mirror of https://github.com/dapr/docs.git
aacrawfi/middlware (#1567)
* Move and update middleware components * Update middleware docs structure * Combine middleware pages * Update middleware references * Update middleware image
This commit is contained in:
Aaron Crawfis
GitHub
parent
93eb5fa15a
commit
5bee1dae16
|
|
@ -29,7 +29,7 @@ Service discovery components are used with the [service invocation]({{<ref "serv
|
|||
|
||||
## Middleware
|
||||
|
||||
Dapr allows custom [middleware]({{<ref "middleware-concept.md">}}) to be plugged into the request processing pipeline. Middleware can perform additional actions on a request, such as authentication, encryption and message transformation before the request is routed to the user code, or before the request is returned to the client. The middleware components are used with the [service invocation]({{<ref "service-invocation-overview.md">}}) building block.
|
||||
Dapr allows custom [middleware]({{<ref "middleware.md">}}) to be plugged into the request processing pipeline. Middleware can perform additional actions on a request, such as authentication, encryption and message transformation before the request is routed to the user code, or before the request is returned to the client. The middleware components are used with the [service invocation]({{<ref "service-invocation-overview.md">}}) building block.
|
||||
|
||||
- [Middleware implementations](https://github.com/dapr/components-contrib/tree/master/middleware)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,39 +0,0 @@
|
|||
---
|
||||
type: docs
|
||||
title: "Middleware pipelines"
|
||||
linkTitle: "Middleware"
|
||||
weight: 400
|
||||
description: "Custom processing pipelines of chained middleware components"
|
||||
---
|
||||
|
||||
Dapr allows custom processing pipelines to be defined by chaining a series of middleware components. A request goes through all defined middleware components before it's routed to user code, and then goes through the defined middleware, in reverse order, before it's returned to the client, as shown in the following diagram.
|
||||
|
||||
<img src="/images/middleware.png" width=400>
|
||||
|
||||
## Customize processing pipeline
|
||||
|
||||
When launched, a Dapr sidecar constructs a middleware processing pipeline. By default the pipeline consists of [tracing middleware]({{< ref tracing-overview.md >}}) and CORS middleware. Additional middleware, configured by a Dapr [configuration]({{< ref configuration-concept.md >}}), can be added to the pipeline in the order they are defined. The pipeline applies to all Dapr API endpoints, including state, pub/sub, service invocation, bindings, security and others.
|
||||
|
||||
> **NOTE:** Dapr provides a **middleware.http.uppercase** pre-registered component that changes all text in a request body to uppercase. You can use it to test/verify if your custom pipeline is in place.
|
||||
|
||||
The following configuration example defines a custom pipeline that uses a [OAuth 2.0 middleware]({{< ref oauth.md >}}) and an uppercase middleware component. In this case, all requests are authorized through the OAuth 2.0 protocol, and transformed to uppercase text, before they are forwarded to user code.
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: pipeline
|
||||
namespace: default
|
||||
spec:
|
||||
httpPipeline:
|
||||
handlers:
|
||||
- name: oauth2
|
||||
type: middleware.http.oauth2
|
||||
- name: uppercase
|
||||
type: middleware.http.uppercase
|
||||
```
|
||||
|
||||
## Next steps
|
||||
|
||||
* [Middleware overview]({{< ref middleware-overview.md >}})
|
||||
* [How-To: Configure API authorization with OAuth]({{< ref oauth.md >}})
|
||||
|
|
@ -1,52 +1,43 @@
|
|||
---
|
||||
type: docs
|
||||
title: "Overview"
|
||||
linkTitle: "Overview"
|
||||
description: "General overview on set up of middleware components for Dapr"
|
||||
weight: 10000
|
||||
type: docs
|
||||
title: "Middleware"
|
||||
linkTitle: "Middleware"
|
||||
weight: 50
|
||||
description: "Customize processing pipelines by adding middleware components"
|
||||
aliases:
|
||||
- /developing-applications/middleware/middleware-overview/
|
||||
- /concepts/middleware-concept/
|
||||
---
|
||||
|
||||
Dapr allows custom processing pipelines to be defined by chaining a series of middleware components. Middleware pipelines are defined in Dapr configuration files.
|
||||
As with other [building block components]({{< ref component-schema.md >}}), middleware components are extensible and can be found in the [components-contrib repo](https://github.com/dapr/components-contrib/tree/master/middleware/http).
|
||||
Dapr allows custom processing pipelines to be defined by chaining a series of middleware components. A request goes through all defined middleware components before it's routed to user code, and then goes through the defined middleware, in reverse order, before it's returned to the client, as shown in the following diagram.
|
||||
|
||||
Middleware in Dapr is described using a `Component` file with the following schema:
|
||||
<img src="/images/middleware.png" width=800>
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: <COMPONENT NAME>
|
||||
namespace: <NAMESPACE>
|
||||
spec:
|
||||
type: middleware.http.<MIDDLEWARE TYPE>
|
||||
version: v1
|
||||
metadata:
|
||||
- name: <KEY>
|
||||
value: <VALUE>
|
||||
- name: <KEY>
|
||||
value: <VALUE>
|
||||
...
|
||||
```
|
||||
The type of middleware is determined by the `type` field. Component setting values such as rate limits, OAuth credentials and other settings are put in the `metadata` section.
|
||||
Even though metadata values can contain secrets in plain text, it is recommended that you use a [secret store]({{< ref component-secrets.md >}}).
|
||||
## Configuring middleware pipelines
|
||||
|
||||
Next, a Dapr [configuration]({{< ref configuration-overview.md >}}) defines the pipeline of middleware components for your application.
|
||||
When launched, a Dapr sidecar constructs a middleware processing pipeline. By default the pipeline consists of [tracing middleware]({{< ref tracing-overview.md >}}) and CORS middleware. Additional middleware, configured by a Dapr [configuration]({{< ref configuration-concept.md >}}), can be added to the pipeline in the order they are defined. The pipeline applies to all Dapr API endpoints, including state, pub/sub, service invocation, bindings, security and others.
|
||||
|
||||
The following configuration example defines a custom pipeline that uses a [OAuth 2.0 middleware]({{< ref middleware-oauth2.md >}}) and an [uppercase middleware component]({{< ref middleware-uppercase.md >}}). In this case, all requests are authorized through the OAuth 2.0 protocol, and transformed to uppercase text, before they are forwarded to user code.
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: appconfig
|
||||
name: pipeline
|
||||
namespace: default
|
||||
spec:
|
||||
httpPipeline:
|
||||
handlers:
|
||||
- name: <COMPONENT NAME>
|
||||
type: middleware.http.<MIDDLEWARE TYPE>
|
||||
- name: <COMPONENT NAME>
|
||||
type: middleware.http.<MIDDLEWARE TYPE>
|
||||
- name: oauth2
|
||||
type: middleware.http.oauth2
|
||||
- name: uppercase
|
||||
type: middleware.http.uppercase
|
||||
```
|
||||
|
||||
As with other building block components, middleware components are extensible and can be found in the [supported Middleware reference]({{< ref supported-middleware >}}) and in the [components-contrib repo](https://github.com/dapr/components-contrib/tree/master/middleware/http).
|
||||
|
||||
{{< button page="supported-middleware" text="See all middleware components">}}
|
||||
|
||||
## Writing a custom middleware
|
||||
|
||||
Dapr uses [FastHTTP](https://github.com/valyala/fasthttp) to implement its HTTP server. Hence, your HTTP middleware needs to be written as a FastHTTP handler. Your middleware needs to implement a middleware interface, which defines a **GetHandler** method that returns **fasthttp.RequestHandler** and **error**:
|
||||
|
|
@ -81,7 +72,6 @@ After the components-contrib change has been accepted, submit another pull reque
|
|||
|
||||
## Related links
|
||||
|
||||
* [Middleware pipelines concept]({{< ref middleware-concept.md >}})
|
||||
* [Component schema]({{< ref component-schema.md >}})
|
||||
* [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
* [Middleware quickstart](https://github.com/dapr/quickstarts/tree/master/middleware)
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
---
|
||||
type: docs
|
||||
title: "Middleware"
|
||||
linkTitle: "Middleware"
|
||||
weight: 50
|
||||
description: "Customize processing pipelines by adding middleware components"
|
||||
---
|
||||
|
|
@ -1,55 +0,0 @@
|
|||
---
|
||||
type: docs
|
||||
title: "Bearer"
|
||||
linkTitle: "Bearer"
|
||||
weight: 4000
|
||||
description: "Use bearer middleware to secure HTTP endpoints by verifying bearer tokens"
|
||||
type: docs
|
||||
---
|
||||
|
||||
The bearer [HTTP middleware]({{< ref middleware-concept.md >}}) verifies a [Bearer Token](https://tools.ietf.org/html/rfc6750) using [OpenID Connect](https://openid.net/connect/) on a Web API without modifying the application. This design separates authentication/authorization concerns from the application, so that application operators can adopt and configure authentication/authorization providers without impacting the application code.
|
||||
|
||||
## Component format
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: bearer-token
|
||||
spec:
|
||||
type: middleware.http.bearer
|
||||
version: v1
|
||||
metadata:
|
||||
- name: clientId
|
||||
value: "<your client ID>"
|
||||
- name: issuerURL
|
||||
value: "https://accounts.google.com"
|
||||
```
|
||||
## Spec metadata fields
|
||||
|
||||
| Field | Details | Example |
|
||||
|----------------|---------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------|
|
||||
| clientId | The client ID of your application that is created as part of a credential hosted by a OpenID Connect platform | |
|
||||
| issuerURL | URL identifier for the service. | `"https://accounts.google.com"`, `"https://login.salesforce.com"` |
|
||||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware-concept.md#customize-processing-pipeline">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: appconfig
|
||||
spec:
|
||||
httpPipeline:
|
||||
handlers:
|
||||
- name: bearer-token
|
||||
type: middleware.http.bearer
|
||||
```
|
||||
|
||||
## Related links
|
||||
|
||||
- [Middleware concept]({{< ref middleware-concept.md >}})
|
||||
- [Configuration concept]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
|
|
@ -1,72 +0,0 @@
|
|||
---
|
||||
type: docs
|
||||
title: "OAuth2"
|
||||
linkTitle: "OAuth2"
|
||||
weight: 2000
|
||||
description: "Use OAuth2 middleware to secure HTTP endpoints"
|
||||
---
|
||||
|
||||
The OAuth2 [HTTP middleware]({{< ref middleware-concept.md >}}) enables the [OAuth2 Authorization Code flow](https://tools.ietf.org/html/rfc6749#section-4.1) on a Web API without modifying the application. This design separates authentication/authorization concerns from the application, so that application operators can adopt and configure authentication/authorization providers without impacting the application code.
|
||||
|
||||
## Component format
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: oauth2
|
||||
spec:
|
||||
type: middleware.http.oauth2
|
||||
version: v1
|
||||
metadata:
|
||||
- name: clientId
|
||||
value: "<your client ID>"
|
||||
- name: clientSecret
|
||||
value: "<your client secret>"
|
||||
- name: scopes
|
||||
value: "https://www.googleapis.com/auth/userinfo.email"
|
||||
- name: authURL
|
||||
value: "https://accounts.google.com/o/oauth2/v2/auth"
|
||||
- name: tokenURL
|
||||
value: "https://accounts.google.com/o/oauth2/token"
|
||||
- name: redirectURL
|
||||
value: "http://dummy.com"
|
||||
- name: authHeaderName
|
||||
value: "authorization"
|
||||
- name: forceHTTPS
|
||||
value: "false"
|
||||
```
|
||||
## Spec metadata fields
|
||||
| Field | Details | Example |
|
||||
|----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------|
|
||||
| clientId | The client ID of your application that is created as part of a credential hosted by a OAuth-enabled platform | |
|
||||
| clientSecret | The client secret of your application that is created as part of a credential hosted by a OAuth-enabled platform | |
|
||||
| scopes | A list of space-delimited, case-sensitive strings of [scopes](https://tools.ietf.org/html/rfc6749#section-3.3) which are typically used for authorization in the application | `"https://www.googleapis.com/auth/userinfo.email"` |
|
||||
| authURL | The endpoint of the OAuth2 authorization server | `"https://accounts.google.com/o/oauth2/v2/auth"` |
|
||||
| tokenURL | The endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token | `"https://accounts.google.com/o/oauth2/token"` |
|
||||
| redirectURL | The URL of your web application that the authorization server should redirect to once the user has authenticated | `"https://myapp.com"` |
|
||||
| authHeaderName | The authorization header name to forward to your application | `"authorization"` |
|
||||
| forceHTTPS | If true, enforces the use of TLS/SSL | `"true"`,`"false"` |
|
||||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware-concept.md#customize-processing-pipeline">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: appconfig
|
||||
spec:
|
||||
httpPipeline:
|
||||
handlers:
|
||||
- name: oauth2
|
||||
type: middleware.http.oauth2
|
||||
```
|
||||
|
||||
## Related links
|
||||
- [Configure API authorization with OAuth]({{< ref oauth >}})
|
||||
- [Middleware OAuth quickstart](https://github.com/dapr/quickstarts/tree/master/middleware)
|
||||
- [Middleware concept]({{< ref middleware-concept.md >}})
|
||||
- [Configuration concept]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
|
|
@ -1,72 +0,0 @@
|
|||
---
|
||||
type: docs
|
||||
title: "OAuth2 client credentials"
|
||||
linkTitle: "OAuth2 client credentials"
|
||||
weight: 3000
|
||||
description: "Use OAuth2 client credentials middleware to secure HTTP endpoints"
|
||||
---
|
||||
|
||||
The OAuth2 client credentials [HTTP middleware]({{< ref middleware-concept.md >}}) enables the [OAuth2 Client Credentials flow](https://tools.ietf.org/html/rfc6749#section-4.4) on a Web API without modifying the application. This design separates authentication/authorization concerns from the application, so that application operators can adopt and configure authentication/authorization providers without impacting the application code.
|
||||
|
||||
## Component format
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: oauth2clientcredentials
|
||||
spec:
|
||||
type: middleware.http.oauth2clientcredentials
|
||||
version: v1
|
||||
metadata:
|
||||
- name: clientId
|
||||
value: "<your client ID>"
|
||||
- name: clientSecret
|
||||
value: "<your client secret>"
|
||||
- name: scopes
|
||||
value: "https://www.googleapis.com/auth/userinfo.email"
|
||||
- name: tokenURL
|
||||
value: "https://accounts.google.com/o/oauth2/token"
|
||||
- name: headerName
|
||||
value: "authorization"
|
||||
```
|
||||
## Spec metadata fields
|
||||
|
||||
| Field | Details | Example |
|
||||
|---------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------|
|
||||
| clientId | The client ID of your application that is created as part of a credential hosted by a OAuth-enabled platform | |
|
||||
| clientSecret | The client secret of your application that is created as part of a credential hosted by a OAuth-enabled platform | |
|
||||
| scopes | A list of space-delimited, case-sensitive strings of [scopes](https://tools.ietf.org/html/rfc6749#section-3.3) which are typically used for authorization in the application | `"https://www.googleapis.com/auth/userinfo.email"` |
|
||||
| tokenURL | The endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token | `"https://accounts.google.com/o/oauth2/token"` |
|
||||
| headerName | The authorization header name to forward to your application | `"authorization"` |
|
||||
| endpointParamsQuery | Specifies additional parameters for requests to the token endpoint | `true` |
|
||||
| authStyle | Optionally specifies how the endpoint wants the client ID & client secret sent. See the table of possible values below | `0` |
|
||||
|
||||
### Possible values for `authStyle`
|
||||
|
||||
| Value | Meaning |
|
||||
|-------|---------|
|
||||
| `1` | Sends the "client_id" and "client_secret" in the POST body as application/x-www-form-urlencoded parameters. |
|
||||
| `2` | Sends the "client_id" and "client_secret" using HTTP Basic Authorization. This is an optional style described in the [OAuth2 RFC 6749 section 2.3.1](https://tools.ietf.org/html/rfc6749#section-2.3.1). |
|
||||
| `0` | Means to auto-detect which authentication style the provider wants by trying both ways and caching the successful way for the future. |
|
||||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in a [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware-concept.md#customize-processing-pipeline">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: appconfig
|
||||
spec:
|
||||
httpPipeline:
|
||||
handlers:
|
||||
- name: oauth2clientcredentials
|
||||
type: middleware.http.oauth2clientcredentials
|
||||
```
|
||||
|
||||
## Related links
|
||||
- [Middleware concept]({{< ref middleware-concept.md >}})
|
||||
- [Configuration concept]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
|
|
@ -115,7 +115,7 @@ The following table lists the properties for HTTP handlers:
|
|||
| name | string | Name of the middleware component
|
||||
| type | string | Type of middleware component
|
||||
|
||||
See [Middleware pipelines]({{< ref "middleware-concept.md" >}}) for more information
|
||||
See [Middleware pipelines]({{< ref "middleware.md" >}}) for more information
|
||||
|
||||
#### Scope secret store access
|
||||
See the [Scoping secrets]({{< ref "secret-scope.md" >}}) guide for information and examples on how to scope secrets to an application.
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ weight: 2000
|
|||
description: "Enable OAUTH authorization on Dapr endpoints for your web APIs"
|
||||
---
|
||||
|
||||
Dapr OAuth 2.0 [middleware]({{< ref "middleware-concept.md" >}}) allows you to enable [OAuth](https://oauth.net/2/) authorization on Dapr endpoints for your web APIs using the [Authorization Code Grant flow](https://tools.ietf.org/html/rfc6749#section-4.1).
|
||||
Dapr OAuth 2.0 [middleware]({{< ref "middleware.md" >}}) allows you to enable [OAuth](https://oauth.net/2/) authorization on Dapr endpoints for your web APIs using the [Authorization Code Grant flow](https://tools.ietf.org/html/rfc6749#section-4.1).
|
||||
You can also inject authorization tokens into your APIs which can be used for authorization towards external APIs called by your APIs using the [Client Credentials Grant flow](https://tools.ietf.org/html/rfc6749#section-4.4).
|
||||
When the middleware is enabled any method invocation through Dapr needs to be authorized before getting passed to the user code.
|
||||
|
||||
|
|
@ -81,7 +81,7 @@ spec:
|
|||
|
||||
### Define a custom pipeline for an Authorization Code Grant
|
||||
|
||||
To use the OAuth middleware (Authorization Code), you should create a [custom pipeline]({{< ref "middleware-concept.md" >}})
|
||||
To use the OAuth middleware (Authorization Code), you should create a [custom pipeline]({{< ref "middleware.md" >}})
|
||||
using [Dapr configuration]({{< ref "configuration-overview" >}}), as shown in the following sample:
|
||||
|
||||
```yaml
|
||||
|
|
@ -139,7 +139,7 @@ spec:
|
|||
|
||||
### Define a custom pipeline for a Client Credentials Grant
|
||||
|
||||
To use the OAuth middleware (Client Credentials), you should create a [custom pipeline]({{< ref "middleware-concept.md" >}})
|
||||
To use the OAuth middleware (Client Credentials), you should create a [custom pipeline]({{< ref "middleware.md" >}})
|
||||
using [Dapr configuration]({{< ref "configuration-overview.md" >}}), as shown in the following sample:
|
||||
|
||||
```yaml
|
||||
|
|
|
|||
|
|
@ -1,10 +1,12 @@
|
|||
---
|
||||
type: docs
|
||||
title: "Supported middleware"
|
||||
linkTitle: "Supported middleware"
|
||||
weight: 30000
|
||||
title: "Middleware component specs"
|
||||
linkTitle: "Middleware"
|
||||
weight: 6000
|
||||
description: List of all the supported middleware components that can be injected in Dapr's processing pipeline.
|
||||
no_list: true
|
||||
aliases:
|
||||
- /developing-applications/middleware/supported-middleware/
|
||||
---
|
||||
|
||||
### HTTP
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
---
|
||||
type: docs
|
||||
title: "Bearer"
|
||||
linkTitle: "Bearer"
|
||||
description: "Use bearer middleware to secure HTTP endpoints by verifying bearer tokens"
|
||||
type: docs
|
||||
aliases:
|
||||
- /developing-applications/middleware/supported-middleware/middleware-bearer/
|
||||
---
|
||||
|
||||
The bearer [HTTP middleware]({{< ref middleware.md >}}) verifies a [Bearer Token](https://tools.ietf.org/html/rfc6750) using [OpenID Connect](https://openid.net/connect/) on a Web API without modifying the application. This design separates authentication/authorization concerns from the application, so that application operators can adopt and configure authentication/authorization providers without impacting the application code.
|
||||
|
||||
## Component format
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: bearer-token
|
||||
spec:
|
||||
type: middleware.http.bearer
|
||||
version: v1
|
||||
metadata:
|
||||
- name: clientId
|
||||
value: "<your client ID>"
|
||||
- name: issuerURL
|
||||
value: "https://accounts.google.com"
|
||||
```
|
||||
## Spec metadata fields
|
||||
|
||||
| Field | Details | Example |
|
||||
|-------|---------|---------|
|
||||
| clientId | The client ID of your application that is created as part of a credential hosted by a OpenID Connect platform
|
||||
| issuerURL | URL identifier for the service. | `"https://accounts.google.com"`, `"https://login.salesforce.com"`
|
||||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware.md">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: appconfig
|
||||
spec:
|
||||
httpPipeline:
|
||||
handlers:
|
||||
- name: bearer-token
|
||||
type: middleware.http.bearer
|
||||
```
|
||||
|
||||
## Related links
|
||||
|
||||
- [Middleware]({{< ref middleware.md >}})
|
||||
- [Configuration concept]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
---
|
||||
type: docs
|
||||
title: "OAuth2"
|
||||
linkTitle: "OAuth2"
|
||||
description: "Use OAuth2 middleware to secure HTTP endpoints"
|
||||
aliases:
|
||||
- /developing-applications/middleware/supported-middleware/middleware-oauth2/
|
||||
---
|
||||
|
||||
The OAuth2 [HTTP middleware]({{< ref middleware.md >}}) enables the [OAuth2 Authorization Code flow](https://tools.ietf.org/html/rfc6749#section-4.1) on a Web API without modifying the application. This design separates authentication/authorization concerns from the application, so that application operators can adopt and configure authentication/authorization providers without impacting the application code.
|
||||
|
||||
## Component format
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: oauth2
|
||||
spec:
|
||||
type: middleware.http.oauth2
|
||||
version: v1
|
||||
metadata:
|
||||
- name: clientId
|
||||
value: "<your client ID>"
|
||||
- name: clientSecret
|
||||
value: "<your client secret>"
|
||||
- name: scopes
|
||||
value: "https://www.googleapis.com/auth/userinfo.email"
|
||||
- name: authURL
|
||||
value: "https://accounts.google.com/o/oauth2/v2/auth"
|
||||
- name: tokenURL
|
||||
value: "https://accounts.google.com/o/oauth2/token"
|
||||
- name: redirectURL
|
||||
value: "http://dummy.com"
|
||||
- name: authHeaderName
|
||||
value: "authorization"
|
||||
- name: forceHTTPS
|
||||
value: "false"
|
||||
```
|
||||
|
||||
{{% alert title="Warning" color="warning" %}}
|
||||
The above example uses secrets as plain strings. It is recommended to use a secret store for the secrets as described [here]({{< ref component-secrets.md >}}).
|
||||
{{% /alert %}}
|
||||
|
||||
## Spec metadata fields
|
||||
|
||||
| Field | Details | Example |
|
||||
|-------|---------|---------|
|
||||
| clientId | The client ID of your application that is created as part of a credential hosted by a OAuth-enabled platform
|
||||
| clientSecret | The client secret of your application that is created as part of a credential hosted by a OAuth-enabled platform
|
||||
| scopes | A list of space-delimited, case-sensitive strings of [scopes](https://tools.ietf.org/html/rfc6749#section-3.3) which are typically used for authorization in the application | `"https://www.googleapis.com/auth/userinfo.email"`
|
||||
| authURL | The endpoint of the OAuth2 authorization server | `"https://accounts.google.com/o/oauth2/v2/auth"`
|
||||
| tokenURL | The endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token | `"https://accounts.google.com/o/oauth2/token"`
|
||||
| redirectURL | The URL of your web application that the authorization server should redirect to once the user has authenticated | `"https://myapp.com"`
|
||||
| authHeaderName | The authorization header name to forward to your application | `"authorization"`
|
||||
| forceHTTPS | If true, enforces the use of TLS/SSL | `"true"`,`"false"` |
|
||||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware.md#customize-processing-pipeline">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: appconfig
|
||||
spec:
|
||||
httpPipeline:
|
||||
handlers:
|
||||
- name: oauth2
|
||||
type: middleware.http.oauth2
|
||||
```
|
||||
|
||||
## Related links
|
||||
|
||||
- [Configure API authorization with OAuth]({{< ref oauth >}})
|
||||
- [Middleware OAuth quickstart](https://github.com/dapr/quickstarts/tree/master/middleware)
|
||||
- [Middleware]({{< ref middleware.md >}})
|
||||
- [Configuration concept]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
|
|
@ -0,0 +1,78 @@
|
|||
---
|
||||
type: docs
|
||||
title: "OAuth2 client credentials"
|
||||
linkTitle: "OAuth2 client credentials"
|
||||
description: "Use OAuth2 client credentials middleware to secure HTTP endpoints"
|
||||
aliases:
|
||||
- /developing-applications/middleware/supported-middleware/middleware-oauth2clientcredentials/
|
||||
---
|
||||
|
||||
The OAuth2 client credentials [HTTP middleware]({{< ref middleware.md >}}) enables the [OAuth2 Client Credentials flow](https://tools.ietf.org/html/rfc6749#section-4.4) on a Web API without modifying the application. This design separates authentication/authorization concerns from the application, so that application operators can adopt and configure authentication/authorization providers without impacting the application code.
|
||||
|
||||
## Component format
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: oauth2clientcredentials
|
||||
spec:
|
||||
type: middleware.http.oauth2clientcredentials
|
||||
version: v1
|
||||
metadata:
|
||||
- name: clientId
|
||||
value: "<your client ID>"
|
||||
- name: clientSecret
|
||||
value: "<your client secret>"
|
||||
- name: scopes
|
||||
value: "https://www.googleapis.com/auth/userinfo.email"
|
||||
- name: tokenURL
|
||||
value: "https://accounts.google.com/o/oauth2/token"
|
||||
- name: headerName
|
||||
value: "authorization"
|
||||
```
|
||||
|
||||
{{% alert title="Warning" color="warning" %}}
|
||||
The above example uses secrets as plain strings. It is recommended to use a secret store for the secrets as described [here]({{< ref component-secrets.md >}}).
|
||||
{{% /alert %}}
|
||||
|
||||
## Spec metadata fields
|
||||
|
||||
| Field | Details | Example |
|
||||
|------------|---------|---------|
|
||||
| clientId | The client ID of your application that is created as part of a credential hosted by a OAuth-enabled platform
|
||||
| clientSecret | The client secret of your application that is created as part of a credential hosted by a OAuth-enabled platform
|
||||
| scopes | A list of space-delimited, case-sensitive strings of [scopes](https://tools.ietf.org/html/rfc6749#section-3.3) which are typically used for authorization in the application | `"https://www.googleapis.com/auth/userinfo.email"`
|
||||
| tokenURL | The endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token | `"https://accounts.google.com/o/oauth2/token"`
|
||||
| headerName | The authorization header name to forward to your application | `"authorization"`
|
||||
| endpointParamsQuery | Specifies additional parameters for requests to the token endpoint | `true`
|
||||
| authStyle | Optionally specifies how the endpoint wants the client ID & client secret sent. See the table of possible values below | `0`
|
||||
|
||||
### Possible values for `authStyle`
|
||||
|
||||
| Value | Meaning |
|
||||
|-------|---------|
|
||||
| `1` | Sends the "client_id" and "client_secret" in the POST body as application/x-www-form-urlencoded parameters. |
|
||||
| `2` | Sends the "client_id" and "client_secret" using HTTP Basic Authorization. This is an optional style described in the [OAuth2 RFC 6749 section 2.3.1](https://tools.ietf.org/html/rfc6749#section-2.3.1). |
|
||||
| `0` | Means to auto-detect which authentication style the provider wants by trying both ways and caching the successful way for the future. |
|
||||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in a [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware.md#customize-processing-pipeline">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: appconfig
|
||||
spec:
|
||||
httpPipeline:
|
||||
handlers:
|
||||
- name: oauth2clientcredentials
|
||||
type: middleware.http.oauth2clientcredentials
|
||||
```
|
||||
|
||||
## Related links
|
||||
- [Middleware]({{< ref middleware.md >}})
|
||||
- [Configuration concept]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
|
|
@ -2,11 +2,12 @@
|
|||
type: docs
|
||||
title: "Apply Open Policy Agent (OPA) policies"
|
||||
linkTitle: "Open Policy Agent (OPA)"
|
||||
weight: 6000
|
||||
description: "Use middleware to apply Open Policy Agent (OPA) policies on incoming requests"
|
||||
aliases:
|
||||
- /developing-applications/middleware/supported-middleware/middleware-opa/
|
||||
---
|
||||
|
||||
The Open Policy Agent (OPA) [HTTP middleware]({{< ref middleware-concept.md >}}) applys [OPA Policies](https://www.openpolicyagent.org/) to incoming Dapr HTTP requests. This can be used to apply reusable authorization policies to app endpoints.
|
||||
The Open Policy Agent (OPA) [HTTP middleware]({{< ref middleware.md >}}) applys [OPA Policies](https://www.openpolicyagent.org/) to incoming Dapr HTTP requests. This can be used to apply reusable authorization policies to app endpoints.
|
||||
|
||||
## Component format
|
||||
|
||||
|
|
@ -71,14 +72,14 @@ You can prototype and experiment with policies using the [official opa playgroun
|
|||
## Spec metadata fields
|
||||
|
||||
| Field | Details | Example |
|
||||
|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------|
|
||||
|--------|---------|---------|
|
||||
| rego | The Rego policy language | See above |
|
||||
| defaultStatus | The status code to return for denied responses | `"https://accounts.google.com"`, `"https://login.salesforce.com"` |
|
||||
| includedHeaders | A comma-separated set of case-insensitive headers to include in the request input. Request headers are not passed to the policy by default. Include to receive incoming request headers in the input | `"x-my-custom-header, x-jwt-header"` |
|
||||
| defaultStatus | The status code to return for denied responses | `"https://accounts.google.com"`, `"https://login.salesforce.com"`
|
||||
| includedHeaders | A comma-separated set of case-insensitive headers to include in the request input. Request headers are not passed to the policy by default. Include to receive incoming request headers in the input | `"x-my-custom-header, x-jwt-header"`
|
||||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware-concept.md#customize-processing-pipeline">}}).
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware.md#customize-processing-pipeline">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
|
|
@ -208,6 +209,6 @@ type Result struct {
|
|||
|
||||
- [Open Policy Agent](https://www.openpolicyagent.org)
|
||||
- [HTTP API example](https://www.openpolicyagent.org/docs/latest/http-api-authorization/)
|
||||
- [Middleware concept]({{< ref middleware-concept.md >}})
|
||||
- [Middleware]({{< ref middleware.md >}})
|
||||
- [Configuration concept]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
|
|
@ -2,11 +2,12 @@
|
|||
type: docs
|
||||
title: "Rate limiting"
|
||||
linkTitle: "Rate limiting"
|
||||
weight: 1000
|
||||
description: "Use rate limit middleware to limit requests per second"
|
||||
aliases:
|
||||
- /developing-applications/middleware/supported-middleware/middleware-rate-limit/
|
||||
---
|
||||
|
||||
The rate limit [HTTP middleware]({{< ref middleware-concept.md >}}) allows restricting the maximum number of allowed HTTP requests per second. Rate limiting can protect your application from denial of service (DOS) attacks. DOS attacks can be initiated by malicious 3rd parties but also by bugs in your software (a.k.a. a "friendly fire" DOS attack).
|
||||
The rate limit [HTTP middleware]({{< ref middleware.md >}}) allows restricting the maximum number of allowed HTTP requests per second. Rate limiting can protect your application from denial of service (DOS) attacks. DOS attacks can be initiated by malicious 3rd parties but also by bugs in your software (a.k.a. a "friendly fire" DOS attack).
|
||||
|
||||
## Component format
|
||||
|
||||
|
|
@ -27,8 +28,8 @@ spec:
|
|||
## Spec metadata fields
|
||||
|
||||
| Field | Details | Example |
|
||||
|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|
|
||||
| maxRequestsPerSecond | The maximum requests per second by remote IP and path. Something to consider is that **the limit is enforced independently in each Dapr sidecar and not cluster wide** | `10` |
|
||||
|-------|---------|---------|
|
||||
| maxRequestsPerSecond | The maximum requests per second by remote IP and path. Something to consider is that **the limit is enforced independently in each Dapr sidecar and not cluster wide** | `10`
|
||||
|
||||
Once the limit is reached, the request will return *HTTP Status code 429: Too Many Requests*.
|
||||
|
||||
|
|
@ -36,7 +37,7 @@ Alternatively, the [max concurrency setting]({{< ref control-concurrency.md >}})
|
|||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware-concept.md#customize-processing-pipeline">}}).
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware.md#customize-processing-pipeline">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
|
|
@ -53,6 +54,6 @@ spec:
|
|||
## Related links
|
||||
|
||||
- [Control max concurrently]({{< ref control-concurrency.md >}})
|
||||
- [Middleware concept]({{< ref middleware-concept.md >}})
|
||||
- [Middleware]({{< ref middleware.md >}})
|
||||
- [Dapr configuration]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
|
|
@ -2,13 +2,14 @@
|
|||
type: docs
|
||||
title: "Sentinel fault-tolerance middleware component"
|
||||
linkTitle: "Sentinel"
|
||||
weight: 7000
|
||||
description: "Use Sentinel middleware to guarantee the reliability and resiliency of your application"
|
||||
aliases:
|
||||
- /developing-applications/middleware/supported-middleware/middleware-sentinel/
|
||||
---
|
||||
|
||||
[Sentinel](https://github.com/alibaba/sentinel-golang) is a powerful fault-tolerance component that takes "flow" as the breakthrough point and covers multiple fields including flow control, traffic shaping, concurrency limiting, circuit breaking, and adaptive system protection to guarantee the reliability and resiliency of microservices.
|
||||
|
||||
The Sentinel [HTTP middleware]({{< ref middleware-concept.md >}}) enables Dapr to facilitate Sentinel's powerful abilities to protect your application. You can refer to [Sentinel Wiki](https://github.com/alibaba/sentinel-golang/wiki) for more details on Sentinel.
|
||||
The Sentinel [HTTP middleware]({{< ref middleware.md >}}) enables Dapr to facilitate Sentinel's powerful abilities to protect your application. You can refer to [Sentinel Wiki](https://github.com/alibaba/sentinel-golang/wiki) for more details on Sentinel.
|
||||
|
||||
## Component format
|
||||
|
||||
|
|
@ -42,14 +43,14 @@ spec:
|
|||
## Spec metadata fields
|
||||
|
||||
| Field | Details | Example |
|
||||
|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|
|
||||
| appName | the name of current running service | `nodeapp` |
|
||||
| logDir | the log directory path | `/var/tmp/sentinel` |
|
||||
| flowRules | json array of sentinel flow control rules | [flow control rule](https://github.com/alibaba/sentinel-golang/blob/master/core/flow/rule.go) |
|
||||
| circuitBreakerRules | json array of sentinel circuit breaker rules | [circuit breaker rule](https://github.com/alibaba/sentinel-golang/blob/master/core/circuitbreaker/rule.go) |
|
||||
| hotSpotParamRules | json array of sentinel hotspot parameter flow control rules | [hotspot rule](https://github.com/alibaba/sentinel-golang/blob/master/core/hotspot/rule.go) |
|
||||
| isolationRules | json array of sentinel isolation rules | [isolation rule](https://github.com/alibaba/sentinel-golang/blob/master/core/isolation/rule.go) |
|
||||
| systemRules | json array of sentinel system rules | [system rule](https://github.com/alibaba/sentinel-golang/blob/master/core/system/rule.go) |
|
||||
|-------|---------|---------|
|
||||
| appName | the name of current running service | `nodeapp`
|
||||
| logDir | the log directory path | `/var/tmp/sentinel`
|
||||
| flowRules | json array of sentinel flow control rules | [flow control rule](https://github.com/alibaba/sentinel-golang/blob/master/core/flow/rule.go)
|
||||
| circuitBreakerRules | json array of sentinel circuit breaker rules | [circuit breaker rule](https://github.com/alibaba/sentinel-golang/blob/master/core/circuitbreaker/rule.go)
|
||||
| hotSpotParamRules | json array of sentinel hotspot parameter flow control rules | [hotspot rule](https://github.com/alibaba/sentinel-golang/blob/master/core/hotspot/rule.go)
|
||||
| isolationRules | json array of sentinel isolation rules | [isolation rule](https://github.com/alibaba/sentinel-golang/blob/master/core/isolation/rule.go)
|
||||
| systemRules | json array of sentinel system rules | [system rule](https://github.com/alibaba/sentinel-golang/blob/master/core/system/rule.go)
|
||||
|
||||
Once the limit is reached, the request will return *HTTP Status code 429: Too Many Requests*.
|
||||
|
||||
|
|
@ -63,7 +64,7 @@ All concrete HTTP API information can be found from [Dapr API Reference]{{< ref
|
|||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware-concept.md#customize-processing-pipeline">}}).
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware.md#customize-processing-pipeline">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
|
|
@ -80,6 +81,6 @@ spec:
|
|||
## Related links
|
||||
|
||||
- [Sentinel Github](https://github.com/alibaba/sentinel-golang)
|
||||
- [Middleware concept]({{< ref middleware-concept.md >}})
|
||||
- [Middleware]({{< ref middleware.md >}})
|
||||
- [Dapr configuration]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
|
|
@ -2,11 +2,12 @@
|
|||
type: docs
|
||||
title: "Uppercase request body"
|
||||
linkTitle: "Uppercase"
|
||||
weight: 9999
|
||||
description: "Test your HTTP pipeline is functioning with the uppercase middleware"
|
||||
aliases:
|
||||
- /developing-applications/middleware/supported-middleware/middleware-uppercase/
|
||||
---
|
||||
|
||||
The uppercase [HTTP middleware]({{< ref middleware-concept.md >}}) converts the body of the request to uppercase letters and is used for testing that the pipeline is functioning. It should only be used for local development.
|
||||
The uppercase [HTTP middleware]({{< ref middleware.md >}}) converts the body of the request to uppercase letters and is used for testing that the pipeline is functioning. It should only be used for local development.
|
||||
|
||||
## Component format
|
||||
|
||||
|
|
@ -26,7 +27,7 @@ This component has no `metadata` to configure.
|
|||
|
||||
## Dapr configuration
|
||||
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware-concept.md#customize-processing-pipeline">}}).
|
||||
To be applied, the middleware must be referenced in [configuration]({{< ref configuration-concept.md >}}). See [middleware pipelines]({{< ref "middleware.md#customize-processing-pipeline">}}).
|
||||
|
||||
```yaml
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
|
|
@ -42,6 +43,6 @@ spec:
|
|||
|
||||
## Related links
|
||||
|
||||
- [Middleware concept]({{< ref middleware-concept.md >}})
|
||||
- [Middleware]({{< ref middleware.md >}})
|
||||
- [Configuration concept]({{< ref configuration-concept.md >}})
|
||||
- [Configuration overview]({{< ref configuration-overview.md >}})
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 24 KiB After Width: | Height: | Size: 44 KiB |
Loading…
Reference in New Issue