Mutual TLS Authentication Configuration

このページは、まだ日本語ではご利用いただけません。翻訳中です。

古いプラグインバージョンのドキュメントを閲覧しています。

構成

このプラグインはDBレスモードに対応しています。

互換性のあるプロトコル

Mutual TLS Authenticationプラグインは以下のプロトコルに対応しています：

grpc, grpcs, http, https

パラメータ

このプラグインの設定で使用できるすべてのパラメータのリストは次のとおりです。

• name or plugin

  string required

  プラグイン名。この場合は mtls-auth 。

  • Kong Admin API、Kong Konnect API、宣言型構成、または decK ファイルを使用する場合、フィールドはnameです。
  • Kubernetes で KongPlugin オブジェクトを使用する場合、フィールドはpluginです。

• service.name or service.id

  string

  プラグインが対象とするサービス名または ID。最上位の /plugins エンドポイント. からプラグインをサービスに追加する場合は、これらのパラメータのいずれかを設定してください /services/{serviceName|Id}/plugins を使用する場合は必要ありません。

• route.name or route.id

  string

  プラグインがターゲットとするルート名または ID。最上位の /plugins エンドポイント. を通るルートにプラグインを追加する場合は、これらのパラメータのいずれかを設定してください /routes/{routeName|Id}/plugins を使用する場合は必要ありません。

• enabled

  boolean default: true

  このプラグインが適用されるかどうか。

• config

  record required
  • anonymous

    string

    An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure 4xx. Note that this value must refer to the consumer id or username attribute, and not its custom_id.

  • consumer_by

    array of type string default: username, custom_id Must be one of: username, custom_id

    Whether to match the subject name of the client-supplied certificate against consumer’s username and/or custom_id attribute. If set to [] (the empty array), then auto-matching is disabled.

  • ca_certificates

    array of type string required

    List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (id).

  • cache_ttl

    number required default: 60

    Cache expiry time in seconds.

  • skip_consumer_lookup

    boolean required default: false

    Skip consumer lookup once certificate is trusted against the configured CA list.

  • allow_partial_chain

    boolean required default: false

    Allow certificate verification with only an intermediate certificate. When this is enabled, you don’t need to upload the full chain to Kong Certificates.

  • authenticated_group_by

    string default: CN Must be one of: CN, DN

    Certificate property to use as the authenticated group. Valid values are CN (Common Name) or DN (Distinguished Name). Once skip_consumer_lookup is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL plugin (not covered here) and create allowed or denied groups of users.

  • revocation_check_mode

    string default: IGNORE_CA_ERROR Must be one of: SKIP, IGNORE_CA_ERROR, STRICT

    Known Issue: The default value IGNORE_CA_ERROR has a known issue in versions 1.5.0.0 and later.m As a workaround, manually set the value to SKIP.

    Controls client certificate revocation check behavior. Valid values are SKIP, IGNORE_CA_ERROR, or STRICT. If set to SKIP, no revocation check is performed. If set to IGNORE_CA_ERROR, the plugin respects the revocation status when either OCSP or CRL URL is set, and doesn’t fail on network issues. If set to STRICT, the plugin only treats the certificate as valid when it’s able to verify the revocation status, and a missing OCSP or CRL URL in the certificate or a failure to connect to the server results in a revoked status. If both OCSP and CRL URL are set, the plugin always checks OCSP first, and only checks the CRL URL if it can’t communicate with the OCSP server.

  • http_timeout

    number default: 30000

    HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.

  • cert_cache_ttl

    number default: 60000

    The length of time in milliseconds between refreshes of the revocation check status cache.

  • send_ca_dn

    boolean default: false

    Sends the distinguished names (DN) of the configured CA list in the TLS handshake message.

  • http_proxy_host

    string

  • http_proxy_port

    integer between: 0 65535

    The HTTP hostname or IP address of a proxy. Use this setting with http_proxy_port to access a certificate revocation list (CRL) or an OCSP server.

    Required if http_proxy_port is set.

  • https_proxy_host

    string

    The HTTPS hostname or IP address of a proxy. Use this setting with https_proxy_port to access a certificate revocation list (CRL) or an OCSP server.

    Required if https_proxy_port is set.

  • https_proxy_port

    integer between: 0 65535

    The TCP port of the HTTPS proxy.

    Required if https_proxy_host is set.