How a Kong Basic Auth Plugin can be restricted to set of consumers?

[sasahoo-tibco]

I have set up the basic auth Kong Plugin and created a Consumer using a Kubernetes secret. This configuration works for all consumers using that secret. I have an ingress that uses this plugin. However, I want the Kong Plugin to work only with a specific set of consumers, not all. Specifically, I would like to know if the Kong Plugin can be configured to work with a single consumer.

For example:

Ingress 'A' uses Kong Basic Auth Plugin 'Ka' and should work only with Consumer 'A'.
Ingress 'B' uses Kong Basic Auth Plugin 'Kb' and should work only with Consumer 'B'.
Ingress 'A' should not authenticate Consumer 'B', and Ingress 'B' should not authenticate Consumer 'A'.

Is there a solution for this scenario?

[makhil006]

Hi,

You can create a custom plugin or a pre-function plugin that checks the username in the access phase and rejects the call if needed.

if kong.client.get_consumer().username ~= "A" then
return kong.response.exit(403, "Forbidden")
end

And you apply varying versions of this plugin with different conditions to different routes you have.

https://docs.konghq.com/hub/kong-inc/pre-function/

https://docs.konghq.com/gateway/latest/plugin-development/pdk/

[hanshuebner]

Continued in #13374