Kong Kong Builders Livestream Recordings, 31 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: GraphQL Authorization with Konnect, OPA and OIDC

Description

🚀 Join us live to learn about how to implement authentication and authorization for GraphQL APIs using OIDC and OPA with Konnect! 🤝

This tutorial focuses on the solution that can solve for the Authentication and Authorization concerns at the gateway layer. We'll first authenticate users, and if authenticated, then the user’s fine-grain permissions will be evaluated to determine if the user has permission to run the incoming GraphQL request (whether the request is nested or using query variables).

📌 In this tutorial, you'll learn:

🔑 How to implement authentication and authorization for GraphQL APIs using OIDC and OPA with Konnect.

🐳 How to create Docker containers for Keycloak, OPA, and Kong.

🔧 How to configure keycloak, OPA, and Konnect.

📈 How to test OPA behavior.

Join us and get started by cloning the repository and following the steps!

Can't wait to see you there!

A

A

A

What is happening internet welcome, to conch, welcome to conch uh and uh if you're watching us, if you see us, uh meaning that you either on the YouTube channel or in the Quan uh LinkedIn stream, or maybe some other places like a twitch, or maybe uh my personal YouTube channel, which I also use to restream this, because the more the merrier more content um and more people will see it. So who am I? My name is Victor. Gamof and I will be your host today, Kong Builders, it's our regular show.

A

uh We like to follow some sort of cadence. uh Usually it was weekly bi-weekly, but it is Regular Show. It is Regular Show, where we're gonna, building different stuff using Quantum, Technologies and um I'm super excited uh that I'm not gonna, be alone. Today and uh I will have my friend and colleague.

A

Let me switch the screen, Danny, also known as a Danny from partner engineering. You probably see her in some of other videos. Danny welcome to con builders.

B

Hey thanks for having me I'm Danny I'm on the partner engineering team and I have been building. You may be familiar with me. I've been building some content out this year on integrating with some of our key technology Partners, so there's some API setups tutorials and using mesh for a cloud migration Journey. So thanks for having me Vic.

A

Please, dear people who are watching our stream, let us know where you're coming from where um like, if it's a LinkedIn YouTube, just like write, something in the comments. Let's make some noise and make sure that the sound is great I hear Danny perfectly I see Danny also perfectly, uh and also we can you calculate while we're waiting for the for the comments we can geek out about the our the mechanical keyboards. That's what I hear Dan is using what kind of mechanical keyboard are you using Danny.

B

I have a ketron yeah.

A

B

Yeah yeah kitchen.

A

The um key three that's mine.

B

Yeah I won the number pad, so I got the I got the compact one, but it's a little bigger. It's got the number pad it's about the same, though.

A

I don't have like uh the numpad I, don't know like some people love to have it um mind Q3. It is a kind of like a low profile, so I can just like probably faster.

A

um So let's take a look. If we do have any uh any comments in our in our stream, so I, don't I, don't see anything right now so people, uh let's uh let's make some noise and tell us if you, um if you can hear us in kien, hear us.

A

Okay, let's see LinkedIn all right, we have connection all right, so we also have some keychron users. That's great.

A

John is asking where's this stream deck yeah, so stream deck is connected over here. So I cannot. I cannot show my thing and.

C

I also have some others.

A

Yeah I have a stream deck that uh the new one with the you know, knobs and stuff so um but I didn't have a time to to install it. So great, at least we have a few people. A few people join.

D

Us there that's awesome to.

A

See, oh merge, hey uh one of our Quan Champion smart simsec uh hi for coming in all right. uh It's great that the people joining in detailing where they're coming from in terms of like what platform but I was talking about like a physical location. What's the uh what's, the city or I, don't know state or country at least you know we want to know uh people I see that you're coming from LinkedIn, because I see this small icon um that says you're coming from LinkedIn.

A

Tell me: where is physically you're located so I'm coming to you at the sunny New Jersey these days and uh Danny, also somewhere on the East Coast.

B

Yeah I'm in North Carolina. If anyone is familiar with North Carolina.

A

uh While we're waiting some of the comments, uh let me actually talk a little bit about some house keeping items so, first of all, the important thing is that uh if you own the Computing travel, please uh subscribe to our YouTube channel or if you're not uh make sure that your button looks something like this. So I have enabled a notification, so I will not miss any streams and I'm subscribed. I would really appreciate- and Danny also will appreciate this, because she posts some of the videos regularly.

A

Speaking about Danish content like if you go to Quran blog, you can find multiple cool uh partnering Integrations uh with the different technology providers like a red hat like AWS um and some other things so Danny. You can talk a little bit about the stuff that you do at the partner engineering. Maybe people would be. You know interesting more about this stuff people know everything about like devrel. Now. What do you do at the partner engineering.

B

Yeah, it's really Niche interesting uh field, but it's actually sometimes a little bit of a mix of devrel, but the first thing we got to do is we got to integrate with our cloud and key technology Partners meeting. If we need to be certified in AWS, we may do that certification.

B

If we need a openshift certification, we may go ahead and do that and then once we've done it, we kind of circle back and start the kind of like the enablement and figure like letting the community know how to use those new Integrations or how to use those new certifications out there. So you can keep you know moving along with whatever you're doing so that's a lot of what we do.

B

It's a lot of fun because it's really busy right, sometimes you're coding, sometimes you're, writing and sometimes you're we're I'm on the Kong Builders Channel, with Vic.

A

So what I like to uh to say about uh the the partnering stuff Endeavor, where we are very similar, we're trying to build this kind of integration with devrel? It's not uh it's less formal right and less structural with the uh with partner engineering, it's kind of like official certification, sometimes customers, they kind of okay. What's your official stand on supporting lws and where's, the Danny and his her team comes into play.

D

A

Hey yep, that's like we're certified, there's a paper, so we can roll. We can enroll with this, um so I just saw like we have a people from France from Bay Area from Egypt uh from Istanbul. So that's a great geography to um to talk about this great uh keep them coming all right, Danny. What we're going to be building today so I noticed that you didn't um uh you're, not sharing your screen. uh Could you share your screen with me, so we can bring your um your screen into the Stream.

B

Yes, that's a good point. Let me do that where, where is it? Let me find it okay. So what we've got for you today is.

A

You're not sharing again that's.

B

B

A

B

Screen now, yeah.

A

So I can, let's see if we will be able to share it. Okay, perfect, we can see it um and if you can make it a little bit bigger, so um people can also see uh what you sharing on this on the screen. So uh people, let me know if you, uh if it's big enough for you to see this, um this awesome diagram um I, would I would go a little bit uh bigger if I.

D

See if we can make it bigger, yeah, yeah I had it's all set up and then yeah.

A

You don't have to you, don't have to do like a presentation mod. You can just go Um on your on your screen and uh just make it bigger.

B

Let me see if I can make it bigger, I think it's about as big I can go. It's kind of stuck in that size. Okay,.

C

B

Guys I know it's a little small, but what we're going to be doing today is we want to talk about graphql, API authorization, and the reason being is that we've got a lot of customers that they're starting to build out their graphql apis, but they've also got rest and grpc going all at the same time, so they kind of want to have a standard solution for protecting all these apis and Kong can kind of help. You do that, so the story is going to be we're going to focus on there's a.

A

B

With Greco yeah.

A

I have a I have a question like before we jump into this one like what um what makes us what makes it um unique so because the graphql runs on top of HTTP like what's the you know, what's the first, what's the big deal we just put, the whatever coin does for years like API authorization, Plug-In or like uh oigc plugin things like that white? Is you know something special about this.

B

Graph yeah, that's a fair question, so I think a lot of us are really familiar with securing and building Access Control policies for rest right, but that object when you're. Looking at it's pretty static. It's just a here is the Json object that I will accept and then it's very easy to build uh disassemble and build Access Control policies. But what is the? What is the Paradigm with graphql?

B

We now want to take all of our rest apis, all of them batch them into one massive Nest data tree structure and now- and you know, expose that to our front-end clients right, whether it be uh web or mobile whatever, and that so we've just taken all the data. We put it into a massive data tree structure. So how are we supposed to secure it? That's kind of the issue that the community is facing working.

A

B

Now yeah think.

A

Think about this, when you're doing the rest stuff, you can have a security on top on particular routes or on top of particular HTTP methods and things like that, but with graphql you're kind of limiting around like one endpoint and one, it should be method and only based on the requests that you have in the type of request. If it's a query or it's a mutation, you need to be what to say like a little bit more aware what is going on in this like a pipeline.

A

So in this case the the security aspect would be um important.

D

A

To know all this kind of like what is going on all over the wire right so so for that matter, graphql is, is much more closer to like RPC protocols right. So in this case it's going to be in one endpoint and we need to do something with some point.

B

Yeah, because the most important is that we've shoved everything that we've distributed across multiple apis into into one one API exactly one master, doodle yeah.

A

Okay, so, um and uh what are moving parts of this, our um stream today, so.

B

Yeah, so con connect we're just going to use that as a control plane and to you know to deploy our data plane for the Gateway, and then we do want to showcase how to use um oidc, in this case, we'll just to identify the user. So we'll have an IDP it'll be key cloak in this case, just because it's easy to deploy but really I'd any IDP works, and then the third is Opa is really going to be the star here: open policy agent. It's a cncf project.

B

That kind of lets you build out decisions and to interact with whether that decision should you know pass through. So we can build authorization with that. Guy.

A

So, as you can see on this uh in this picture, so we have a like a request that will come in. uh We will hit the oidc provider key clock um and you know, and after that we will apply some additional policies in order to see if it's a user eligible to get the date or not.

B

Yeah, because what Opa will do so we'll issue the jot an API consumer hits the Gateway the oidc by default is gonna plug in it's going to be hit first, so we're gonna uh we're gonna key, close gonna issue that jot and then it goes down to Opa and we take that request and your jot if we send it over to the OPA engine. It's going to execute your authorization uh policy to assess if your request and yeah is good or about is, is, can pass or not, and then.

D

B

It has that decision returns it back and then decides. If you can go hit your back end or Upstream service.

A

Fantastic, so so we will switching to different I guess we, you know different screen to to start building, but I have a question for our audience.

A

um How many of you actually using graphql today and uh what's your you know, strategy of protecting um your um your graphql server in the other question that I also might have, and if you have an answer, uh if you want the stream write us down this in the chat, if you are watching this afterwards as a recording write down in comments, um how common is to host your own oidc provider like, in this case, key clock, we're going to be using or using some managed solution?

A

I, don't know OCTA Azure, active director or something like that. So that's my question to you.

A

Hopefully we will generate some of the responses um and we're not going to wait for for those responses we're going to be switching to to actual to actual demo.

A

um So as far as understand, then we're going to be using um Quant connect and we're going to be using.

C

A

We're going to deploy our data plane, the most important question.

B

We're going to use eks to deploy the data plan today, yeah so who's driving. Are you driving or am I driving? No.

A

You're driving so you're driving, okay.

D

A

Have you have uh I did I, did the check before um before the stream and I don't have a account with ec2, so I need to go and update my credentials.

B

Okay, so what we've got today.

B

It hadn't done the bulk of the leg work because I thought you were gonna, do it but I'll do it. So what we're going to do first is start over um I've already got it. I've already got eks up and running because that takes you know 15 minutes and then what I've just got is just kubernetes manifest to actually logged in.

B

Let me just check if I'm logged in here we've got the keep coming yeah I'm ready to go good, yeah, yeah, okay, great so I'm, just going to scoot over to K9s here and just show you what I've got in the namespace so in the namespace.

B

If I could do this right, always on the Fly got a Kong name. Space I've got key cloak deployed, I've got uh the data plan and I've got the OPA engine so and opa there's a couple of way deployment strategies for it. You know at kubernetes. It also will deploys uh admissions controller, but we're going to leverage it we're not leveraging in that in that context, right now, because we actually just want to be making calls to it back and forth with the Gateway not making a decision as we insert something into kubernetes.

B

So that's why it's uh deployed as a sidecar here kind of like as a sidecar Club.

A

B

um So, let's go up to connect and just check what we've got going on as well. If I can find it here, we go.

B

So in Connect I made a new runtime group called Kong Builders just to keep it separate, and we can see. We've got that one data plane connected and I went ahead and did a deck sink in advance. So we've got a Rick and Morty Gateway service and it's got a route Associated to it called on path, Rick and Morty, and we've got a couple of. We got the two plugins just two plugins for now so Opa is enabled and open ID connect is enabled I'm gonna I.

A

I wanna I wanna kind of like a quickly uh mention this to to people who to watching this. So the reason why we're using connect at this point is not only because it is like easiest way how you can um get access to a variety of the plugins, a variety of the things that are available there, um but also just like a free UI. So we can quickly demonstrate all these things to you um all these things also possible to do uh whatever Quantum deployment you're using.

A

We choose to use con connect because it's the most simplest and most our developer friendly environment. These days, you can start, and even though we're using this in kubernetes right now, so Ikea's is our kind of like deployment platform.

A

um The same thing would be applicable if you just like switch to deploy to even like local Docker right, if you, if you deploy this in local local Docker, if you deploy this in Google Cloud, um the even like all this like a deck file would be absolutely the same, because it will be working against connect. So that's um pretty uh pretty simple thing to do with connect, so we do have uh like um it's a it's a it's, a it's a managed, Service uh trial uh is enabled.

A

If you want to play around with this and.

B

A

B

And you can sign up for a 14-day trial as well. If you want to get access to some of these plugins so like the OPA plugin is one of our Enterprise plugins. So if you want to play around with it, uh go ahead and sign up for that 14-day trial, we do have a link I think in the blog post, yep I know yeah.

A

B

So I'm gonna go ahead and try to start from scratch and.

A

Or if you will, I can actually start from scratch and we can show you this actually simple and dumb person, as myself can do this like quite easily.

B

um I think you can do it I think, okay,.

A

Yeah, let's, let's do this: let's try it, let's see um so that's gonna be fun, because this is totally totally you know. Unprepared and I am not afraid to make fun of myself with something not gonna work. So we do have this um uh repository that we're going to share afterwards uh right now, it's kind of like it looks like this. The hardest thing for me would be probably get my kubernetes uh cluster. Let's see if I have this um uh nodes, I would probably it's connected to my uh hoop CTX Coupe CTX Coupe CTX.

A

Where is my Cube CTX and I will select my a mesh stuff. Let's see if I have.

A

Get could get notes, uh let's see if my kubernetes cluster is up and running. Hopefully it will be up and running in there. Let's see, is it still there, hello hello? So if my cluster is not ready, so we're gonna have a backup plan to switch to uh to Dennis see if maybe my Cube TX, maybe I need to use um yeah. No, this this cluster should be should be up and running uh cloud.

A

Where's this compute container cluster.

A

Create font cluster, let's see if I will be able to get new new cluster created a little quick number of notes. Just one. Okay, remove all this stuff that I don't need.

B

I could also use Docker if you wanted.

A

um Let's see my project is suspended, so uh we got to. We got to go with Dennis Dennis environment, so I need to go and figure out billing. It's always fun. uh When the you know the money comes into into playing when you're trying to play around with the things so.

D

B

Okay, all right so I've got I've got an eks cluster yeah.

A

Budget is exhausted. So that's what what the message says so, unfortunately, that's the true nature of the modern uh Technologies. You know money.

B

A

Money show me the money exactly right.

D

B

Right, okay, so I'll uh I'll start from the beginning. Let's start from the beginning, let me use I'm gonna, do a deck sync and refresh this a little bit no such file and directory. That's not a good start!

B

A

That's true you're running in there.

D

No, it's there. It's there just.

B

Have a bad habit of relabeling things, thinking it'll be easier and then not fixing the readme there we go so we created three things. We created one thing, updated three things and deleted one thing: interesting: yeah, let's, uh let's double check, let's do a refresh here.

B

Let's see what we've got uh plugins, okay, so the two plugins uh yeah we did wanted to start them disabled just so we can like get an understanding of what the default behavior is right before we start enabling things uh we should have oh steps in right: it's okay!

B

um We, the host, is still right still morning, still pointing at Rick and Morty API, and so.

A

We want to use some sort of public API available there, so we use Rick and Morty uh graphql server. If you know in the past, in the past my favorite one was the um uh the spice spicex um graphql.

C

A

So you can get the data like what kind of like a ships are applying right now and I think they they suspended this. So so we got to go to less exciting things with Rick and Morty, which is also um Cosmic themed, so Rick and Morty. Then.

B

It's true, it is Cosmic thing. It is true: okay, okay, where are we yeah? So um this looks good, so Rick and Morty API.

D

uh Where is this guy here we.

B

Go he's here: it's working, that's kind of important, so we should be able to go to without doing anything. We have. We basically got uh an API exposed via the Gateway right, so we're gonna go.

A

B

If I can find insomnia, I'm gonna go to insomnia. I got this first request ready to go and we should be able to hit the load balancer at slash, Rick and Morty, because that's what I configured it to and it should work theoretically. Okay, great, that's good! It's working so.

A

You either get the address of the host where you can't deployed, or.

D

C

A

Run this in in kubernetes, you can get this service uh with type of load, balancer and M space. So in this case this is how you can get external IP address to this one, um so you will be able to get access.

B

Yeah, so do you want me to just I'll just go over that real quick, so wait? Is it yeah where am I I'm, so lost I'm? Sorry.

D

A

You're using your um Mac, um the the desktops like a master I'm I I, always making a decision. I need to use more of those and I still end up with just like, with one thing and like a bunch of pile of Windows in one screen.

B

Yeah, it's tough man, yeah.

B

Kind of nerve-wracking too, because I never know which direction to go. So we just look at this. We just look at this service, real quick, you know. If we go down, it's got a host name, and if this is really production ready, you know we would have had um Route 53 fronting the load balancer, but we're just kind of like this is just a quick start landscape.

B

So that's where the load balancer is, and that's pointing at the data plane running in our namespace right, so pod hates me: I, don't know how to stop it from doing that. Yeah.

D

A

B

It's there it's there. The point is it's there right, moral story, okay, so um so we right now what we've got is we've just we've just exposed the graphql API endpoint. We don't have anything else on it, and so we want to kind of start incrementaling turning things on um when we turn on key cloak. So let's go back to let's go back to connect and turn on key cloak I'm going to close this, because this is really frustrating here. We go. Okay,.

A

I'm gonna go to the screen a little bit bigger, so we can see.

C

A

My favorite uh rule of thumb to when you watch our streams on on the mobile and, if you're comfortable, watching these things in in the mobile. That's meaning that we're striking group perfect balance in terms of size of the font and accessibility of the content.

B

Yes, I believe you, okay, so.

A

How can I turn this one I'm, using like my small screen.

B

A

That's how that's how I know.

B

Yeah, no, it is really a good point, rule of thumb honestly, because people can't see then it's futile, it's worthless. Okay, so we're gonna enable the open, ID connect. Plugin I've already got it configured because I had a deck config right. Some of this was predictable, so I already got this guy configured about where to where key cloak is and how to make that call and everything and in the same token, what I did in key cloak is. We just did service to service we're just pretending like this is a machine to machine for now.

B

So it's not going to provision me a bear token. I've just got a I've just got a Kong ID service client. Let me go to the list of the clients, so I've got a realm Kong, Kong, ID and then I went over and grabbed his credentials and I got the secret. It's already seated in insomnia for me, but that is formerly what I did so now that I've got the now I've got the oadc plugin enabled formally speaking when I go to insomnia and hit the request. I don't have any auth enabled.

B

So this should throw me a forbidden, yeah, 401, unauthorized, okay, so oidc is enabled, but that's not very, very exciting. We need to do some authorization stuff. So let's do that uh so for authorization for this Opa piece. What we need to do is we need. We need to actually we're going to use a Opia has rest endpoints to go ahead and push up those policies to this engine over here and we created a couple of them for you, so we're gonna, we gotta push up. We gotta push one up. First,.

B

um How are we gonna do that? Let me see what the plan was. The plan was, what was the plan?

B

The plan was that right, I don't have a load balancer for Opa, because I was a little lazy just talking.

A

About money, what you can do, yeah, what you can do is just do um port forwarding and try to push it to the localhost.

D

Yeah I had port forward Cube cuddle Port. There we go yeah.

A

You can do you can do port forwarding from the um from K9s.

D

A

Not very good at K9s, no I can show you, so that's the beauty being part of the just kill. It kill the airport four wing for now.

D

A

So if you go to K9s and go find the service that you want to go in this particular case.

D

A

A namespace conk and uh when you go to service you.

D

B

A

Know, control F and that will tell you.

B

Wait controller for command F.

A

D

A

It's a good point or shift f. Good thing is that you can always okay. So that's uh some some other thing you can do. Control F, yeah.

D

None of it's working, no.

A

So uh in this case, you always have a help. um You can do uh get the help from the from kinanas.

D

I, don't know how to do that either.

A

So uh uh try to like you, have a service.

D

I have a service, that's a service got the.

A

Highlight my uh my um uh my kubernetes clusters is a little bit impaired, so let me try to um try to run this in mini Cube, because I have this. um You know all this all these shortcuts they are on.

A

The like very much depend on my local environment, but okay. So let's do let's not waste some time. Let's do regular port forwarding, yeah and I'll.

C

A

You shortcut afterwards: okay.

B

Forwarding is up, and we've got three policies here, so kind of wanted to demonstrate just the flexibility you have so the first policy. Let's see if we can read it together, I'm gonna widen this out. So what it's going to do is just schema validation for you, meaning that any any graphql queries made in um should be should match the abstract syntax tree for that you've defined for that back-end, graphql API.

B

So at the top all of this Co all of this code is the schema hard-coded as a string kind of like what you do with uh when you're building out those apis in the microservice anyways and.

A

Then so, in this case, we basically this. um This OPI policy is literally a some sort of like a code like some sort of DSL that we actually write in code against. So this is engine of age and we'll be executing this code against, um or income and requests and validate like every time. Everything.

B

Yeah, so what's going to happen is so this is yeah it's written in Rigo, which is there. It is their per that one called proprietary, but it's the OPA language itself and it's intended to help you build decision engines, basically build um hierarchical decision policies and all of the abstract policy enforcement away from your your code itself right.

B

So what the other thing that's really nice about is we also have the concept of Separation concerns where we want to have our governance teams and our development teams to really have a little more collaborative experience and we're starting to get a little bit of that when we use Opa, because you know we developed what a lot of graphql teams have to do. Is they have to do this authorization inside their code base? But you.

C

Know I haven't.

B

You haven't actually seen me write any graphql apis at all. At the moment. I just wrote oppa policy, so that's kind of a it's kind of nice that I don't have to go into the microservice and right.

A

The thing is, it's kind of a double-edged sword. In my opinion, we have um every time when you try to involve non-technical people, try to write them code. um It can, in the like.

C

A

Promise never worked. It worked like with the we.

C

Have the times remember.

A

um Like a rules, engine like analysts will be writing rules and they don't have to write the code in order to execute this, so they will Implement these rules and everything would be automatically you know, deployed.

B

um Automatically, yes, yes,.

A

We still need to uh the the uh maybe maybe child GPT will change the situation in you know the people.

B

C

The moderator yeah I.

B

A

I need to have a rule that prevents prevents people to get access to characters. uh Endpoints write me Oba policy for that and uh graphql will write this Rigo code for you.

B

Yeah yeah, honestly, that would be kind of a little nice anyways as a developer, but I feel like even you know, it is a double-edged sword. 100 agree. At the same token, it is a little nice that we can at least there's a little bit more transparency with Rigo in the sense that you know we have all of our policies hosted. You know version controlled into git repository uh with styra. We're gonna have a follow-up webinar on this, but you know: there's there's the whole consideration around building the policy testing.

B

The policy before you deploy at the policy and having kind of like a central management of your policy system as well, so I feel like there's also a lot of benefit. It just depends on you know as as always, it always depends like what is your.

A

Problem already like uh came up with another name for this kind of like Opa Ops type of thing, because it looks like everyone is coming up with their own Ops thingy like.

C

We have a API Ops.

A

uh Maybe for for managing this, uh the policies also, there is that Opa Ops or something like that. Yeah.

B

Dude they clock, they call it policy Ops. Oh.

A

Really, okay: I was right. I do days since uh new star Ops thingy came up zero.

B

D

B

Got off these days shift left yeah.

D

B

Coined yeah, okay, so okay, okay, but so right here we actually have one main decision. The default is not to allow and then anything that happens in here that comes out true is allowed. So the first thing is: is it a public query and what I did here was just to check that what your realm access was so basically checking the claims in the jot token, that was provisioned in that's. What these kind of helper functions do here is to parse it and then check uh what role you have.

B

uh What, in that token, so by default, key cloak gives everybody this default rosecon. So it's just kind of an easy way to give permission to everybody for quick start testing and then the only other thing it's going to do is just validate query valid. Oh here, it is query. Valid is just checking that the incoming query from input request, HTTP, parse body, query very long- um is valid using the schema, which is a string up top.

A

Parses again, like we're parsing this raw HTTP request, is there like libraries that can work with directly with a graphql instead of kind of doing this, like a parsing stuff.

B

Well, that's what this is for. It is working with graphql. So this is a built-in function built by the OPA Rego team. I guess.

D

B

Way, I would say it, but it's a built-in function to basically convert your query, your incoming queries and your schema into an abject syntax tree so that we can. Basically, then you know, go from a string to a tree which is something like a tree structure, so we can start to Traverse it with what we need. So that's, actually what these built-in functions are for. Okay,.

D

B

It comes with Rigo, it's not I, didn't write. This I actually didn't write this guy. It comes. It comes with Opa.

A

Okay, perfect, so in this case.

B

A

We we um there's uh there's a functions for dealing with the raw HTTP, so this stuff can be also used for doing under Advanced attachments on top of any HTTP API like a rest, API, basically,.

B

Yeah yeah definitely, and um so this one is just saying like with this. What this function is doing is just checking if the incoming request query is valid against the schema, like basically schema validation is a valid, but we're in the the next use cases. We're actually we'll do some more advanced use cases, so we can see all the capabilities that are, you know that come with the built-in functions, so this.

D

B

Just one of hopefully many, let's see if we get there, okay so, but we need to First push this up to uh push us up to the OPA engine. So we've opened, we've done, we've opened up port forwarding, so we have access to the API to the rest, API and I'm just going to do a curl.

B

um We have three policies. We're just gonna. Do policy number number one um this? This is good. This is a 200, it wasn't an error. So when we go to an what else do we need to do? Actually we pushed up the policy, the first policy, but we also need to enable Opa plug-in at the Gateway. So let's go up to connect.

B

D

Up to connect so I hope, I didn't get logged out check what's going on here. Yes,.

B

I'm still here great um so Opa is disabled. Let's enable it should be on the route. You just make sure I'm, not crazy. Yeah they're.

D

B

Ground, so it's got two plugins so now, when we go to insomnia, I'm gonna go to number two: oh, you know what we never tested. Turning on off, so let's test that I'm gonna execute this. Oh no. We did.

A

B

Okay, so let's go to number two I've got basic auth, because this is service to service, and this is just the client's, client, ID and the client secret down here um you can steal it, but it's not going to matter yeah and yeah. So let's go ahead and execute this request. This should work, but.

A

So basically, in this case, we do have a YDC plug-in front, uh every request that comes into this uh Slash graphql route into Rick and Morty service, and what we want to do right now is to make it more granular. So we can apply different schemas and you know validate requests.

B

Yeah, so let's let's go ahead and cause a failure, um so I'm just gonna do characters, so this is schema. Validation is what we're testing so I'm going to do something like farts and you can see. This is a 403 Forbidden. If we had turned it off, actually, let's go ahead and do it. Let's turn it off, just the plug-in. Where is that, where the hell so I'm saying it's too complicated, let's just turn off the plug-in.

B

It may take a second. It takes a second see we turned off Opa, which is doing just schema, validation and now we're getting an error, because the Rick and Morty API is throwing an error. It does not understand characters. Farts is not a part of the schema. Yeah characters is part of the schema.

B

So what is what is beautiful thing? Is that we're not, as we've stopped this at the Gateway, rather than going all the way back to the migrant server and say hey man, this is not a valid schema you're not coming in with this. So now it's back on. You can see that everything is good to go.

D

B

Parts, unauthorized yeah, so that's schema validation for you.

A

And I think it's also some. Sometimes people cannot go okay so, but it throws an authorized exception.

A

um The thing about security is that you, you have to give attacker or whatever counterpart as less information as possible as a developer. I think oh I'm, giving my users not enough information in order them to resolve this problem. But here's we're talking about security. So um when you give some additional information like oh the schema doesn't exist or you know try to check your email or things like that. You actually giving more information in order to knit hackers to explore the the vulnerability of the system.

A

So right now, Gateway actually stops this unauthorized, and you don't know what was that you know as attacker, who came with the wrong query or wrong key unless you give information to your attacker is, is, is more I would say so in this case, you.

D

Know when you see just.

A

A generic Auto unauthorized, it's a it's, a normal try to reduce um how they call it I try to reduce the vector like of the attack that, yes, unauthorized, probably you know something authorization but what's what's actually happens is like Ron schema.

B

Yep and- uh and that's just the so that's that's the most basic, but there's a lot of other problems with it's, not a problem, but it's a Nuance with graphql is um well. Let's say: we've got two people uh Vic Danny Danny is currently the administrator. So I'm allowed I have super power privileges, but Vic does not.

D

B

Fix only allowed to execute stuff uh in characters, but it's not episodes. So how do we? How do we go ahead and do that? That's what the next policy I think is supposed to be about.

B

So we've got a second policy and it's going to do it's slightly more advanced. The second policy is going to not just check that you're valid, but every query and characters is going we're going to get the abstract syntax tree back, we're going to go through every um every character's query that comes in, and we are going to check that the arguments that they send in so this in this case, filter character, is a variable input. Variable argument: where is insomnia there?

B

It is this filter character is actually something that's uh intended to be as intended to be an input into the uh into the query right. It could actually could have made this more granular. So if you wanted to check name and status and check the value of these guys as well, that would have been possible. I I didn't do it in this case, but we do have another example of doing that. So this is saying: hey you can only you know if you have an input, that's fine, but the input needs to be filter character.

B

Yes, that's the objective of SEC policy.

D

B

So, let's push up this: let's push up this guy I'm just going to do a replacement there we go um and when we execute this now should work it works. But if I do filter character, test.

B

It's also forbidden, and one thing- that's really nice that I like to do because um this probably seems like audio magic or Auto Magic is that I set up Opa. If you guys end up playing around I set up opa. Let me get to the pod.

D

A

It's in the cold, damn space.

D

um Let's open up that guy, let's.

B

Blow us up real quickly, um it's nice just for um to Value yourself. If you guys are just playing around that, you can go into the engine and you can actually go ahead and see all the data come through and the decision comes through and it kind of gives you the rationale of what of these sub allows.

B

Kind of of these uh helper functions were the reason why so I would really recommend getting in there and taking a look at yourself, because you can see what's in the access token, so that you just don't feel like you're, totally crazy, fun fact, so that is number two and so just to refresh like we didn't Opa provides the built-in functions for this partisan verify. So what it did was it first validated that the incoming query was legitimate, so the schema validation is still there, but then we had some additional validations.

B

We wanted to do and that's why we took this abstract, abstract syntax tree, and then we built arguments against it and then so in here we've got some helper functions to go ahead and help us with that parsing. So this helper function helps us walk the uh abstract contest tree and look for the character's query and then we've got another one for episodes. We didn't use it yet, but we'll use it in the next set and then we've got parsing out constants parsing out variables. You could have parsed out inputs. So there's a lot.

B

You a lot of flexibility here.

B

Any questions, I'm gonna, move on.

A

um I'm just checking our um chat window I, don't see anything uh specifically striking, so, okay, what I? What I usually say it looks like is everything is clear or nothing is clear and when there's a silence, it's very difficult to distinguish like which one is which so, hopefully, everything is clear um on um on our front or we just like Talking to Ourselves, which is going to be depressing. People um just make some noise in the comments, if you still with us.

B

Yeah, let us know, uh because we can, we have time to Circle back, keep talking.

C

About, what's going.

B

On okay, so the third and final policy is that um two people now Vic and Danny, one of them has privileges. One of them does not, uh let's figure out who, in this very long list, has privileges so.

A

Everybody right now, yeah, you have this policies of um they kind of built in into um that sodium, not the policy schemas built into the policy, but you said that it's possible to um have some sort of like a schema registry or or whatnot where this schemas can be. You know, stored and uh just like pull this into the into the code.

B

For Opa, so what we actually do need to, if we want to do that, for the plug-in we it can be an input, so it could also have been like you know how we've got input request HTTP. We also input a lot of the other information that we have like Gateway service route methods in order for it to be a part of the Opa we actually, if we wanted to do that for us for our plugin, we actually have to have like another input available to abstract.

C

B

Away from the plug-in yeah, that's why it's hard coded at the moment.

A

B

A

People we can put this in the plugin somewhere kind of like as a config or or.

B

Cool feature request: yep yeah feature request: um okay, yeah, so uh this last query we're just expanding on it, so everybody still has access to execute the characters. Query type definition, but it's not. Everybody should have access to episodes. Only someone with fake access, which is they should have a role called fake, and nobody actually has this role because I didn't set it up in key cloak. So no one should be allowed to do this. So if we go to insomnia.

B

And we execute this request. It should fail no surprise. Let's.

A

Fix this guy, though yeah.

B

Oh yeah, we didn't.

A

Curl up yeah, you, you didn't apply the policy.

B

Yeah we didn't play the policy crazy.

B

It's hard to do all of this. At the same time,.

A

No, that's! Okay! That's why I'm I'm here I'm kind of like reminding you like what we do like yeah.

B

Okay, so now it failed so I'm going to take away the episode section, because I don't have permission to execute that and it should succeed because uh yeah just because I am only focused on the character's query, not the episodes query and if I had a role before the fake key cloak uh realm roll and we use that uh client, ID and secret Pro. It would have worked instead, but so that's that's the state of the Affairs of graphql with Cog and opa.

B

So that's what we have for the demo do there any questions. Do.

D

People want to.

A

Play around with them more yeah did you um did you actually set up the um the Realms inside the okay I, just missed that, because I was checking the comments.

B

um No I set it up, I set it up earlier yeah, but we can try another one, but I didn't set up a fake one, but we can give it a go. We can see if you want to see if we can do it so.

A

Irbox is oops. Sorry uh irbox is asking: do we have example to run locally? Let's just say doctor composer, uh yes, uh and if you go into Dennis uh blog post that we have somewhere Hindi the this blog post includes everything. So if you go to this, where is one graphql authorization with con connect in Opa?

A

It has um public uh public repository where you can use Docker compose, and you can do all those things that the plane is showing you right now there should be. There should be like a URL to this. There should be URL. If not, we will put this in the comments afterwards.

B

Yeah I think it's at the bottom.

A

D

A

uh You bro, yes, that's the GitHub repo you, you probably need to enable um get access to your Quant connect, but uh everything that you're asking is is here. So that's your Docker compose yeah. It doesn't because you know we're going to be running the Quant um in the same network that your Opa in Key Club.

A

All right, cool, hide the comments. Let's see, if you have any other comments here, oh yes and our helpers um uh Emily who's in background sending you links you can find this. uh The blog post I just put this on the screen, so you can do screenshots. uh We need it next time. We need to bring the QR code, so we can like show the QR codes and, but you know think about this you're doing this you're watching this right now in your break.

A

Hopefully it's lunch lunchroom or some other room where you take an arrest on your phone and if it's gonna be, um if it's going to be a QR code, how are you going to scan the QR code from the screen that you're watching this stream?

A

Of course, you're welcome. Yeah need.

D

Two phones, yeah.

A

Yeah exactly um so no I think I think. um That's um that's a very interesting uh that very interesting use case and one of the things that uh probably um beneficial for people to know is that it is. It is indeed separation of of concerns, so we don't have. uh Let me switch this one like we can.

A

We can talk this in a different case yeah, so we don't have access to this service like we cannot change the source code of the service and um but we will be able to restrict access to the service by applying all those those policies and uh that's I, think that's that's huge in in terms of like uh protecting your your apis. Every time when the people say like why I need a Gateway, I can Implement all these things. Yeah.

A

It's depends on the um development cycles that uh or like uh Sprints, rather right so to implement certain pieces of functionality, and you also want to be very reactive and apply different rules, because your requirements on restricting access can change. You know over a matter of hours and minutes and you might not have a time to re-implement everything that you uh you have to so in this case, applying those policies on the fly like we did.

A

It just takes a matter of seconds to to implement this, um and we didn't even touch some other aspects, for example, kind of like uh implementing some sort of like a rate limiting based on the oidc type of thing.

A

You know you can first of all apply rate limiting based on the token or validation of the token, and only after that pass it to um say you have access to your service like this Rick and Morty service, and you, as a provider of this, may be paying yourself you're paying for the service you're, not just like getting this for free. So you can reduce number of requests that your users can get access to your uh to this API. So so, basically, the the possibilities are enormous.

A

You can do multiple things using this, the same Foundation all right, so um we will wait for a few more questions. uh I would like to remind that again uh everything that we were. We are talking about uh with the videos and stuff uh they will be here.

A

um Some of the tutorials, some of the videos Tech talks, all these recordings you can find here in the Quant YouTube channel in in order to receive everything. So the only thing that you need to do is to subscribe to this channel enable notification and everything will be delivered to your. You know. Notification um notification screen over here.

A

um I would like to say uh thanks to Danny for agreeing doing this demo with me uh write down in comments. If you want to see more uh videos with Danny talking about some some cool stuff and trust me, she has a lot of things to talk about and she has a lot of cool demos too to demonstrate so it's really depends on your desire.

A

We also in in this streams, who also accepting requests because there's a something that uh it's not super polish and you can see like I thought microbes cluster is always prepared, but things like you know the budgeting and the unpaid bills for your Cloud providers. I hit us and that's why you know you know we would not be able to run this on on my account. Also tricon connect. It's it's pretty cool thing to uh to do so with this. Let me last last call for question.

A

uh Okay, so there's a air box question. So can you run con locally in container? Yes, uh of course you can and as always as a good YouTuber, it's a good YouTuber uh I have a I have a video for that somewhere somewhere here. If you scroll down like almost one of the First videos that I did when I joined Quan, it was built a demo of running Quant in in Docker, and where is it? Where is it? Where is it launch?

A

I have so many videos, so many videos um you can you can check uh you, can check and find this video yeah so install Chrome, API Gateway uh in in container so like watch this video I showed examples, but, more importantly again, if you start with, um if you start with, um um if you start with connect that that what uh Daniel was talking about.

B

Oh I can show it. I still got it up. You.

D

Have it okay, yeah.

A

B

Mean showing that runtime instance.

A

Yeah yeah, so if you, if.

B

You create neuron.

A

Time, insta.

B

A

See there's there's.

B

Mac OS there's Docker yeah.

A

If you select docker.

A

Yeah, we even give you a script that just copy paste and you run more importantly, um we also have very cool um script that allows you to run this in Docker. If you do conk getting started.

A

You should be able to get this blog post start with Quan in no it's it's something different, it's not what I was. There should be like even like one liner, so basically in order to run the Quan in Docker. That's what command one command that you need to run.

C

A

And it were on squonk um and even probably deploy some some API, so give it a try that should be fairly fairly fairly easy.

B

And um if you're running the, if you're running that tutorial it'll, do it all in Docker, so it'll spin up your your gateway, a key cloak and opa all in Docker, yeah.

A

So yep yep yep yep uh and thank you so much Emily again for pasting everything into our chat. So it's a good idea to follow, chat and see the comments all right, so we're almost at the time Denny it's it's always great to chatting with you. It's always great to collaborate with you on certain cool cool, Technologies, um I hope your first experience being a part of the Kong Builders was pleasant and I hope I will see you in.

C

A

Episodes thank you.

D

A

D

You later don't.

A

Forget to you know, smash that like button um and uh yes and move this, as always, my name is uh Victor Gamo. Don't forget to subscribe to this uh YouTube channel like subscribe. I will put every buttons like make it cringe, but you know you need to subscribe and with this my name is Victor gamof and, as always, have a nice day.

A