Skip to content

Commit bcb939c

Browse files
nelson-parentemarcduikermsfussellalicejgibbons
authored
doc: oauth middleware pathFilter (#4745)
* doc: oauth middleware pathFilter Signed-off-by: nelson.parente <[email protected]> * doc: add section for path filter with examples Signed-off-by: nelson.parente <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> * Update daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md Co-authored-by: Alice Gibbons <[email protected]> Signed-off-by: Mark Fussell <[email protected]> --------- Signed-off-by: nelson.parente <[email protected]> Signed-off-by: Mark Fussell <[email protected]> Co-authored-by: Marc Duiker <[email protected]> Co-authored-by: Mark Fussell <[email protected]> Co-authored-by: Alice Gibbons <[email protected]>
1 parent e3708a7 commit bcb939c

File tree

2 files changed

+124
-0
lines changed

2 files changed

+124
-0
lines changed

‎daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ spec:
3636
value: "authorization"
3737
- name: forceHTTPS
3838
value: "false"
39+
- name: pathFilter
40+
value: ".*/users/.*"
3941
```
4042
4143
{{% alert title="Warning" color="warning" %}}
@@ -54,6 +56,7 @@ The above example uses secrets as plain strings. It is recommended to use a secr
5456
| redirectURL | The URL of your web application that the authorization server should redirect to once the user has authenticated | `"https://myapp.com"`
5557
| authHeaderName | The authorization header name to forward to your application | `"authorization"`
5658
| forceHTTPS | If true, enforces the use of TLS/SSL | `"true"`,`"false"` |
59+
| pathFilter | Applies the middleware only to requests matching the given path pattern | `".*/users/.*"`
5760
5861
## Dapr configuration
5962
@@ -71,6 +74,67 @@ spec:
7174
type: middleware.http.oauth2
7275
```
7376
77+
## Request path filtering
78+
79+
The `pathFilter` field allows you to selectively apply OAuth2 authentication based on the HTTP request path using a regex pattern. This enables scenarios such as configuring multiple OAuth2 middlewares with different scopes for different API endpoints, implementing the least privilege principle by ensuring users only receive the minimum permissions necessary for their intended operation.
80+
81+
### Example: Separate read-only and admin user access
82+
In the following configuration:
83+
- Requests to `/api/users/*` endpoints receive tokens with a read-only user scopes
84+
- Requests to `/api/admin/*` endpoints receive tokens with full admin scopes
85+
86+
This reduces security risk by preventing unnecessary privilege access and limiting the blast radius of compromised tokens.
87+
```yaml
88+
# User with read-only access scope
89+
apiVersion: dapr.io/v1alpha1
90+
kind: Component
91+
metadata:
92+
name: oauth2-users
93+
spec:
94+
type: middleware.http.oauth2
95+
version: v1
96+
metadata:
97+
- name: clientId
98+
value: "<your client ID>"
99+
- name: clientSecret
100+
value: "<your client secret>"
101+
- name: scopes
102+
value: "user:read profile:read"
103+
- name: authURL
104+
value: "https://accounts.google.com/o/oauth2/v2/auth"
105+
- name: tokenURL
106+
value: "https://accounts.google.com/o/oauth2/token"
107+
- name: redirectURL
108+
value: "http://myapp.com/callback"
109+
- name: pathFilter
110+
value: "^/api/users/.*"
111+
---
112+
# User with full admin access scope
113+
apiVersion: dapr.io/v1alpha1
114+
kind: Component
115+
metadata:
116+
name: oauth2-admin
117+
spec:
118+
type: middleware.http.oauth2
119+
version: v1
120+
metadata:
121+
- name: clientId
122+
value: "<your client ID>"
123+
- name: clientSecret
124+
value: "<your client secret>"
125+
- name: scopes
126+
value: "admin:read admin:write user:read user:write"
127+
- name: authURL
128+
value: "https://accounts.google.com/o/oauth2/v2/auth"
129+
- name: tokenURL
130+
value: "https://accounts.google.com/o/oauth2/token"
131+
- name: redirectURL
132+
value: "http://myapp.com/callback"
133+
- name: pathFilter
134+
value: "^/api/admin/.*"
135+
```
136+
137+
74138
## Related links
75139

76140
- [Configure API authorization with OAuth]({{% ref oauth %}})

‎daprdocs/content/en/reference/components-reference/supported-middleware/middleware-oauth2clientcredentials.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ spec:
3030
value: "https://accounts.google.com/o/oauth2/token"
3131
- name: headerName
3232
value: "authorization"
33+
- name: pathFilter
34+
value: ".*/users/.*"
3335
```
3436
3537
{{% alert title="Warning" color="warning" %}}
@@ -47,6 +49,7 @@ The above example uses secrets as plain strings. It is recommended to use a secr
4749
| headerName | The authorization header name to forward to your application | `"authorization"`
4850
| endpointParamsQuery | Specifies additional parameters for requests to the token endpoint | `true`
4951
| authStyle | Optionally specifies how the endpoint wants the client ID & client secret sent. See the table of possible values below | `0`
52+
| pathFilter | Applies the middleware only to requests matching the given path pattern | `".*/users/.*"`
5053

5154
### Possible values for `authStyle`
5255

@@ -72,6 +75,63 @@ spec:
7275
type: middleware.http.oauth2clientcredentials
7376
```
7477

78+
## Request path filtering
79+
80+
The `pathFilter` field allows you to selectively apply OAuth2 authentication based on the HTTP request path using a regex pattern. This enables scenarios such as configuring multiple OAuth2 middlewares with different scopes for different API endpoints, implementing the least privilege principle by ensuring users only receive the minimum permissions necessary for their intended operation.
81+
82+
### Example: Separate read-only and admin user access
83+
84+
In the following configuration:
85+
- Requests to `/api/users/*` endpoints receive tokens with a read-only user scopes
86+
- Requests to `/api/admin/*` endpoints receive tokens with full admin scopes
87+
This reduces security risk by preventing unnecessary privilege access and limiting the blast radius of compromised tokens.
88+
```yaml
89+
# User with read-only access scope
90+
apiVersion: dapr.io/v1alpha1
91+
kind: Component
92+
metadata:
93+
name: oauth2clientcredentials-users
94+
spec:
95+
type: middleware.http.oauth2clientcredentials
96+
version: v1
97+
metadata:
98+
- name: clientId
99+
value: "<your client ID>"
100+
- name: clientSecret
101+
value: "<your client secret>"
102+
- name: scopes
103+
value: "user:read profile:read"
104+
- name: tokenURL
105+
value: "https://accounts.google.com/o/oauth2/token"
106+
- name: headerName
107+
value: "authorization"
108+
- name: pathFilter
109+
value: "^/api/users/.*"
110+
---
111+
# User with full admin access scope
112+
apiVersion: dapr.io/v1alpha1
113+
kind: Component
114+
metadata:
115+
name: oauth2clientcredentials-admin
116+
spec:
117+
type: middleware.http.oauth2clientcredentials
118+
version: v1
119+
metadata:
120+
- name: clientId
121+
value: "<your client ID>"
122+
- name: clientSecret
123+
value: "<your client secret>"
124+
- name: scopes
125+
value: "admin:read admin:write user:read user:write"
126+
- name: tokenURL
127+
value: "https://accounts.google.com/o/oauth2/token"
128+
- name: headerName
129+
value: "authorization"
130+
- name: pathFilter
131+
value: "^/api/admin/.*"
132+
```
133+
134+
75135
## Related links
76136
- [Middleware]({{% ref middleware.md %}})
77137
- [Configuration concept]({{% ref configuration-concept.md %}})

0 commit comments

Comments
 (0)