Questions about OIDC & Permission Management

[guancyxx]

Hi, we are the developers of arkid unified authentication solution, recently we started to try to access APISIX, the expected idea is to let the resource provider's program interface be proxied by APISIX, to verify user credentials and control user access to the interface at the proxy level permissions, as shown in the following figure.

sequenceDiagram
    participant user
    participant arkid
    participant third-party resource
    participant APISIX
    rect rgb(0, 0, 255, .1)
    Note left of user:initial solution
        user->third-party resource:direct access interface
    end
   
    rect rgb(0, 0, 255, .1)
    Note left of user:expected solution
        User->>APISIX: Use oauth token to access the proxy interface
        APISIX->>arkid: Verify the validity of the token and confirm if the user has access to the interface
        arkid->>APISIX: return the user has access to the interface
        APISIX->>third-party resource: proxy data access, get access results
        Third party resource->>APISIX: data
        APISIX->>User: data
    end

Loading

Currently we have the following main queries that we are expecting help with.

• We noticed that APISIX has the OIDC plugin which seems to allow the resource provider role to be involved in the whole process, but it is not clear if this is what we expect.
• In what form should arkid, as the permission data store, pass permission information to APISIX.
• How can APISIX be configured to pass token and other information to the third party resource program during the proxy process

Any help would be greatly appreciated.

---

你好，我们是arkid统一认证解决方案的开发者，近期我们开始尝试接入APISIX，预期的想法是让资源提供方的程序接口由APISIX进行代理，在代理层验证用户凭证以及控制用户访问接口权限，如下图所示：

sequenceDiagram
    participant 用户
    participant arkid
    participant 第三方资源
    participant APISIX
    rect rgb(0, 0, 255, .1)
    Note left of 用户:初始方案
        用户-->第三方资源:直接访问接口
    end
   
    rect rgb(0, 0, 255, .1)
    Note left of 用户:预期方案
        用户->>APISIX: 使用oauth token访问代理接口
        APISIX->>arkid: 验证token有效性并确认用户是否有权限访问接口
        arkid->>APISIX:返回用户有权访问接口
        APISIX->>第三方资源: 代理数据访问，获取访问结果
        第三方资源->>APISIX:数据
        APISIX->>用户: 数据
    end

Loading

目前我们主要有以下疑问期待能得到帮助：

• 我们注意到APISIX有OIDC插件，似乎可以资源提供方的角色参与整个流程，但不清楚是否与我们的预期相符。
• arkid作为权限数据存储方，应该以怎样的形式传递权限信息给APISIX。
• APISIX在代理过程中如何配置将token等信息传递给第三方资源程序

希望能得到帮助，万分感谢。

[juzhiyuan]

Hi @tzssangglass @membphis @bzp2010 , please have a look at this issue 😄

[juzhiyuan]

Hi @guancyxx, here is the wolf-rbac plugin[1][2] (not sure if it could give you some ideas though) 😄

Also, here is the Weekly Meeting[3] link on Wednesday 🙈

[1] https://apisix.apache.org/docs/apisix/plugins/wolf-rbac
[2] https://github.com/iGeeky/apisix-plugin-rbac
[3] #5721