Consumers

A consumer represents a user, application, or host that sends requests to the API gateway and consumes backend services. It is used together with the authentication system. Every consumer should be configured with at least one authentication plugin.

The following diagram illustrates an example of API7 Enterprise with one route and two consumers. One consumer, FetchBot, is a data fetching bot, and the other consumer, JohnDoe, is a user. The route and consumers are enabled with the key-auth plugin. Therefore, requests will be authenticated with API keys. To access the internal service, FetchBot sends its requests with bot-key and JohnDoe sends his request with john-key.

This configuration ensures that only authenticated requests can interact with the internal service exposed on /petstore.

• If a request is sent to API7 Enterprise without any key or with the wrong key, the request is rejected.
• If a request is sent to API7 Enterprise with bot-key, the request is authenticated and sent by FetchBot to fetch data from the internal service. The limit-count rate limiting plugin on the FetchBot consumer takes effect, limiting the number of requests within a 5-second window to 2. If the rate-limiting threshold has not been met, the request is forwarded to the upstream service. Otherwise, it is rejected.
• If a request is sent to API7 Enterprise with john-key, the request is authenticated and sent by JohnDoe, subsequently being forwarded to the upstream endpoint.

In this scenario, the authentication plugin is executed before the limit-count rate limiting plugin in accordance with the plugins execution phases.

Consumer Authentication & Authorization

There are two main design patterns for building authentication and authorization in an API7 Enterprise-based architecture.

The first and most commonly adopted approach is to authenticate and authorize requests through a third-party identity provider (IdP), such as Keycloak:

In some environments, a request might need to go through more than one IdP before it can be forwarded to the upstream endpoints. In such cases, you can configure multiple authentication plugins, each corresponding to an IdP on one consumer. API7 Enterprise will not show a successful response until all IdPs have granted access to the request.

The second and more basic approach is to perform authentication and authorization on the API gateway itself, using key-auth, basic-auth, jwt-auth, hmac-auth plugins:

Related Topic

• Manage Consumer Credentials.