Authentication

What is authentication?

Authentication is the process of verifying that a requester has permissions to access a resource. As its name implies, API gateway authentication controls the flow of data between clients and the gateway.

With Kong Gateway controlling authentication, requests won’t reach upstream services unless the client has successfully authenticated. This means upstream services process pre-authorized requests, freeing them from the cost of authentication, which is a savings in compute time and development effort.

Kong Gateway has a library of plugins that support the most widely used methods of API gateway authentication.

Why is authentication important?

Kong Gateway authentication plugins protect your upstream services from unauthorized access. This means upstream services process pre-authorized requests, freeing them from the cost of authentication, which is a savings in compute time and development effort.

Kong Gateway offers tools that give visibility into all authentication attempts, which provides the ability to build monitoring and alerting capabilities supporting Service availability and compliance.

For more information, see What is API Gateway Authentication in our Learning Center.

Using multiple authentication methods

You can configure multiple authentication plugins, such as Basic Authentication and Key Authentication, on a Gateway Service. This allows clients to use different authentication methods to access the associated Gateway Service or Route. When multiple authentication plugins are configured, they must all either be configured to always perform authentication or to only perform authentication if the Consumer wasn’t already authenticated. This configuration is controlled by the config.anonymous property in the plugin schema:

• When config.anonymous is not set: Authentication is always performed and a 4xx error is returned if the Consumer isn’t validated. With this method, the last plugin executed will be the one setting the credentials passed to the upstream service.
• When config.anonymous is set to a valid Consumer: Authentication is only performed if the Consumer isn’t already authenticated. When authentication fails, it won’t return a 40x response. Instead, it sets the anonymous Consumer as the Consumer. With this method, the first plugin that successfully authenticates the Consumer sets the credentials passed to the upstream service or the last plugin that sets its configured anonymous Consumer.

If you enable anonymous access so that authentication isn’t always performed but you don’t want unauthorized users to access the Gateway Service or Route, you can configure the Request Termination plugin on the anonymous Consumer.

Note: If you configure the OAuth2 plugin and don’t set config.anonymous, then the OAuth2 endpoints for requesting tokens and so forth will require authentication by the other configured auth plugins.

• Allow clients to choose their authentication methods and prevent unauthorized accessView →
• Automatically create and manage Dev Portal applications in Auth0 with Dynamic Client RegistrationView →
• Authenticate Consumers with the JWT pluginView →
• Authenticate Consumers with basic authenticationView →
• Enable key authentication on a Gateway Service with Kong GatewayView →
• View More →