Hi all, I’ve read through man . And did not figure out if it is possible to use authentication mechanism to deny api requests without valid token in http header. For example, I want to get a key by requesting /kv/:key(as it stipulated in the man) But how can I filter such kind of requests for thos…

Hi @rituzy , Have a look at the Consul ACLs. Using ACLs you will be able to set permissions against Consul KV entries. Sharing some links to the documentation below. Secure Consul with Access Control Lists (ACLs) | Consul - HashiCorp Learn ACL Rules | Consul by HashiCorp - KV ACL rules ACL Rules…

Hi @ Ranjandas Thank you for prompt reply. But all these documentations are about ACL. But what if I want to authenticate with keycloack server or validate JWT token came with incoming request? Maybe there is a way to use JWT authentication through ACL mechanism?

@rituzy , Yes you can authenticate external users using Consul Auth Methods and the users can be mapped to custom ACL roles using binding rules. - ACL Auth Methods | Consul by HashiCorp This guide shows how OIDC is configured with Auth0 as the backend - Authenticate Users with Single Sign-On (SSO) a…

Hi @rituzy , As @Ranjandas mentioned, Consul’s ACL system is the appropriate way to secure access to resources like KV entries, services, etc. Consul’s JWT auth method allows a user to authenticate with Consul using a valid JWT and obtain an ACL token based on information contained within the JWT …

Hi @Blake , thanks for you reply. Let me sum up this info and show the example. Purpose : client wants to get data from consul storage. Client sends PUT request to consul <consul-address>/acl/auth-method with payload : { “Name”: “client-name”, “Type”: “jet”, “Description”: “client connectio…

Hi @rituzy , [image] rituzy: Client sends PUT request to consul <consul-address>/acl/auth-method with payload : { “Name”: “client-name”, “Type”: “jet”, “Description”: “client connection”, “Config”: { " JWKSURL": “ https://my-corp-jwks-url.example.com/” } } This auth method should be pr…

Hi @blake , thank you so much for such a big explanation with quick example. But I failed to pass second step with calling /v1/acl/login method I send this put request /v1/acl/auth-method { "Name": "ja9", "Type": "jwt", "Description": "client connection", "Confi…

The things needs to do for working process are: create policy for accessing kv storage create role and link to the policy above create acl binding-rule to auth method created earlier(see previous replies here) Than it will be working as described earlier. Thanks guys, the topic is closed.

KV storage - get data only if authenticated

Consul

rituzy June 15, 2021, 7:13am 9

bump!
Btw could you please advise how can I get verbose security logs for authentication process?

Topic		Replies	Views
JWT Authentication and ACLs Consul	2	2120	August 17, 2020
Authenticating to consul KV from client VMs Consul	9	708	September 10, 2023
How to authenticate using the JWT auth method Consul	1	627	July 29, 2021
Permission Denied for login API while using JWT Consul	2	603	July 13, 2023
Consul ACL scope Consul acl	6	1490	January 6, 2022

KV storage - get data only if authenticated

Related topics