doc: add API7 Authentication #24
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,50 @@ | ||||||
| --- | ||||||
| title: Portal文档：API7 Authentication | ||||||
| --- | ||||||
|
|
||||||
| ## 一、认证方案架构说明 | ||||||
|
|
||||||
| API7 认证用于 API7 Portal 系统中，给 Developer 访问 Provider 提供的上游服务提供身份认证能力。 | ||||||
| 相较于传统的 Developer 直接认证于 API Endpoints （如下图一所示），API7 认证（如下图二所示）升级为 Developer 与 API7 Portal 之间统一通过 API key 认证，API7 Portal 与 API Endpoints 之间保持原有认证方式。 | ||||||
|
|
||||||
|  | ||||||
|
|
||||||
| 图一 传统认证方案：Developer 直接认证于 API Endpoints | ||||||
|
|
||||||
|  | ||||||
|
|
||||||
| 图二 API7 认证 | ||||||
|
|
||||||
|
|
||||||
| ## 二、认证方案优势说明 | ||||||
|
|
||||||
| API7 认证具有如下优势： | ||||||
| 1. 简化了 Developer 对 API 的调用，无需感知适配 API Endpoints 提供的的各种不同认证方式； | ||||||
| 2. 将 Developer 对 API Endpoints 的访问进行解耦、大大增加了 API Endpoints 抵御攻击的能力； | ||||||
| 3. Developer 可以自己管控 API key，增加了 Developer 对 API 的调度安全，并且方便 Developer 后续对基于 key 的调度进行运营分析； | ||||||
|
|
||||||
|
|
||||||
| ## 三、API Key 的安全性保障 | ||||||
|
|
||||||
| ### API7 Portal 提供 API Key 的发放和回收机制 | ||||||
| 1. Developer 可以自己创建 API key，并且自己命名，方便后续使用时分辨，不过 API key 是由 API7 Portal 的后端服务按照一定的规则主动生成的，Developer 不可编辑； | ||||||
|
||||||
| 1. Developer 可以自己创建 API key，并且自己命名，方便后续使用时分辨，不过 API key 是由 API7 Portal 的后端服务按照一定的规则主动生成的，Developer 不可编辑； | |
| 1. Developer 可以自己创建 API key，并且自己命名，方便后续使用时分辨，不过 API key 的内容是由 API7 Portal 的后端服务按照一定的规则主动生成的，Developer 不可编辑； |
Outdated
Contributor
There was a problem hiding this comment.
将来要支持多种的，暂时只有key-auth
Outdated
Contributor
There was a problem hiding this comment.
这些认证都是 client => APISIX 的，不是 APISIX -> Upstream 的。
Contributor
There was a problem hiding this comment.
这里说的是 API Portal => API Endpoints 的吧。
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
这一句话我不是很理解，是给 Developer 访问我们数据面提供的身份认证能力吧。
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
用户关心的是developer到provider。我们要在这篇文档说清楚我们是拆成两节了，中间做了一层中转