solo-io / gloo

The Feature-rich, Kubernetes-native, Next-Generation API Gateway Built on Envoy
https://docs.solo.io/
Apache License 2.0
4.07k stars 436 forks source link

Ability to have the passthrough auth generated headers show up in the API GW event's "requestContext.authorizer" #9863

Open htech7x opened 1 month ago

htech7x commented 1 month ago

Gloo Edge Product

Enterprise

Gloo Edge Version

1.16.7

Is your feature request related to a problem? Please describe.

Lambda authorizer generates headers and puts them in the authorizer context for the overall API GW event object. For example, a Go lambda might reference one of them like this:

func handleRequest(_ context.Context, request events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {
    roles := request.RequestContext.Authorizer["roles"]
    ...
}

where the AWS API Gateway event might look something like this:

{
  "resource": "/hello/{name}",
  "path": "/hello/Alex",
  ...
  "requestContext": {
    ...
    "authorizer": {
      ...
      "roles": "[\"EXAMPLE_ROLE\"]"
    },
    ...
  },
  "body": ""
}

When going through Gloo with "wrapAsApiGateway: true" and using an AuthConfig with a passthrough service (followed this doc), Gloo-wrapped event equivalent looked more like this:

{
    "resource": "/v1/hello/Alex",
    "path": "/v1/hello/Alex",
    "httpMethod": "GET",
    "headers": {
        ":authority": "auth.test.com",
        ":method": "GET",
        ":path": "/v1/lambda/Alex",
        ":scheme": "https",
        "accept": "*/*",
        "accept-encoding": "gzip, deflate, br",
        ...
        "roles": "[\"EXAMPLE_ROLE\"]",
        ...
    },
    ...
    "requestContext": {
        ...
        "authorizer": null,
        ...
    },
    "body": ""
}

Thus, need to be able to have headers generated by passthrough auth in the "requestContext.authorizer" object of the API GW event

Describe the solution you'd like

No response

Describe alternatives you've considered

No response

Additional Context

No response

soloio-bot commented 1 month ago

Zendesk ticket #4240 has been linked to this issue.