tk/Ocelot
1
0
Fork 0
mirror of https://github.com/nsnail/Ocelot.git synced 2025-06-19 11:58:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Feature/use any id server for admin area (#232)

Browse Source 
* initial commits around using any id servers

* add your own id server for admin area

* lots of refactoring, now instead of injecting IWebHostBuilder we just set the Ocelot base url as a configuration extension method..this means people can pass it in on the command line aswell as hardcode which is OK I guess, also can now use your own IdentityServer to authenticate admin area

* updated docs for #231

* some tests that hopefully bump up coverage
This commit is contained in:
Tom Pallister
2018-02-14 18:53:18 +00:00
committed by GitHub
parent 6f177fbf5b
commit 05481f3af3
31 changed files with 876 additions and 546 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
docs/features/administration.rst
View File

@ -1,8 +1,39 @@
Administration
==============
Ocelot supports changing configuration during runtime via an authenticated HTTP API. The API is authenticated
using bearer tokens that you request from Ocelot iteself. This is provided by the amazing
Ocelot supports changing configuration during runtime via an authenticated HTTP API. This can be authenticated in two ways either using Ocelot's
internal IdentityServer (for authenticating requests to the administration API only) or hooking the administration API authentication into your own
IdentityServer.
Providing your own IdentityServer
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All you need to do to hook into your own IdentityServer is add the following to your ConfigureServices method.
.. code-block:: csharp
public virtual void ConfigureServices(IServiceCollection services)
{
Action<IdentityServerAuthenticationOptions> options = o => {
// o.Authority = ;
// o.ApiName = ;
// etc....
};
services
.AddOcelot(Configuration)
.AddAdministration("/administration", options);
}
You now need to get a token from your IdentityServer and use in subsequent requests to Ocelot's administration API.
This feature was implemented for `issue 228 <https://github.com/TomPallister/Ocelot/issues/228>`_. It is useful because the IdentityServer authentication
middleware needs the URL of the IdentityServer. If you are using the internal IdentityServer it might not alaways be possible to have the Ocelot URL.
Internal IdentityServer
^^^^^^^^^^^^^^^^^^^^^^^
The API is authenticated using bearer tokens that you request from Ocelot iteself. This is provided by the amazing
`Identity Server <https://github.com/IdentityServer/IdentityServer4>`_ project that I have been using for a few years now. Check them out.
In order to enable the administration section you need to do a few things. First of all add this to your
@ -31,8 +62,6 @@ will need to be changed if you are running Ocelot on a different url to http://l
The scripts show you how to request a bearer token from ocelot and then use it to GET the existing configuration and POST
a configuration.
Administration running multiple Ocelot's
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you are running multiple Ocelot's in a cluster then you need to use a certificate to sign the bearer tokens used to access the administration API.
In order to do this you need to add two more environmental variables for each Ocelot in the cluster.
@ -44,6 +73,7 @@ In order to do this you need to add two more environmental variables for each Oc
Normally Ocelot just uses temporary signing credentials but if you set these environmental variables then it will use the certificate. If all the other Ocelots in the cluster have the same certificate then you are good!
Administration API
^^^^^^^^^^^^^^^^^^

7
docs/features/authentication.rst
View File

@ -135,3 +135,10 @@ Then map the authentication provider key to a ReRoute in your configuration e.g.
"AllowedScopes": []
}
}]
Allowed Scopes
^^^^^^^^^^^^^
If you add scopes to AllowedScopes Ocelot will get all the user claims (from the token) of the type scope and make sure that the user has all of the scopes in the list.
This is a way to restrict access to a ReRoute on a per scope basis.

69
docs/introduction/gettingstarted.rst
View File

@ -29,8 +29,8 @@ The following is a very basic configuration.json. It won't do anything but shoul
**Program**
Then in your Program.cs you will want to have the following. This can be changed if you
don't wan't to use the default url e.g. UseUrls(someUrls) and should work as long as you keep the WebHostBuilder registration.
Then in your Program.cs you will want to have the following. The main things to note are AddOcelotBaseUrl("http://localhost:5000") (adds the url this instance of Ocelot will run under),
AddOcelot() (adds ocelot services), UseOcelot().Wait() (sets up all the Ocelot middleware). It is important to call AddOcelotBaseUrl as Ocelot needs to know the URL that it is exposed to the outside world on.
.. code-block:: csharp
@ -38,51 +38,33 @@ don't wan't to use the default url e.g. UseUrls(someUrls) and should work as lon
{
public static void Main(string[] args)
{
IWebHostBuilder builder = new WebHostBuilder();
builder.ConfigureServices(s => {
s.AddSingleton(builder);
});
builder.UseKestrel()
new WebHostBuilder()
.UseKestrel()
.UseContentRoot(Directory.GetCurrentDirectory())
.ConfigureAppConfiguration((hostingContext, config) =>
{
config.SetBasePath(hostingContext.HostingEnvironment.ContentRootPath);
var env = hostingContext.HostingEnvironment;
config.AddJsonFile("appsettings.json", optional: true, reloadOnChange: true)
.AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true, reloadOnChange: true);
config.AddJsonFile("configuration.json");
config.AddEnvironmentVariables();
config
.SetBasePath(hostingContext.HostingEnvironment.ContentRootPath)
.AddJsonFile("appsettings.json", true, true)
.AddJsonFile($"appsettings.{hostingContext.HostingEnvironment.EnvironmentName}.json", true, true)
.AddJsonFile("configuration.json")
.AddEnvironmentVariables()
.AddOcelotBaseUrl("http://localhost:5000");
})
.ConfigureServices(s => {
s.AddOcelot();
})
.ConfigureLogging((hostingContext, logging) =>
{
logging.AddConfiguration(hostingContext.Configuration.GetSection("Logging"));
logging.AddConsole();
//add your logging
})
.UseIISIntegration()
.UseStartup<ManualTestStartup>();
var host = builder.Build();
host.Run();
}
}
Sadly we need to inject the IWebHostBuilder interface to get the applications scheme, url and port later. I cannot find a better way of doing this at the moment without setting this in a static or some kind of config.
**Startup**
An example startup using a json file for configuration can be seen below. This is the most basic startup and Ocelot has quite a few more options. Detailed in the rest of these docs! If you get a stuck a good place to look is at the ManualTests project in the source code.
.. code-block:: csharp
public class Startup
{
public void ConfigureServices(IServiceCollection services)
{
services.AddOcelot();
}
public void Configure(IApplicationBuilder app)
{
app.UseOcelot().Wait();
.Configure(app =>
{
app.UseOcelot().Wait();
})
.Build()
.Run();
}
}
@ -109,8 +91,7 @@ The following is a very basic configuration.json. It won't do anything but shoul
**Program**
Then in your Program.cs you will want to have the following. This can be changed if you
don't wan't to use the default url e.g. UseUrls(someUrls) and should work as long as you keep the WebHostBuilder registration.
Then in your Program.cs you will want to have the following.
.. code-block:: csharp
@ -121,7 +102,6 @@ don't wan't to use the default url e.g. UseUrls(someUrls) and should work as lon
IWebHostBuilder builder = new WebHostBuilder();
builder.ConfigureServices(s => {
s.AddSingleton(builder);
});
builder.UseKestrel()
@ -134,8 +114,6 @@ don't wan't to use the default url e.g. UseUrls(someUrls) and should work as lon
}
}
Sadly we need to inject the IWebHostBuilder interface to get the applications scheme, url and port later. I cannot find a better way of doing this at the moment without setting this in a static or some kind of config.
**Startup**
An example startup using a json file for configuration can be seen below.
@ -151,7 +129,8 @@ An example startup using a json file for configuration can be seen below.
.AddJsonFile("appsettings.json", optional: true, reloadOnChange: true)
.AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true)
.AddJsonFile("configuration.json")
.AddEnvironmentVariables();
.AddEnvironmentVariables()
.AddOcelotBaseUrl("http://localhost:5000");
Configuration = builder.Build();
}