This topic describes how to configure an Alibaba Cloud Microservices Engine (MSE) application in IDaaS. This protects routes in your cloud-native gateway by requiring users to authenticate through IDaaS before access.
To simplify the process, IDaaS provides a pre-integrated application template for MSE. As an administrator, create the MSE application in IDaaS, then complete the configuration in your cloud-native gateway using the OpenID Connect (OIDC) protocol.
Application overview
Microservices Engine (MSE) is designed for mainstream open source microservice projects. It provides a registry, configuration center, and distributed coordination capabilities (with native support for Nacos, ZooKeeper, and Eureka), a cloud-native gateway (with native support for Ingress and Envoy), and microservice governance (with native support for Spring Cloud, Dubbo, and Sentinel, compliant with the OpenSergo service governance specification).
Procedure
Step 1: Create an MSE application
Log on to the IDaaS console.
Select an IDaaS instance and click Console.
Navigate to Applications > Add Application > Marketplace, search for Alibaba Cloud - MSE cloud-native gateway, and then click Add Application.
Confirm the application name to add it. IDaaS automatically redirects you to the Single Sign-on configuration page.
Fill in the form.
Form parameters:
For Grant Types, ensure only Authorization Code is selected.
Make sure that PKCE is not selected.
Redirect URIs: Set this value to <MSE gateway access address>+/oauth2/callback. For example, if your MSE access address is http://a.example.com, the redirect URI must be http://a.example.com/oauth2/callback. This URI must match the value in the Redirect URL field of the MSE authentication and authorization settings.
For Authorize, you can select Authorize for testing purposes. To grant access to specific IDaaS accounts, see Application authorization.
Click Save to complete the application configuration.
Copy the following values for the MSE configuration.
Parameters:
Issuer: Obtain this from the application configuration information at the bottom of the page.
client_id: Obtain this from the General tab of the application management page.
client_secret: Obtain this from the General tab of the application management page.
You have completed the IDaaS configuration. Next, go to the MSE console to enable authentication.
Step 2: Configure gateway authentication
The configuration in MSE consists of four steps. Due to caching, some configuration changes may take 3 to 5 minutes to take effect.
Enable an Internet NAT gateway
To enable gateway authentication, MSE must communicate with IDaaS. Therefore, you must ensure that the Virtual Private Cloud (VPC) where your MSE is located has outbound internet access. Otherwise, MSE may use a stale cached record when initiating an authentication request, causing the request to fail.
Go to the Alibaba Cloud VPC Internet NAT gateway console to create an Internet NAT gateway and ensure smooth outbound internet access.
Gateway management
Log on to the Alibaba Cloud Microservices Engine (MSE) console.
In the left-side navigation pane, go to .
Click the name of the gateway to protect to open its management page. If you have not created a gateway, you can create one to test the authentication configuration.
Create a test route (optional)
For easier testing, we recommend that you first add a test route in the MSE gateway so you can quickly verify the end-to-end authentication flow.
If you already have a route, you can skip this step. In the next step, add your route path to Blacklist Mode to enable protection.
Configure a mock route
For configuration details, see the MSE documentation: Manage services in MSE Nacos by using a cloud-native gateway.
After the configuration is complete, you can use the /mock path in subsequent steps to test the gateway authentication configuration.
Configure a local hosts file
For security reasons, the MSE authentication flow restricts the use of an IP address as the callback address.
If your MSE gateway does not have a domain name, you must configure a mapping in your local hosts file. Then, in both the MSE and IDaaS forms, use the mapped domain name instead of an IP address.
Assuming the public IP address of your MSE gateway is 47.96.xxx.xxx, add the following line to the local hosts file on your device:
47.96.xxx.xxx a.example.comUse a.example.com instead of the public IP address to access the MSE gateway. In IDaaS, the application's Redirect URIs should be set to http://a.example.com/oauth2/callback. The Redirect URL in the gateway's authentication and authorization settings must be set to the same value.
Configure authentication and authorization
Now, enable authentication and authorization in MSE.
In the left-side navigation pane of the gateway management page, go to Security > Authentication.
Click Create Authentication and fill in the form.
Parameter | Description |
Authentication Name | Enter a custom name. |
Authentication Type | Select OIDC. The list also includes IDaaS, which corresponds to an earlier version of IDaaS. If you are using the current version of IDaaS, select OIDC. |
Issuer | Copied from the IDaaS application management page. |
Redirect URL | If you configured a local hosts file mapping in the previous step, enter http://a.example.com/oauth2/callback. Otherwise, enter the public domain name of your MSE gateway. This value must be a domain name, not an IP address. |
Client-ID | Copied from the IDaaS application management page. |
Client-Secret | Copied from the IDaaS application management page. |
Cookie-Domain | If you configured a local hosts file mapping in the previous step, enter a.example.com. Otherwise, enter the public domain name of your MSE gateway. |
Scope | Set this value to |
Authorization | For testing, select Blacklist Mode. This means only the specified paths require authentication. Click Add Rule Condition and specify that access to the
|
The configuration looks like this:
After creating the authentication rule, click Enable.
Configure the oauth2-proxy route. After enabling gateway authentication and authorization, MSE automatically creates an OIDC companion route to handle the authorization callback.
In the left-side navigation pane, click Route Configuration and find the oauth2-proxy route that is in the Unpublished state.
Click Edit for that route, click Next without making changes, and then click Save and Publish.
You have completed all configurations. Now, you can test the authentication flow.
Step 3: Verify access
1. Access the URL
In a browser, open http://a.example.com/mock or the protected address that you configured in the previous steps.
MSE detects that the request requires IDaaS authentication. If you are not logged in to IDaaS, you are automatically redirected to the IDaaS login page.
2. Authenticate
Use any authentication method enabled in IDaaS, such as SMS verification codes, DingTalk QR code scanning, or Active Directory (AD) login. Administrators can also enable multi-factor authentication (MFA) in IDaaS to improve security.
3. Confirm success
After you log in, the browser redirects to your requested address and displays the expected result, confirming successful authentication.
