k8sgateway / k8sgateway

The Cloud-Native API Gateway and AI Gateway
https://k8sgateway.io/
Apache License 2.0
4.12k stars 449 forks source link

Ability to have the passthrough auth generated headers show up in the API GW event's "requestContext.authorizer" #9863

Open htech7x opened 3 months ago

htech7x commented 3 months ago

Gloo Edge Product

Enterprise

Gloo Edge Version

1.16.7

Is your feature request related to a problem? Please describe.

Lambda authorizer generates headers and puts them in the authorizer context for the overall API GW event object. For example, a Go lambda might reference one of them like this:

func handleRequest(_ context.Context, request events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {
    roles := request.RequestContext.Authorizer["roles"]
    ...
}

where the AWS API Gateway event might look something like this:

{
  "resource": "/hello/{name}",
  "path": "/hello/Alex",
  ...
  "requestContext": {
    ...
    "authorizer": {
      ...
      "roles": "[\"EXAMPLE_ROLE\"]"
    },
    ...
  },
  "body": ""
}

When going through Gloo with "wrapAsApiGateway: true" and using an AuthConfig with a passthrough service (followed this doc), Gloo-wrapped event equivalent looked more like this:

{
    "resource": "/v1/hello/Alex",
    "path": "/v1/hello/Alex",
    "httpMethod": "GET",
    "headers": {
        ":authority": "auth.test.com",
        ":method": "GET",
        ":path": "/v1/lambda/Alex",
        ":scheme": "https",
        "accept": "*/*",
        "accept-encoding": "gzip, deflate, br",
        ...
        "roles": "[\"EXAMPLE_ROLE\"]",
        ...
    },
    ...
    "requestContext": {
        ...
        "authorizer": null,
        ...
    },
    "body": ""
}

Thus, need to be able to have headers generated by passthrough auth in the "requestContext.authorizer" object of the API GW event

Describe the solution you'd like

No response

Describe alternatives you've considered

No response

Additional Context

No response

soloio-bot commented 3 months ago

Zendesk ticket #4240 has been linked to this issue.