Gunakan GetGatewayAuthDetail untuk Akses Gateway Aman - MSE - Alibaba Cloud - Microservices Engine

Mengambil detail otentikasi gerbang.

Coba sekarang

Coba API ini di OpenAPI Explorer tanpa perlu penandatanganan manual. Panggilan yang berhasil akan secara otomatis menghasilkan contoh kode SDK sesuai dengan parameter Anda. Unduh kode tersebut dengan kredensial bawaan yang aman untuk penggunaan lokal.

Test

RAM authorization

Tabel berikut menjelaskan otorisasi yang diperlukan untuk memanggil API ini. Anda dapat menentukannya dalam kebijakan Resource Access Management (RAM). Kolom pada tabel dijelaskan sebagai berikut:

Action: Aksi yang dapat digunakan dalam elemen Action pada pernyataan kebijakan izin RAM untuk memberikan izin guna melakukan operasi tersebut.
API: API yang dapat Anda panggil untuk melakukan aksi tersebut.
Access level: Tingkat akses yang telah ditentukan untuk setiap API. Nilai yang valid: create, list, get, update, dan delete.
Resource type: Jenis resource yang mendukung otorisasi untuk melakukan aksi tersebut. Ini menunjukkan apakah aksi tersebut mendukung izin tingkat resource. Resource yang ditentukan harus kompatibel dengan aksi tersebut. Jika tidak, kebijakan tersebut tidak akan berlaku.
- Untuk API dengan izin tingkat resource, jenis resource yang diperlukan ditandai dengan tanda bintang (*). Tentukan Nama Sumber Daya Alibaba Cloud (ARN) yang sesuai dalam elemen Resource pada kebijakan.
- Untuk API tanpa izin tingkat resource, ditampilkan sebagai All Resources. Gunakan tanda bintang (*) dalam elemen Resource pada kebijakan.
Condition key: Kunci kondisi yang didefinisikan oleh layanan. Kunci ini memungkinkan kontrol granular, berlaku baik hanya untuk aksi maupun untuk aksi yang terkait dengan resource tertentu. Selain kunci kondisi spesifik layanan, Alibaba Cloud menyediakan serangkaian common condition keys yang berlaku di semua layanan yang didukung RAM.
Dependent action: Aksi dependen yang diperlukan untuk menjalankan aksi tersebut. Untuk menyelesaikan aksi tersebut, pengguna RAM atau role RAM harus memiliki izin untuk melakukan semua aksi dependen.

Action

Access level

Resource type

Condition key

Dependent action

mse:GetGatewayAuthDetail

get

*Gateway

acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}

None

Parameter permintaan

Parameter	Type	Required	Description	Example
Id	integer	No	ID otentikasi.	1100
GatewayId	integer	No	ID gerbang. Tentukan parameter ini atau `GatewayUniqueId`.	2274
GatewayUniqueId	string	No	ID unik gerbang. Tentukan parameter ini atau `GatewayId`. Jika keduanya ditentukan, `GatewayUniqueId` yang diutamakan.	gw-6f0dbd108a0249d2b675b3ef50b*****
AcceptLanguage	string	No	Bahasa tanggapan. Nilai valid: `zh` (default): Bahasa Mandarin `en`: Bahasa Inggris.	zh

Elemen respons

Element	Type	Description	Example
	object	The response schema.
RequestId	string	The request ID.	9C96CDF8-9E6C-XXXX-XXXX-8F87A10117E6
HttpStatusCode	integer	The HTTP status code.	200
Message	string	The returned message.	OK
Code	integer	The response code. This value is synchronized with the `Success` parameter. When `Success` is `true`, the value of this parameter is `200`.	200
Success	boolean	Indicates whether the request was successful.	true
Data	object	The details of the authentication.
Id	integer	The authentication ID.	1100
Name	string	The name of the authentication.	test
GatewayUniqueId	string	The unique ID of the associated gateway.	gw-6f0dbd108a0249d2b675b3ef50b*****
GatewayId	integer	The ID of the associated gateway.	2274
Type	string	The authentication type. Valid values: `JWT` `OIDC` `IDaaS` `ExternalAuthZ`: Represents a custom authentication service.	JWT
Issuer	string	The token issuer. This parameter is returned only if the authentication type is `JWT` or `OIDC`. If the type is `JWT`, this parameter indicates the issuer (`iss`) of the JWT claims. If the type is `OIDC`, this parameter indicates the issuer (`iss`) of the OIDC claims.	https://example.com/auth
Jwks	string	The JWT public key, in JSON format.	{\n \"keys\":[\n {\n \"kty\": \"RSA\",\n \"e\": \"AQAB\",\n \"use\": \"sig\",\n \"kid\": \"1rGufmH1YN8rqM9ZOLgo7eEST3AnL89Y-m-XGFioLoA\",\n \"alg\": \"RS256\",\n \"n\": \"rM2GIc0YTMqwNCwXnjKbW5QndkCEZgyLu3uQUnyZF7HvMTekiTvQg_39mg3dV1eaYYkYfZBogyroJBqAQXhk6VVCxlBjFVp2xstJPVWngMOOlcafwN_BKdN-EQ06O_Uu__e7gNKI3DunkNk0cNaFETE7d4meRYyTlgEzYgsrW05_ufR0BKoddL3E5JsCpUxRjH9ICbodBx0U74W6Dcci-R2EA1DBrEcboE6n90uoJs6UJNriAK_71nAsYonihU5aQFFnyPTkJHfRwHK6JlME6rn-b-rpLSpdyc6U1nOFZP2DEpz8U5FrYoLYSZIU-MQGxDhCnGc_rxl2IyP9B2qcCQ\"\n }\n ]\n}\n
IsWhite	boolean	The authorization mode. `true`: whitelist mode. Requests for the hosts and paths in the list can bypass authentication. All other requests require authentication. `false`: blacklist mode. Requests for the hosts and paths in the list require authentication. All other requests can bypass authentication.	true
GmtCreate	string	The time when the authentication was created, in GMT.	2024-02-19T02:41:03.000+0000
GmtModified	string	The time when the authentication was last modified, in GMT.	2024-02-19T02:41:03.000+0000
TokenPosition	string	The location of the JWT. `HEADER`: The token is passed in a request header.	HEADER
TokenName	string	The name of the request header that carries the token. Typically, this is `Authorization`.	Authorization
TokenNamePrefix	string	The prefix of the JWT token.	Bearer
TokenPass	boolean	Specifies whether to pass the token to the backend service after authentication.	true
Status	boolean	Indicates whether authentication is enabled.	false
RedirectUrl	string	The redirect URL for successful OIDC or IDaaS authentication. This URL must match the one configured in your identity provider.	https://yourdomain/path
ClientId	string	The application ID registered with the OIDC or IDaaS service.	example-app
ClientSecret	string	The application secret registered with the OIDC or IDaaS service.	xxxxx
CookieDomain	string	The cookie domain used to maintain the login session after successful OIDC or IDaaS authentication.	hello.com
ScopesList	string	The scopes of the OIDC authentication.	["openid","email"]
LoginUrl	string	The URL of the user sign-in page for IDaaS authentication.	https://daxxxxcn.aliyunidaas.com/
Sub	string	The subject (`sub`) of the JWT claims. This is returned when the authentication type is `JWT`.	https://example.com/auth
ExternalAuthZ	object	The details of the custom authentication.
ServiceId	integer	The ID of the authentication service.	15300
PrefixPath	string	The path of the authentication API.	/auth
TokenKey	string	The header in which the token is in the request message. Common header types include Authorization and Cookie.	Authorization
AllowRequestHeaders	array	Allowed Request Headers
	string	The name of the allowed request header.	x-req
AllowUpstreamHeaders	array	Allowed Response Headers
	string	The name of the allowed response header.	x-resp
Timeout	integer	The timeout period of the authentication service. Unit: seconds.	10
IsRestrict	boolean	Indicates whether the strict authentication mode is used. Valid values: true: The strict mode is used. If the authentication service is unavailable when a connection to the authentication service fails to be established or a 5xx error code is returned, the gateway rejects requests from the client. false: The loose mode is used. If the authentication service is unavailable when a connection to the authentication service fails to be established or a 5xx error code is returned, the gateway still accepts requests from the client.	true
Service	object	Information about the authentication service.
Name	string	The name of the authentication service.	httpbin-auth-service
SourceType	string	The source of the authentication service.	K8s
GroupName	string	The group to which the authentication service belongs.	test
Namespace	string	The namespace to which the authentication service belongs.	default
WithRequestBody	boolean	Indicates whether bodies are carried in requests.	true
BodyMaxBytes	integer	The maximum number of bytes in a body.	4000000
WithRematchRoute	boolean
ResourceList	array<object>	A list of authorization rules. These rules are combined using a logical OR. Within each rule, all match conditions must be met (logical AND).
	array<object>	An authorization rule.
Id	integer	The ID of the authentication rule.	1303
AuthId	integer	The ID of the authentication to which the rule belongs.	2274
DomainId	integer	The ID of the domain name in the rule.	1765
DomainName	string	The domain name in the rule.	example.com
Path	string	The match path in the rule.	/test
IsWhite	boolean	Specifies whether to use a whitelist. Valid values: true: A whitelist is used. Only requests with the hostnames and paths that you specify in the whitelist can access the cloud-native gateway without authentication. false: A blacklist is used. Only requests with the hostnames and paths that you specify in the blacklist require authentication.	true
GatewayId	integer	The ID of the gateway for which the authentication rule is configured.	2274
GatewayUniqueId	string	The unique ID of the gateway for which the authentication rule is configured.	gw-6f0dbd108a0249d2b675b3ef50b*****
GmtCreate	string	The time when the authentication rule was created. The time was formatted as a GMT timestamp.	2024-02-19T03:32:38.000+0000
GmtModified	string	The time when the authentication rule was modified. The time was formatted as a GMT timestamp.	2024-02-19T03:32:38.000+0000
MatchType	string	The method that is used to match requests based on paths. Valid values: EQUAL: exact match PRE: prefix match ERGULAR: regular expression match	EQUAL
IgnoreCase	boolean	Indicates whether case sensitivity is enabled for request paths. true: Case sensitivity is enabled. false: Case sensitivity is disabled.	true
AuthResourceHeaderList	array<object>	The request headers in the rule. The related parameters are valid when Type is set to ExternalAuthZ.
	object
HeaderKey	string	Request header	x-req
HeaderMethod	string	Match condition: EQUAL NOT_EQUAL EXIST NOT_EXIST INCLUDE EXCLUDE PREFIX SUFFIX REGREX	EQUAL
HeaderValue	string	The value of the request header.	123
AuthResourceMode	integer	The authorization resource mode. Valid values: `0`: simple mode `1`: complex mode	0
AuthResourceConfig	string	The YAML configuration for the complex mode.	permissions: - not_rule: or_rules: rules: - and_rules: rules: - url_path: path: ignore_case: false prefix: /version - and_rules: rules: - url_path: path: ignore_case: false prefix: /header

Contoh

Respons sukses

JSONformat

{
  "RequestId": "9C96CDF8-9E6C-XXXX-XXXX-8F87A10117E6",
  "HttpStatusCode": 200,
  "Message": "OK",
  "Code": 200,
  "Success": true,
  "Data": {
    "Id": 1100,
    "Name": "test",
    "GatewayUniqueId": "gw-6f0dbd108a0249d2b675b3ef50b*****",
    "GatewayId": 2274,
    "Type": "JWT",
    "Issuer": "https://example.com/auth",
    "Jwks": "{\\n  \\\"keys\\\":[\\n    {\\n      \\\"kty\\\": \\\"RSA\\\",\\n      \\\"e\\\": \\\"AQAB\\\",\\n      \\\"use\\\": \\\"sig\\\",\\n      \\\"kid\\\": \\\"1rGufmH1YN8rqM9ZOLgo7eEST3AnL89Y-m-XGFioLoA\\\",\\n      \\\"alg\\\": \\\"RS256\\\",\\n      \\\"n\\\": \\\"rM2GIc0YTMqwNCwXnjKbW5QndkCEZgyLu3uQUnyZF7HvMTekiTvQg_39mg3dV1eaYYkYfZBogyroJBqAQXhk6VVCxlBjFVp2xstJPVWngMOOlcafwN_BKdN-EQ06O_Uu__e7gNKI3DunkNk0cNaFETE7d4meRYyTlgEzYgsrW05_ufR0BKoddL3E5JsCpUxRjH9ICbodBx0U74W6Dcci-R2EA1DBrEcboE6n90uoJs6UJNriAK_71nAsYonihU5aQFFnyPTkJHfRwHK6JlME6rn-b-rpLSpdyc6U1nOFZP2DEpz8U5FrYoLYSZIU-MQGxDhCnGc_rxl2IyP9B2qcCQ\\\"\\n    }\\n  ]\\n}\\n",
    "IsWhite": true,
    "GmtCreate": "2024-02-19T02:41:03.000+0000",
    "GmtModified": "2024-02-19T02:41:03.000+0000",
    "TokenPosition": "HEADER",
    "TokenName": "Authorization",
    "TokenNamePrefix": "Bearer ",
    "TokenPass": true,
    "Status": false,
    "RedirectUrl": "https://yourdomain/path",
    "ClientId": "example-app",
    "ClientSecret": "xxxxx",
    "CookieDomain": "hello.com",
    "ScopesList": "[\"openid\",\"email\"]",
    "LoginUrl": "https://daxxxxcn.aliyunidaas.com/",
    "Sub": "https://example.com/auth",
    "ExternalAuthZ": {
      "ServiceId": 15300,
      "PrefixPath": "/auth",
      "TokenKey": "Authorization",
      "AllowRequestHeaders": [
        "x-req"
      ],
      "AllowUpstreamHeaders": [
        "x-resp"
      ],
      "Timeout": 10,
      "IsRestrict": true,
      "Service": {
        "Name": " httpbin-auth-service",
        "SourceType": "K8s",
        "GroupName": "test",
        "Namespace": "default"
      },
      "WithRequestBody": true,
      "BodyMaxBytes": 4000000,
      "WithRematchRoute": false
    },
    "ResourceList": [
      {
        "Id": 1303,
        "AuthId": 2274,
        "DomainId": 1765,
        "DomainName": "example.com",
        "Path": "/test",
        "IsWhite": true,
        "GatewayId": 2274,
        "GatewayUniqueId": "gw-6f0dbd108a0249d2b675b3ef50b*****",
        "GmtCreate": "2024-02-19T03:32:38.000+0000",
        "GmtModified": "2024-02-19T03:32:38.000+0000",
        "MatchType": "EQUAL",
        "IgnoreCase": true,
        "AuthResourceHeaderList": [
          {
            "HeaderKey": "x-req",
            "HeaderMethod": "EQUAL",
            "HeaderValue": "123"
          }
        ]
      }
    ],
    "AuthResourceMode": 0,
    "AuthResourceConfig": "permissions:\n  - not_rule:\n      or_rules:\n        rules:\n        - and_rules:\n            rules:\n            - url_path:\n                path:\n                  ignore_case: false\n                  prefix: /version\n        - and_rules:\n            rules:\n            - url_path:\n                path:\n                  ignore_case: false\n                  prefix: /header"
  }
}

Kode kesalahan

HTTP status code	Error code	Error message
400	IllegalRequest	Invalid request:%s
400	InvalidParameter	Parameter error:%s
500	InternalError	Console error. Try again later:%s
403	NoPermission	You are not authorized to perform this operation:%s
404	NotFound	Not found:%s

Lihat Error Codes untuk daftar lengkap.

Catatan rilis

Lihat Release Notes untuk daftar lengkap.