$ show nokia/kong-oidc
The Kong OIDC plugin is an OpenID Connect Relying Party (RP) implementation for the Kong API gateway. It authenticates users against an OpenID Connect Provider using the Authorization Code flow and supports token introspection for Bearer tokens. The plugin maintains user sessions and adds headers (X-Userinfo, X-Access-Token, X-ID-Token) to the upstream request for use by backend services. The plugin follows a modular architecture with separate modules for handling the main logic (handler.lua), request filtering (filter.lua), session configuration (session.lua), and utility functions (utils.lua). It relies on the `lua-resty-openidc` library for the core OIDC protocol handling. Key features include configurable session storage (client-side cookie or server-side via shared memory, memcache, or Redis), caching of discovery documents and access tokens, and support for both authentication and token introspection modes. Note: This repository is not maintained and is not recommended for use in production, as indicated in the README. The last commit history shows no recent activity, and dependencies are outdated relative to current Kong and OIDC library versions.
The LLM identified 2 files worth highlighting for reuse:
This module provides a function to determine if a request should be processed based on a list of URL patterns. It implements a non-obvious pattern matching logic that excludes paths matching specific prefixes (with the condition that the prefix must be followed by a non-alphanumeric character or the end of the string). This is reusable in any OpenResty/Lua-based web server for path-based filtering with minimal modification (by passing the URI as a parameter).
This module contains utility functions for the OIDC plugin, including: `get_redirect_uri_path` (computes the correct redirect URI for the OIDC flow by stripping the query string and adjusting the path based on the presence of a 'code' parameter), `get_options` (maps the plugin configuration to the options expected by the underlying `lua-resty-openidc` library), and header injection functions for setting user info, access token, and ID token in the upstream request. The `get_redirect_uri_path` function demonstrates non-obvious skill in handling OAuth2 redirect URIs correctly and is reusable in any OAuth2/OIDC implementation with minimal refactoring.