Kong Kong Tutorials, 16 Feb 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: How to Use Kong Gateway JWT Plugin

Description

In this video, we'll walk through how to secure a service (in this case, an API server) with Kong Gateway and its JWT plugin. View the full tutorial on our blog: https://bit.ly/3pudLXD

We’ll cover all the steps to set up, configure and test the service — giving you the foundational knowledge needed to implement these tools independently.

Authentication can be difficult, but with the Kong Gateway JWT Plugin, you can save time and resources without risking your API gateway security.

A

In this video walk, through, we're going to build a very simple node.js express api server with a single endpoint and then we'll configure kong gateway to sit in front of our server.

A

As an api, gateway. lastly, we'll secure the endpoint with jwt authentication using kong's jwt plugin.

A

First, we'll set up our new project in our terminal.

A

We create a project folder for our simple express server.

A

We'll just call that project.

A

We'll use yarn as our package manager., so we run yarn init and we can accept all the defaults.

A

Next, we add the express package,, which is the only package we'll need for this project.

A

And lastly, we create and edit an index.js file,. That's our entry point for our server.

A

Our simple api server will have a single endpoint at its root.

A

And we're going to listen, for get requests to that endpoint on port three thousand.

A

So we require express,, then we instantiate it server,. We declare a port and then we call server.get to the root path. Slash.

A

What we're going to do is we're going to log the headers from the request and then we're just going to send back an ok 200 status with a message. "Hello,.

A

World". we set up our server to listen on that port.

A

Great, and then we save our file,, we exit and we can start up our server.

A

We started up by node and then index.js, and the server is running.

A

And just a test that our server is up and running,, we open up our browser and we visit localhost 3000.

A

And there's our response.

A

We'll also use insomnia to send this request and inspect the response.

A

Insomnia is a desktop application for api testing.

A

We'll be using insomnia more later on once we start getting to authentication.

A

So for now, though, we create a get request.

A

And we're going to send that request also to localhost 3000.

A

And there's the ok response with hello, world.

A

Your installation, steps for the kong gateway will differ depending on your development, environment.

A

Go ahead and follow the steps on the kong gateway website to install.

A

Assuming kong has been successfully installed to the system,, there are a few steps we need to take to configure it to sit in front of our api server.

A

First, in your project, folder, run the command kong config init.

A

This creates a kong.yml file which we'll edit in a moment, to provide the gateway configuration for our upstream service. That is, our api server.

A

If you're referencing the documentation for kong gateway,, you should note that the style of configuration we're using is the databaseless declarative, configuration.

A

That just means that we will declare the entire configuration we need here in kong.yml, and then we will tell kong to look for that configuration when it starts up.

A

We'll come back to our kong.yml file in a moment. but first,, let's edit, the general kong configuration by going to /etc/kong.

A

There you'll see a kong.conf.default template file.

A

Let's copy and rename that file to kong.conf.

A

We have two edits that we need to make to that file, and by the way,. You will need to edit this file with route privileges.

A

In the file,, we want to look for the line that refers to database.

A

There it is at around line 839.. We want to set database to off. database equals off because we're using the databaseless declarative, configuration.

A

We also want to look for declarative config there at around line 1023.

A

And then you set declarative config to the absolute path to your projects. Kong.Yml file in your project, folder.

A

Those are the only two edits, we will save that file and exit.

A

Now we return back to our project folder and we're going to edit that kong.yml file.

A

All we want to do initially is declare the service and the route which the kong gateway need to listen.

A

We'll define our upstream service and we will name it. My api server.

A

Pointing it to our express server endpoint,, which is localhost three thousand.

A

Next, we define a route for kong gateway, which we'll call api requests.

A

And this route is associated with our service,, our my api server service.

A

Then we set a path /api,, which kong will listen: on.

A

When a request goes to that, path, kong knows to route that request to our api server.

A

And that's it for now, for our gateway, configuration.

A

We haven't set up the jwt plugin yet,, that's coming in a bit,, but for now, we save the file and we start up kong.

A

Kong is set up by default to listen on port eight thousand.

A

In our browser, we'll visit, localhost, eight thousand to the /api path.

A

Remember our express server is on localhost three thousand.

A

So, by going to eight thousand, kong is routing us to our express server.

A

And there's our hello world response.

A

Back in insomnia,, we sent a similar get request to localhost port 800/api.

A

And we see the ok response with hello, world.

A

Now, back in our terminal, we're going to modify our kong configuration to use the jwt plugin.

A

For this,, we edit kong.yml.

A

And down at the bottom, we add the jwt plugin.

A

We add plugins and it is enabled on the api requests. Route.

A

The name of our plugin jwt,, our route, api, requests.

A

We'll tell the plugin where to find the key that identifies who issued this token.

A

We sent the config to have a key claim name of kid, and then we set the claims to verify to include exp.

A

That's the expiration timestamp of the token,, which it will need to verify.

A

And then just to make sure this locks down the properly will test this in insomnia.

A

But first we restart kong. and then we go back to insomnia.

A

And there we have that original request to port eight thousand slash api.

A

We're going to send it again,, but this time 401 unauthorized.

A

That is what we should expect.

A

Now that we have our jwt plug in enabled on our api server route,, we want to set up the consumer and the jwt credentials used for authentication.

A

Our consumer,, since we're working with that basic use, case, will be our login server, who will be in charge of generating jwts and handing them out.

A

So let's go ahead and open up our kong.yml file again for editing.

A

Now, at the bottom, we add a consumer and we give that consumer a username.

A

Then we add jwt secrets.. These are credentials which will associate with our consumer.

A

We set the consumer value to be our consumer's user name from above.

A

Then we add the secret that our consumer will use to sign the jwt when generating it.

A

And now that we have our consumer and our credentials configured,, we save the file and we restart kong.

A

In order for us to generate valid jwts,, we need a couple pieces of information.

A

We need the jwt secret,, which we already have,, but we also need the key identifier or the kid to use in the jwt header.

A

This value is connected to the issuer of the jwt, and it would be used by the plugin to track down the associated consumer so that it can retrieve the secret that is supposed to.

A

Be used to sign that jwt if, in fact, it was issued by that consumer.

A

Basically, the kid and the secret work together and they need to correspond with the jwt, is to be valid.

A

To get the value we ought to use for kid., we can make a call to kong's admin api, getting detailed information about the credential and the consumer.

A

So we send over a get request to the admin api,, which is at localhost 8001/ and the endpointis consumers/.

A

The user name of our consumer,, which we put in their.

A

Followed by /jwt.

A

And we send that request.

A

and here in the response, we see data regarding this jwt credential.

A

We see the hashing algorithm., we see the secret that we had set for signing jwts,, and here we see key.

A

That is the key, that value that we will use in the kid value of our jwt header.

A

Let's make sure to copy that.

A

There are lots of ways to generate a jwt,, but for convenience, we'll use the website. Jwt .io.

A

Here, we can configure the header,, the payload and the secret on the right side, and then we'll get the resulting encoded jwt on the left. Side.

A

We make sure we're using the correct hashing algorithm, hs 256.

A

Our jwt header, we'll need the kid value, which we copied from our previous step.

A

So we put that in, paste it here.

A

For the payload,, we'll need to include that exp,. That's the token expiration timestamp.

A

You can put anything else in the payload if you like., so we'll also include a name and an email, address.

A

But we need an exp value. That's far into the future..

A

This is a unix timestamp,, so we use something. That's pretty far into the future.

A

Lastly,, we make sure to enter our jwt secret at the bottom.

A

And then there on the left, we end up with our encoded jwt,, let's copy that.

A

Now, back in insomnia,, we need to ensure that our request is sent with our jwt.

A

So you recall our original request sent to /api.

A

We sent that and we get a 401 unauthorized..

A

So what we need to do is set up authorization., so we click on auth and we set the bearer token as the type of auth and we paste in our token that we just copied from the previous step.

A

We send the request.

A

And now we have the 200, ok with hello world., our jwt was validated and kong gateway has routed our request on to our api server.

A

You'll recall that we set up our express server to log requests headers to the console.

A

It's interesting to note that the jwt plugin after authenticating a jwt will write some additional data to the request headers,, which can then be used by the upstream service.

A

So if we look back at our terminal window that had express running,, we can look at the log request, headers to see this.

A

You'll see values for the consumer, id, consumer user name and the credential identifier. That was the kid value in our header.

A

Let's look briefly at what happens if our jwt fails validation.

A

First,, let's craft a jwt that is signed with a wrong secret.

A

So back at jwt.io, we changed the circuit that we use for signing.

A

Now, we copy this incorrectly signed jwt value.

A

We paste that value here as our token value in insomnia.

A

And we send the request., and now we have a 401 unauthorized with invalid signature.

A

Back in our browser at jwt.io,, let's fix our secret to be the correct one.

A

But now we use an incorrect value for the kid up in our header.

A

We copy the new encoded jwt.

A

Back in insomnia,, we paste the jwt that we just copied.

A

And we send the request.

A

now we have a 401 unauthorized with no credentials found for given kid.

A

Lastly,, let's use an expired token..

A

We make sure that our secret and our kid value are correct,, but for exp, we use a timestamp. That's far in the past.

A

We copy that jwt value.

A

We go back to insomnia,. We paste that token in.

A

We send the request.

A

And we have a 401 unauthorized, this time with a message: token expired.

A

And that wraps up our walkthrough of configuring kong gateway and the jwt plugin for a basic use, case, jwt authentication for a single consumer to control access to a node.

A

.Js express api server.. Thank you for joining us.