localhost:8000/v1/books/1 \
--header "Authorization: Basic amFja0Bob3RtYWlsLmNvbToxMjM0NTY=" \
--header 'Host: contoso.com'

HTTP/1.1 403 Forbidden
Date: Thu, 10 May 2018 03:19:39 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: kong/0.13.1

{"message":"You cannot consume this service"}

没有加入黑名单的用户john依然可以访问book服务
以下命令执行结果表明：即没有加入白名单也没有加入黑名单用户组的用户无权访问书籍数据接口
键-值对{username:password}字符串
[email protected]:123456 左边的键-值对字符串BASE64编码结果为：
am9obkBob3RtYWlsLmNvbToxMjM0NTY=
使用用户john的Basic验证方式访问书籍数据接口
[[email protected] ~]# curl -i -X GET \
--url http://localhost:8000/v1/books/2 \
--header "Authorization: Basic am9obkBob3RtYWlsLmNvbToxMjM0NTY=" \
--header 'Host: contoso.com'

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 106
Connection: keep-alive
Date: Thu, 10 May 2018 03:22:35 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 23
X-Kong-Proxy-Latency: 0
Via: kong/0.13.1

[{"id":2,"title":"Brigitte Bardot - My Life in Fashion","author":"Henry-Jean Servat and Brigitte Bardot"}]


没有加入黑名单的用户cathy依然可以访问book服务
以下命令执行结果表明：即没有加入白名单也没有加入黑名单用户组的用户无权访问书籍数据接口
键-值对{username:password}字符串
[email protected]:123456 左边的键-值对字符串BASE64编码结果为：
Y2F0aHlAaG90bWFpbC5jb206MTIzNDU2
使用用户cathy的Basic验证方式访问书籍数据接口
[[email protected] ~]# curl -i -X GET \
--url http://localhost:8000/v1/books/3 \
--header "Authorization: Basic Y2F0aHlAaG90bWFpbC5jb206MTIzNDU2" \
--header 'Host: contoso.com'

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 63
Connection: keep-alive
Date: Thu, 10 May 2018 03:23:02 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 25
X-Kong-Proxy-Latency: 0
Via: kong/0.13.1

[{"id":3,"title":"The Fashion Image","author":"Thomas Werner"}]


如何使用命令将黑名单组group4到消费者jack的关联取消 ------ 删掉用户与黑名单之间关联让用户继续能够访问book服务
[[email protected] ~]# curl -i -X GET http://localhost:8001/consumers/jack/acls
HTTP/1.1 200 OK
Date: Thu, 10 May 2018 03:24:50 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{"total":1,"data":[{"group":"group4","created_at":1525922278000,"id":"bf3d30cc-67c5-4b05-b6bf-7a75f551aa64","consumer_id":"14af98df-237a-4555-bc00-580db0b26032"}]}
[[email protected] ~]# curl -i -X GET http://localhost:8001/consumers/jack/acls/bf3d30cc-67c5-4b05-b6bf-7a75f551aa64
HTTP/1.1 200 OK
Date: Thu, 10 May 2018 03:25:48 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1

{"group":"group4","created_at":1525922278000,"id":"bf3d30cc-67c5-4b05-b6bf-7a75f551aa64","consumer_id":"14af98df-237a-4555-bc00-580db0b26032"}
[[email protected] ~]# curl -i -X DELETE http://localhost:8001/consumers/jack/acls/bf3d30cc-67c5-4b05-b6bf-7a75f551aa64
HTTP/1.1 204 No Content
Date: Thu, 10 May 2018 03:26:00 GMT
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.13.1
// 此处虽然没有删除成功的提示,但确实已经删掉用户与黑名单之间关联
[[email protected] ~]# 
[[email protected] ~]# curl -i -X GET \
--url http://localhost:8000/v1/books/1 \
--header "Authorization: Basic amFja0Bob3RtYWlsLmNvbToxMjM0NTY=" \
--header 'Host: contoso.com'

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 77
Connection: keep-alive
Date: Thu, 10 May 2018 03:29:46 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.13
X-Powered-By: PHP/7.1.13
X-Kong-Upstream-Latency: 23
X-Kong-Proxy-Latency: 5
Via: kong/0.13.1

[{"id":1,"title":"Fashion That Changed the World","author":"Jennifer Croll"}]

// 本来关联存黑名单存在时jack是不允许访问book服务的，现在变成了又可以继续访问book这个服务了，即恢复用户的合法访问身份
[[email protected] ~]# 

*****************************************************************************************

备注：以下方式虽然能让同1个服务同1个用户同时关联白名单和黑名单但这么干违背官网定义黑名单与白名单不能同时在配置文件里定义的原则，故不建议向下面这么做（假如首先定义了白名单group1和group2）：

[[email protected] ~]# curl http://localhost:8001/plugins/93419daf-ec5f-455a-8404-e0105f3c540f

[[email protected] ~]# curl -i -X PATCH \

--url http://localhost:8001/plugins/93419daf-ec5f-455a-8404-e0105f3c540f \

--data "config.blacklist=group3, group4"

HTTP/1.1 200 OK

Date: Wed, 09 May 2018 15:28:05 GMT

Content-Type: application/json; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/0.13.1

{

"created_at": 1525795744000,

"config": {

"blacklist": [

"group3",

"group4"

"whitelist": [

"group1",

"group2"

]

"id": "93419daf-ec5f-455a-8404-e0105f3c540f",

"enabled": true,

"service_id": "e55beddd-a9f1-4865-94ae-1b2e2bf4e6d5",

"name": "acl"

}

[[email protected] ~]# curl http://localhost:8001/plugins/da001489-1e0e-4235-b32d-624dfe9e5518

[[email protected] ~]# curl -i -X PATCH \

--url http://localhost:8001/plugins/da001489-1e0e-4235-b32d-624dfe9e5518 \

--data "config.blacklist=group3, group4"

HTTP/1.1 200 OK

Date: Wed, 09 May 2018 15:30:11 GMT

Content-Type: application/json; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/0.13.1

{

"created_at": 1525795992000,

"config": {

"blacklist": [

"group3",

"group4"

"whitelist": [

"group1",

"group2"

]

"id": "da001489-1e0e-4235-b32d-624dfe9e5518",

"enabled": true,

"route_id": "cbcb0d5f-e95a-4114-8aa0-3f77283cc980",

"name": "acl"

}

现在可以使用以下命令将黑名单组group3关联到消费者jack：

[[email protected] ~]# curl -i -X POST \

--url http://localhost:8001/consumers/jack/acls \

--data "group=group3"

HTTP/1.1 201 Created

Date: Wed, 09 May 2018 15:41:37 GMT

Content-Type: application/json; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/0.13.1

{

"group": "group3",

"created_at": 1525880497000,

"id": "4af05fd8-816e-4151-b0fe-77300af200a4",

"consumer_id": "d81de922-1dab-4ec4-9a7c-91403b6b1d51"

}

[[email protected] ~]# curl -i -X GET http://localhost:8001/consumers/jack/acls

HTTP/1.1 200 OK

Date: Wed, 09 May 2018 16:06:21 GMT

Content-Type: application/json; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/0.13.1

{

"total": 2,

"data": [

{

"group": "group1", // 白名单组

"created_at": 1525797101000,

"id": "b2534048-7f56-440b-87c0-da56e90590df",

"consumer_id": "d81de922-1dab-4ec4-9a7c-91403b6b1d51"

{

"group": "group3", // 黑名单组

"created_at": 1525880497000,

"id": "4af05fd8-816e-4151-b0fe-77300af200a4",

"consumer_id": "d81de922-1dab-4ec4-9a7c-91403b6b1d51"

}

]

}

当用户jack即关联到白名单又关联到黑名单时,那么用户jack就不能消费book服务

[[email protected] ~]# curl -i -X GET \

--url http://localhost:8000/v1/books/3 \

--header "Authorization: Basic amFja0Bob3RtYWlsLmNvbToxMjM0NTY=" \

--header 'Host: contoso.com'

HTTP/1.1 403 Forbidden

Date: Wed, 09 May 2018 15:44:56 GMT

Content-Type: application/json; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Server: kong/0.13.1

{"message":"You cannot consume this service"}

Kong Gateway - 11 基于网关服务的ACL访问控制列表黑名单

Kong Gateway - 01 基于网关服务的基本验证（Basic Authentication）

继续阅读

Linux的ACL权限

微服务网关的总结和实践

sqlserver打开或创建mdf失败

ClusterStorage-236-4-客户端配置挂载与授权控制（ACL&Quota）

ClusterStorage-5-配置ACLs与Quotas实验

ACL2020 | SongNet(格式可控的文本生成)背景方法实验总结

万字长文让你掌握网络问题排查技巧！

VRRP和ACL一、VRRP（虚拟路由器冗余协议）二、ACL（访问控制列表）

微服务网关有哪些？NetflixZuul：Netflix开源的微服务网关，用于动态路由、负载均衡、安全认证等功能。Spr

ACL 访问控制列表 (理论一)

【zookeeper】zookeeper基础知识《ACL》

Linux系统之高级用户组和权限管理一、用户的密码策略设置二、监控系统用户登录三、用户的提权四、ACL权限配置五、文件与目录的特殊权限六、默认权限与反掩码

笔记－CCNA与网络安全第8章网络安全网络安全包括的层面网络层安全常见的安全威胁路由器上的安全

软考高项记忆小妙招—案例计算、每日英文16

什么？Zookeeper | ACL权限控制

S5700的ACL访问控制列表及实验

Kong Gateway - 11 基于网关服务的ACL访问控制列表 黑名单

Kong Gateway - 01 基于网关服务的基本验证（Basic Authentication）

继续阅读

Kong Gateway - 11 基于网关服务的ACL访问控制列表黑名单