Call GetGatewayAuthDetail for Secure Gateway Access - MSE - Alibaba Cloud - Microservices Engine

Retrieves the authentication details of a gateway.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

mse:GetGatewayAuthDetail

get

*Gateway

acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}

None

Request parameters

Parameter	Type	Required	Description	Example
Id	integer	No	The authentication ID.	1100
GatewayId	integer	No	The gateway ID. Specify this parameter or `GatewayUniqueId`.	2274
GatewayUniqueId	string	No	The unique gateway ID. Specify this parameter or `GatewayId`. If both are specified, `GatewayUniqueId` takes precedence.	gw-6f0dbd108a0249d2b675b3ef50b*****
AcceptLanguage	string	No	The language of the response. Valid values: `zh` (default): Chinese `en`: English	zh

Response elements

Element	Type	Description	Example
	object	The response schema.
RequestId	string	The request ID.	9C96CDF8-9E6C-XXXX-XXXX-8F87A10117E6
HttpStatusCode	integer	The HTTP status code.	200
Message	string	The returned message.	OK
Code	integer	The response code. This value is synchronized with the `Success` parameter. When `Success` is `true`, the value of this parameter is `200`.	200
Success	boolean	Indicates whether the request was successful.	true
Data	object	The details of the authentication.
Id	integer	The authentication ID.	1100
Name	string	The name of the authentication.	test
GatewayUniqueId	string	The unique ID of the associated gateway.	gw-6f0dbd108a0249d2b675b3ef50b*****
GatewayId	integer	The ID of the associated gateway.	2274
Type	string	The authentication type. Valid values: `JWT` `OIDC` `IDaaS` `ExternalAuthZ`: Represents a custom authentication service.	JWT
Issuer	string	The token issuer. This parameter is returned only if the authentication type is `JWT` or `OIDC`. If the type is `JWT`, this parameter indicates the issuer (`iss`) of the JWT claims. If the type is `OIDC`, this parameter indicates the issuer (`iss`) of the OIDC claims.	https://example.com/auth
Jwks	string	The JWT public key, in JSON format.	{\n \"keys\":[\n {\n \"kty\": \"RSA\",\n \"e\": \"AQAB\",\n \"use\": \"sig\",\n \"kid\": \"1rGufmH1YN8rqM9ZOLgo7eEST3AnL89Y-m-XGFioLoA\",\n \"alg\": \"RS256\",\n \"n\": \"rM2GIc0YTMqwNCwXnjKbW5QndkCEZgyLu3uQUnyZF7HvMTekiTvQg_39mg3dV1eaYYkYfZBogyroJBqAQXhk6VVCxlBjFVp2xstJPVWngMOOlcafwN_BKdN-EQ06O_Uu__e7gNKI3DunkNk0cNaFETE7d4meRYyTlgEzYgsrW05_ufR0BKoddL3E5JsCpUxRjH9ICbodBx0U74W6Dcci-R2EA1DBrEcboE6n90uoJs6UJNriAK_71nAsYonihU5aQFFnyPTkJHfRwHK6JlME6rn-b-rpLSpdyc6U1nOFZP2DEpz8U5FrYoLYSZIU-MQGxDhCnGc_rxl2IyP9B2qcCQ\"\n }\n ]\n}\n
IsWhite	boolean	The authorization mode. `true`: whitelist mode. Requests for the hosts and paths in the list can bypass authentication. All other requests require authentication. `false`: blacklist mode. Requests for the hosts and paths in the list require authentication. All other requests can bypass authentication.	true
GmtCreate	string	The time when the authentication was created, in GMT.	2024-02-19T02:41:03.000+0000
GmtModified	string	The time when the authentication was last modified, in GMT.	2024-02-19T02:41:03.000+0000
TokenPosition	string	The location of the JWT. `HEADER`: The token is passed in a request header.	HEADER
TokenName	string	The name of the request header that carries the token. Typically, this is `Authorization`.	Authorization
TokenNamePrefix	string	The prefix of the JWT token.	Bearer
TokenPass	boolean	Specifies whether to pass the token to the backend service after authentication.	true
Status	boolean	Indicates whether authentication is enabled.	false
RedirectUrl	string	The redirect URL for successful OIDC or IDaaS authentication. This URL must match the one configured in your identity provider.	https://yourdomain/path
ClientId	string	The application ID registered with the OIDC or IDaaS service.	example-app
ClientSecret	string	The application secret registered with the OIDC or IDaaS service.	xxxxx
CookieDomain	string	The cookie domain used to maintain the login session after successful OIDC or IDaaS authentication.	hello.com
ScopesList	string	The scopes of the OIDC authentication.	["openid","email"]
LoginUrl	string	The URL of the user sign-in page for IDaaS authentication.	https://daxxxxcn.aliyunidaas.com/
Sub	string	The subject (`sub`) of the JWT claims. This is returned when the authentication type is `JWT`.	https://example.com/auth
ExternalAuthZ	object	The details of the custom authentication.
ServiceId	integer	The authentication service ID.	15300
PrefixPath	string	The path of the authentication API.	/auth
TokenKey	string	The request header that contains the token, such as `Authorization` or `Cookie`.	Authorization
AllowRequestHeaders	array	The allowed request headers.
	string	The name of the allowed request header.	x-req
AllowUpstreamHeaders	array	The allowed response headers.
	string	The name of the allowed response header.	x-resp
Timeout	integer	The timeout for the authentication service, in seconds.	10
IsRestrict	boolean	The custom authentication mode. `true`: strict mode. The gateway rejects client requests if the authentication service is unavailable (for example, due to a connection failure or a 5xx error). `false`: loose mode. The gateway allows client requests to bypass authentication if the authentication service is unavailable.	true
Service	object	Details of the authentication service.
Name	string	The name of the authentication service.	httpbin-auth-service
SourceType	string	The source type of the authentication service.	K8s
GroupName	string	The group to which the authentication service belongs.	test
Namespace	string	The namespace of the authentication service.	default
WithRequestBody	boolean	Specifies whether to forward the request body to the authentication service.	true
BodyMaxBytes	integer	The maximum size of the request body, in bytes.	4000000
WithRematchRoute	boolean	Specifies whether to rematch the route after authentication.
ResourceList	array<object>	A list of authorization rules. These rules are combined using a logical OR. Within each rule, all match conditions must be met (logical AND).
	array<object>	An authorization rule.
Id	integer	The ID of the authorization rule.	1303
AuthId	integer	The ID of the authentication to which this rule belongs.	2274
DomainId	integer	The ID of the domain name in the rule.	1765
DomainName	string	The domain name in the rule.	example.com
Path	string	The path pattern of the rule.	/test
IsWhite	boolean	The authorization mode. `true`: whitelist mode. Requests for the hosts and paths in the list can bypass authentication. All other requests require authentication. `false`: blacklist mode. Requests for the hosts and paths in the list require authentication. All other requests can bypass authentication.	true
GatewayId	integer	The ID of the associated gateway.	2274
GatewayUniqueId	string	The unique ID of the associated gateway.	gw-6f0dbd108a0249d2b675b3ef50b*****
GmtCreate	string	The time when the authorization rule was created, in GMT.	2024-02-19T03:32:38.000+0000
GmtModified	string	The time when the authorization rule was last modified, in GMT.	2024-02-19T03:32:38.000+0000
MatchType	string	The match type for the request path. Valid values: `EQUAL`: exact match `PRE`: prefix match `REGULAR`: regular expression match	EQUAL
IgnoreCase	boolean	Specifies whether the path matching is case-sensitive. `true`: Path matching is case-insensitive. `false`: Path matching is case-sensitive.	true
AuthResourceHeaderList	array<object>	A list of match conditions based on request headers. This parameter applies only to custom authentication.
	object
HeaderKey	string	The name of the request header.	x-req
HeaderMethod	string	The match condition. Valid values: `EQUAL`: equals `NOT_EQUAL`: does not equal `EXIST`: exists `NOT_EXIST`: does not exist `INCLUDE`: contains `EXCLUDE`: does not contain `PREFIX`: starts with `SUFFIX`: ends with `REGEX`: matches a regular expression	EQUAL
HeaderValue	string	The header value to match.	123
AuthResourceMode	integer	The authorization resource mode. Valid values: `0`: simple mode `1`: complex mode	0
AuthResourceConfig	string	The YAML configuration for the complex mode.	permissions: - not_rule: or_rules: rules: - and_rules: rules: - url_path: path: ignore_case: false prefix: /version - and_rules: rules: - url_path: path: ignore_case: false prefix: /header

Examples

Success response

JSON format

{
  "RequestId": "9C96CDF8-9E6C-XXXX-XXXX-8F87A10117E6",
  "HttpStatusCode": 200,
  "Message": "OK",
  "Code": 200,
  "Success": true,
  "Data": {
    "Id": 1100,
    "Name": "test",
    "GatewayUniqueId": "gw-6f0dbd108a0249d2b675b3ef50b*****",
    "GatewayId": 2274,
    "Type": "JWT",
    "Issuer": "https://example.com/auth",
    "Jwks": "{\\n  \\\"keys\\\":[\\n    {\\n      \\\"kty\\\": \\\"RSA\\\",\\n      \\\"e\\\": \\\"AQAB\\\",\\n      \\\"use\\\": \\\"sig\\\",\\n      \\\"kid\\\": \\\"1rGufmH1YN8rqM9ZOLgo7eEST3AnL89Y-m-XGFioLoA\\\",\\n      \\\"alg\\\": \\\"RS256\\\",\\n      \\\"n\\\": \\\"rM2GIc0YTMqwNCwXnjKbW5QndkCEZgyLu3uQUnyZF7HvMTekiTvQg_39mg3dV1eaYYkYfZBogyroJBqAQXhk6VVCxlBjFVp2xstJPVWngMOOlcafwN_BKdN-EQ06O_Uu__e7gNKI3DunkNk0cNaFETE7d4meRYyTlgEzYgsrW05_ufR0BKoddL3E5JsCpUxRjH9ICbodBx0U74W6Dcci-R2EA1DBrEcboE6n90uoJs6UJNriAK_71nAsYonihU5aQFFnyPTkJHfRwHK6JlME6rn-b-rpLSpdyc6U1nOFZP2DEpz8U5FrYoLYSZIU-MQGxDhCnGc_rxl2IyP9B2qcCQ\\\"\\n    }\\n  ]\\n}\\n",
    "IsWhite": true,
    "GmtCreate": "2024-02-19T02:41:03.000+0000",
    "GmtModified": "2024-02-19T02:41:03.000+0000",
    "TokenPosition": "HEADER",
    "TokenName": "Authorization",
    "TokenNamePrefix": "Bearer ",
    "TokenPass": true,
    "Status": false,
    "RedirectUrl": "https://yourdomain/path",
    "ClientId": "example-app",
    "ClientSecret": "xxxxx",
    "CookieDomain": "hello.com",
    "ScopesList": "[\"openid\",\"email\"]",
    "LoginUrl": "https://daxxxxcn.aliyunidaas.com/",
    "Sub": "https://example.com/auth",
    "ExternalAuthZ": {
      "ServiceId": 15300,
      "PrefixPath": "/auth",
      "TokenKey": "Authorization",
      "AllowRequestHeaders": [
        "x-req"
      ],
      "AllowUpstreamHeaders": [
        "x-resp"
      ],
      "Timeout": 10,
      "IsRestrict": true,
      "Service": {
        "Name": " httpbin-auth-service",
        "SourceType": "K8s",
        "GroupName": "test",
        "Namespace": "default"
      },
      "WithRequestBody": true,
      "BodyMaxBytes": 4000000,
      "WithRematchRoute": false
    },
    "ResourceList": [
      {
        "Id": 1303,
        "AuthId": 2274,
        "DomainId": 1765,
        "DomainName": "example.com",
        "Path": "/test",
        "IsWhite": true,
        "GatewayId": 2274,
        "GatewayUniqueId": "gw-6f0dbd108a0249d2b675b3ef50b*****",
        "GmtCreate": "2024-02-19T03:32:38.000+0000",
        "GmtModified": "2024-02-19T03:32:38.000+0000",
        "MatchType": "EQUAL",
        "IgnoreCase": true,
        "AuthResourceHeaderList": [
          {
            "HeaderKey": "x-req",
            "HeaderMethod": "EQUAL",
            "HeaderValue": "123"
          }
        ]
      }
    ],
    "AuthResourceMode": 0,
    "AuthResourceConfig": "permissions:\n  - not_rule:\n      or_rules:\n        rules:\n        - and_rules:\n            rules:\n            - url_path:\n                path:\n                  ignore_case: false\n                  prefix: /version\n        - and_rules:\n            rules:\n            - url_path:\n                path:\n                  ignore_case: false\n                  prefix: /header"
  }
}

Error codes

HTTP status code	Error code	Error message	Description
400	IllegalRequest	Invalid request:%s	Invalid request: %s
400	InvalidParameter	Parameter error:%s	Request parameter error: %s
500	InternalError	Console error. Try again later:%s	Console error. Try again later: %s
403	NoPermission	You are not authorized to perform this operation:%s	You do not have the permission to use this interface:%s
404	NotFound	Not found:%s	The resource does not exist:%s

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.