Skip to main content

Cloudentity

Kusk Gateway enables using third-party authentication and authorization management solutions such as Cloudentity.

Developers can utilize Cloudentity's platform to control their authorization flows while still using OpenAPI with Kusk to configure gateway level rules.

This separation of concerns is important when your authorization flow complexity grows or the number of services talking to each other require more authorization granularity.

Setup guide

By the end of this guide, you will have deployed an API to Kusk and used Cloudentity to block requests to your API.

1. Create Kusk Authorizer in Cloudentity

On Cloudentity's platform, go to Enforcement > Authorizers, click CREATE GATEWAY, and from the list that's displayed choose Kusk.

cloudentity authorizers list

2. Install Cloudentity's authorizer in your cluster

The bottom of the quickstart section contains a helm command that installs Cloudentity's authorizer and configures it with credentials that are used to pull authorization policies from Cloudentity.

Be sure to click on "Show" before copying the command so it can copy the credentials with the helm command.

cloudentity helm command

Once copied, run the helm command in your terminal.

You can check the installation of the authorizer with:

kubectl get svc -A
NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
...
cloudentity-authorizer-standalone-authorizer ClusterIP 10.96.216.20 <none> 9004/TCP 3h12m
...

3. Deploy an API with Kusk that uses Cloudentiy's authorizer

This is an example that uses a Kusk Policy with your OpenAPI definition to configure your gateway to use Cloudentity's authorizer with Kusk's mocking policy:

cloudentity-api.yaml

openapi: 3.0.0
info:
title: super-simple
description: super simple api
version: '0.1.0'
x-kusk:
mocking:
enabled: true
auth:

cloudentity:
host:
hostname: cloudentity-authorizer-standalone-authorizer.kusk-system # default authorizer service, change in case your authorizer is installed differently
port: 9004
paths:
/hello:
get:
responses:
200:
description: Return a hello world message
content:
application/json:
schema:
type: object
properties:
message:
type: string
example:
message: Mocked Response!

Create the file and deploy it to your cluster:

kusk deploy -i cloudentity-api.yaml

Without any additional configuration, you should be able to call the API without it being blocked and Kusk will return a mock response as configured in the example field:

info

Cloudentity's authorizer pulls new rules on an interval of 1 minute. During that period after the initial confiugration your will receive responses with HTTP Status Code 403.

curl $(kusk ip)

{"message":"Mocked Response!"}

4. Add an API Authorization Policy with Cloudentity

To see a simple example of how Cloudentity blocks an API, configure the simple authorization policy "Block API" with cloudentity to block all API calls.

For that, on Cloudentity's portal, navigate to Enforcement > APIs where you'll see the list of paths that Kusk has synchronized with your Cloudentity's account.

Click on the policy column to add a Block API rule.

cloudentity policy selection

5. Test that API calls are blocked

curl $(kusk ip) -v
...
< HTTP/1.1 403 Forbidden
< date: Tue, 04 Oct 2022 06:54:52 GMT
< x-envoy-upstream-service-time: 9
< server: envoy
< content-length: 0
info

Cloudentity's authorizer pulls new rules on an interval of 1 minute. During that period, your API calls will work with the old rules until the new ones are pulled.