I have confiured three APIDefinitions, one for ingress, one with auth_token and another one with jwt.
There is a security policy applied for the api with auth_token but it does not seem to be enforcing
Here are the configuratons:
apiDefinition-entrypoint:
apiVersion: tyk.tyk.io/v1alpha1
kind: ApiDefinition
metadata:
name: example-entrypoint
namespace: tyk
spec:
name: example-entrypoint
protocol: http
use_keyless: true
active: true
proxy:
target_url: https://api-rate-limit.example.com/
listen_path: /
strip_listen_path: false
version_data:
default_version: default
not_versioned: true
versions:
Default:
name: default
use_extended_paths: true
extended_paths:
url_rewrites:
- match_pattern: /(.*)
method: GET
path: /{id}
rewrite_to_internal:
query: 'check_limits=true'
target:
name: example-apikey
namespace: tyk
path: apikey/$1
triggers:
- "on": "all"
options:
header_matches:
"Authorization":
match_rx: "^Bearer"
rewrite_to_internal:
query: 'check_limits=true'
target:
name: example-jwt
namespace: tyk
path: bearer/$1
here is the apiDefinition for example-apikey:
apiVersion: tyk.tyk.io/v1alpha1
kind: ApiDefinition
metadata:
name: example-apikey
namespace: tyk
spec:
name: example-apikey
protocol: http
use_keyless: false
active: true
proxy:
target_url: https://api-rate-limit.example.com/
listen_path: "/apikey"
strip_listen_path: true
auth:
auth_header_name: 'Authorization'
auth_configs:
authToken:
auth_header_name: 'Authorization'
use_param: true
param_name: apikey
base_identity_provided_by: auth_token
use_standard_auth: true
internal: true
And here is the securitypolicy:
apiVersion: tyk.tyk.io/v1alpha1
kind: SecurityPolicy
metadata:
name: example-apikey
namespace: tyk
spec:
name: Rate Limit, Quota and Throttling policy at apikey
state: active
active: true
is_inactive: false
access_rights_array:
- name: example-apikey
namespace: tyk
versions:
- Default
partitions:
acl: false
complexity: false
per_api: false
quota: true
rate_limit: true
quota_max: 1
quota_renewal_rate: 60
rate: 1
per: 60
I have tested the internal api by putting internal: false and directly creating an apicall to that api, and the security policy is working okay in that case but securitypolicy is not enforcing in case of looping.
Though I can verify from logs:
time="Sep 21 04:23:21" level=debug msg="URL Re-written to: tyk://dHlrL2FkdC1jYXJnby1tb3ZlbWVudHMtYXBpa2V5/apikey/v5/reference/test/?apikey=<apikey>?check_limits=true"
also, I can see from logs that following MW are running successfully: RateLimitAndQuotaCheck,Accessrightscheck, authkey etc.
