@ -12,11 +12,12 @@ import "envoy/api/v2/core/http_uri.proto";
/ / External Authorization filter calls out to an external service over either :
/ / External Authorization filter calls out to an external service over either :
/ /
/ /
/ / 1. gRPC Authorization API defined by : ref : ` CheckRequest < envoy_api_msg_service.auth.v2alpha.CheckRequest > ` .
/ / 1. gRPC Authorization API defined by : ref : ` CheckRequest
/ / < envoy_api_msg_service.auth.v2alpha.CheckRequest > ` .
/ / 2. Raw HTTP Authorization server by passing the request headers to the service.
/ / 2. Raw HTTP Authorization server by passing the request headers to the service.
/ /
/ /
/ / A failed check will cause this filter to close the HTTP request normally with 403 ( Forbidden ) , unless
/ / A failed check will cause this filter to close the HTTP request normally with 403 ( Forbidden ) ,
/ / a different status code has been indicated in the authorization response.
/ / unless a different status code has been indicated in the authorization response.
message ExtAuthz {
message ExtAuthz {
oneof services {
oneof services {
@ -36,27 +37,29 @@ message ExtAuthz {
bool failure_mode_allow = 2 ;
bool failure_mode_allow = 2 ;
}
}
/ / External Authorization filter calls out to an upstream authorization server by passing the raw HTTP
/ / External Authorization filter calls out to an upstream authorization server by passing the raw
/ / request headers to the server. This allows the authorization service to take a decision whether the
/ / HTTP request headers to the server. This allows the authorization service to take a decision
/ / request is authorized or not.
/ / whether the request is authorized or not.
/ /
/ /
/ / A successful check allows the authorization service adding or overriding headers from the original
/ / A successful check allows the authorization service adding or overriding headers from the
/ / request before dispatching it to the upstream. This is done by including the headers in the response
/ / original request before dispatching it to the upstream. This is done by including the headers in
/ / sent back from the authorization service to the filter. Note that ` Status ` , ` Method ` , ` Path ` and
/ / the response sent back from the authorization service to the filter. Note that ` Status ` ,
/ / ` Content Length ` response headers are automatically removed from this response by the filter. If other
/ / ` Method ` , ` Path ` and ` Content Length ` response headers are automatically removed from this
/ / headers need be deleted , they should be specified in ` response_headers_to_remove ` field.
/ / response by the filter. If other headers need be deleted , they should be specified in
/ / ` response_headers_to_remove ` field.
/ /
/ /
/ / A failed check will cause this filter to close the HTTP request normally with 403 ( Forbidden ) , unless
/ / A failed check will cause this filter to close the HTTP request normally with 403 ( Forbidden ) ,
/ / a different status code has been indicated by the authorization service via response headers. The HTTP
/ / unless a different status code has been indicated by the authorization service via response
/ / service also allows the authorization filter to also pass data from the response body to the downstream
/ / headers. The HTTP service also allows the authorization filter to also pass data from the
/ / client in case of a denied request.
/ / response body to the downstream client in case of a denied request.
message HttpService {
message HttpService {
/ / Sets the HTTP server URI which the authorization requests must be sent to .
/ / Sets the HTTP server URI which the authorization requests must be sent to .
envoy.api.v2.core.HttpUri server_uri = 1 ;
envoy.api.v2.core.HttpUri server_uri = 1 ;
/ / Sets an optional prefix to the value of authorization request header ` path ` .
/ / Sets an optional prefix to the value of authorization request header ` path ` .
string path_prefix = 2 ;
string path_prefix = 2 ;
/ / Sets a list of headers that should be not be sent * from the authorization server * to the upstream.
/ / Sets a list of headers that should be not be sent * from the authorization server * to the
/ / upstream.
repeated string response_headers_to_remove = 3 ;
repeated string response_headers_to_remove = 3 ;
}
}