feat(ldap-auth): add hide_credentials (#13832)

Author: nic-6443

apisix/plugins/ldap-auth.lua

@@ -31,6 +31,7 @@ local schema = {
         use_tls = { type = "boolean", default = false },
         tls_verify = { type = "boolean", default = false },
         uid = { type = "string", default = "cn" },
+        hide_credentials = { type = "boolean", default = false },
         realm = schema_def.get_realm_schema("ldap"),
     },
     required = {"base_dn","ldap_uri"},
@@ -162,7 +163,13 @@ function _M.rewrite(conf, ctx)
     end
     consumer_mod.attach_consumer(ctx, consumer, consumer_conf)
 
-    core.log.info("hit basic-auth access")
+    -- the header carries the directory password, which is usually reusable
+    -- beyond this API, so it should not reach the upstream unless asked for
+    if conf.hide_credentials then
+        core.request.set_header(ctx, "Authorization", nil)
+    end
+
+    core.log.info("hit ldap-auth access")
 end
 
 return _M

docs/en/latest/plugins/ldap-auth.md

@@ -55,6 +55,7 @@ For Route:
 | use_tls  | boolean | False    | `false` | If set to `true` uses TLS.                                             |
 | tls_verify| boolean  | False     | `false`        | Whether to verify the server certificate when `use_tls` is enabled; If set to `true`, you must set `ssl_trusted_certificate` in `config.yaml`, and make sure the host of `ldap_uri` matches the host in server certificate. |
 | uid      | string  | False    | `cn`    | uid attribute.                                                         |
+| hide_credentials | boolean | False | `false` | If true, do not pass the `Authorization` request header to the Upstream service. The header carries the directory password, which is usually reusable beyond this API. |
 | realm    | string  | False    | ldap    | The realm to include in the `WWW-Authenticate` header when authentication fails.                 |
 
 ## Enable plugin

docs/zh/latest/plugins/ldap-auth.md

@@ -51,6 +51,7 @@ Route 端：
 | use_tls  | boolean | 否    | false  | 如果设置为 `true` 则表示启用 TLS。                                             |
 | tls_verify| boolean  | 否     | false        | 是否校验 LDAP 服务器的证书。如果设置为 `true`，你必须设置 `config.yaml` 里面的 `ssl_trusted_certificate`，并且确保 `ldap_uri` 里的 host 和服务器证书中的 host 匹配。 |
 | uid      | string  | 否    | cn    | UID 属性。                                                         |
+| hide_credentials | boolean | 否 | false | 如果设置为 `true`，则不会将 `Authorization` 请求头传递给上游服务。该请求头中携带的目录密码通常在本 API 之外也可复用。|
 | realm | string | 否 | ldap |在身份验证失败时，应包含在 `WWW-Authenticate` 标头中的域。|
 
 ## 启用插件

t/plugin/ldap-auth.t

@@ -731,3 +731,120 @@ Authorization: Basic Y29tbWEsdXNlcjpjb21tYXBhc3M=
 hello world
 --- error_log
 find consumer commauser
+
+
+
+=== TEST 33: enable ldap-auth without hide_credentials
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/consumers',
+                ngx.HTTP_PUT,
+                [[{
+                    "username": "user01",
+                    "plugins": {
+                        "ldap-auth": {
+                            "user_dn": "cn=user01,ou=users,dc=example,dc=org"
+                        }
+                    }
+                }]]
+                )
+            if code >= 300 then
+                ngx.status = code
+                ngx.say(body)
+                return
+            end
+
+            code, body = t('/apisix/admin/routes/1',
+                ngx.HTTP_PUT,
+                [[{
+                    "plugins": {
+                        "ldap-auth": {
+                            "base_dn": "ou=users,dc=example,dc=org",
+                            "ldap_uri": "127.0.0.1:1389",
+                            "uid": "cn"
+                        }
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/uri"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 34: the credentials reach the upstream
+--- request
+GET /uri
+--- more_headers
+Authorization: Basic dXNlcjAxOnBhc3N3b3JkMQ==
+--- response_body
+uri: /uri
+authorization: Basic dXNlcjAxOnBhc3N3b3JkMQ==
+host: localhost
+x-consumer-username: user01
+x-real-ip: 127.0.0.1
+
+
+
+=== TEST 35: enable ldap-auth with hide_credentials
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/1',
+                ngx.HTTP_PUT,
+                [[{
+                    "plugins": {
+                        "ldap-auth": {
+                            "base_dn": "ou=users,dc=example,dc=org",
+                            "ldap_uri": "127.0.0.1:1389",
+                            "uid": "cn",
+                            "hide_credentials": true
+                        }
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/uri"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 36: the credentials do not reach the upstream
+--- request
+GET /uri
+--- more_headers
+Authorization: Basic dXNlcjAxOnBhc3N3b3JkMQ==
+--- response_body
+uri: /uri
+host: localhost
+x-consumer-username: user01
+x-real-ip: 127.0.0.1