Download, install, and configure the ping-auth
plugin to set up Kong
Gateway with PingAuthorize.
To configure the ping-auth
plugin in Kong to set up a connection between
PingAuthorize and
Kong Gateway:
-
Install the plugin by running the
luarocks install kong-plugin-ping-auth
command.See the Kong Gateway plugin installation guide for more information.
-
After installation, load the plugin into Kong by editing the
plugins = bundled,ping-auth
property in the kong.conf file. - Restart Kong Gateway.
- To confirm loading, look for the debug-level message Loading plugin: ping-auth in Kong’s error.log.
- To complete Kong Gateway setup using Kong Manager, proceed to Using the GUI.
- To complete Kong Gateway setup using API requests, proceed to Using the API.
Setting up Kong Gateway using the GUI
-
In Kong Manager, select the default workspace and then
click Plugins.
-
For the
ping-auth
plugin, click Edit, and then click the toggle to enable the plugin. - Optional: If you want to enable the plugin for specific consumers, services, or routes, click Scoped, and then enter Service, Route, and Consumer information as needed.
-
Connect Kong Gateway to PingAuthorize:
- Copy the PingAuthorize sideband client’s shared secret.
-
Enter the hostname of your PingAuthorize
server and the port of the HTTPS Connection
Handler into the Config.Service
URL field.
You can find this port number in the PingAuthorize administrative console by going to Configuration > System > Connection Handlers.
For example, this field's value could be https://pingauthorize:8443.
- Paste the shared secret into the Config.Shared Secret field in Kong Manager.
-
Ensure the Config.Secret Header Name value in
Kong Manager matches the secret header name configured for the Sideband
API Servlet Extension in PingAuthorize.
- Optional:
Configure the rest of the optional fields in Kong Manager or the API.
Option API Field Name Description Config.Connection KeepAlive Ms
connection_keepAlive_ms
The duration to keep the connection alive for reuse. The default is 60000.
Config.Connection Timeout Ms
connection_timeout_ms
The duration to wait before the connection times out. The default is 10000.
Config.Enable Debug Logging
enable_debug_logging
Controls if requests and responses are logged at the debug level. The default is false. For log messages to show in error.log, you must set
log_level = debug
in kong.conf.Config.Verify Service Certificate
verify_service_certificate
Controls whether the service certificate is verified. This is intended for testing purposes and the default is true.
- Click Update, and then click Update Plugin.
Kong Gateway is now configured to work with PingAuthorize.
Setting up Kong Gateway using the API
-
Send the following in a
POST
request to https://<KONG_URL>/plugins:{ "name": "ping-auth", "enabled": true, "config": { "service_url": "https://<PingAuthorize Server hostname>:<HTTPS Connection Handler port>/", "shared_secret": "<shared secret>", "secret_header_name": "<shared secret header name>" } }
Note:See the following list for more information about the required fields for the previous API request:
- service_url
- The full URL of the Ping policy provider. This should not contain /sideband in the path.
- shared_secret
- The shared secret value to authenticate this plugin to the policy provider.
- secret_header_name
- The header name in which the shared secret is provided.
You can provide additional configuration in accordance with the Kong API specification. For more information, see the Kong documentation.
- Optional:
Configure the rest of the optional fields through the API.
Option API Field Name Description Config.Connection KeepAlive Ms
connection_keepAlive_ms
The duration to keep the connection alive for reuse. The default is 60000.
Config.Connection Timeout Ms
connection_timeout_ms
The duration to wait before the connection times out. The default is 10000.
Config.Enable Debug Logging
enable_debug_logging
Controls if requests and responses are logged at the debug level. The default is false. For log messages to show in error.log, you must set
log_level = debug
in kong.conf.Config.Verify Service Certificate
verify_service_certificate
Controls whether the service certificate is verified. This is intended for testing purposes and the default is true.
Kong Gateway is now configured to work with PingAuthorize.