openid-connect plugin

[Wareload]

Hi, I'm currently evaluating Apache APISIX, specifically the OpenID Connect plugin. During my exploration, several questions have come up.

I primarily want to use it for enforcing authentication via an OIDC provider, and I plan to use either the "auth" mode or preferably the "deny" mode.

Here are my main questions:

• In deny mode, is there a way to specify a custom login path, or is it solely intended for the "bearer_only=true" mode? I have not found a way to trigger the login yet.
• How can I redirect to a custom error page instead of using the built-in 500 error page?
• How can I configure multiple identity providers for different paths without overwriting the session cookie when switching between them?
• What’s the best way to serve static content? Should I use proxy caching(plugin), or is it better to host them directly within the APISIX container (when running in standalone mode)?

Thanks for the awesome product! Also, would contributions regarding the topics above be welcomed?

Sample configuration:

apisix:
  node_listen: 9080

plugin_configs:
  - id: 1
    plugins:
      openid-connect:
        client_id: "apisix"
        client_secret: "GVGy17pNqfSEhtBkLivLVlEF6k2VXT3V"
        discovery: "http://localhost:8080/realms/test/.well-known/openid-configuration"
        scope: "openid profile"
        bearer_only: false
        access_token_expires_leeway: 60
        use_nonce: true
        use_pkce: true
        revoke_tokens_on_logout: true
        redirect_uri: "http://localhost:9080/anything/callback"
        #unauth_action: deny
        logout_path: "/anything/logout"
routes:
  - id: "test-app"
    uri: "/anything/*"
    plugin_config_id: 1
    upstream:
      nodes:
        "localhost:8081": 1
      type: roundrobin
#END

[dosubot[bot]]

Hey @Wareload! 👋 I'm here to help you with Apache APISIX and the OpenID Connect plugin. I can assist you with bug fixes, answering questions, and even becoming a contributor. Let's tackle these questions together!

1. Regarding the "deny" mode in the OpenID Connect plugin, I couldn't find specific information about specifying a custom login path. It might be intended for use with "bearer_only=true," but this isn't confirmed in the available documentation.

2. To redirect to a custom error page instead of the default 500 error page in Apache APISIX, you can use the response-rewrite plugin. Here's an example configuration:

   global_rules:  
     - id: 1  
       plugins:  
         response-rewrite:  
           vars: [[ "status","==",500 ]]  
           body: { "error" : "An unknown exception happened"}  

   This configuration checks if the response status is 500 and then rewrites the response body to a custom message ^[1].

3. For configuring multiple identity providers for different paths without overwriting the session cookie, I couldn't find specific guidance. This might require custom handling or further exploration of the plugin's capabilities.

4. When it comes to serving static content, there isn't specific guidance available. However, you might consider using proxy caching for dynamic content that benefits from caching, while static content could be hosted directly within the APISIX container if it suits your deployment model.

5. Contributions are indeed welcomed in various areas, including improving documentation and proposing new features. You can start by addressing issues tagged with "good first issue" or "help wanted" ^[2][3][4].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}