Kong API Gateway session plugin with user info

Question

I am attempting to abstract the authorization/authentication from my upstream services into Kong API gateway. Previously, I was using express + passport to handle sessions. Whenever a user logs in with their credentials a session would be created with their user info attached to the req object (req.user).

Currently, I am using API keys + session + serverless functions to compare user passwords (using bycrypt lua library) from a file mapped into the Kong container. The client would send an initial login (with username and password) request with an API key to log in, the serverless function would compare the password hashes, if all that passes, the session would get created.

However, my question is, is there a way to store the user info into the session database, so my upstream service can ask for that information to ensure that the session attached to the user logged in is valid at any given time?

Any ideas even if not related to Kong would be appreciated!

wave wave · Accepted Answer · 2021-02-19T21:25:12

When creating a new session on Kong, you can explicitly provide the unique Key used to identify a session (by default created by KONG itself). When The password checks pass and you are generating a session on Kong you can create your own unique key and use that key while creating the session.

    Kong_admin = 'http://localhost:8001'

    kong_session = {'key': 'any-unique-combination'}
    #any unique combination which you would like to use for identifying the session

    user = '[email protected]'
    
    #create a session for this dummy user using your key
    response = requests.post('%s/consumers/%s/jwt' % (Kong_admin, user),data=kong_session)

    
    #Once the session is created you can find it using
    
    resp = requests.get('%s/consumers/%s/jwt/any-unique-combination' % (Kong_admin, user))
    
    # you can use this key in your token payload so your upstream service can decrypt the 
    # payload and get this key and you can store this key in your database mapped with 
    # user during session creation.
    # with this you ll be able to decrypt any session payload , get a key and then query 
    # it on database at any point of time

Kong API Gateway session plugin with user info

1 Answers