This is an automated email from the ASF dual-hosted git repository.
nic-6443 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new a4bacbdaae feat(ldap-auth): add hide_credentials (#13832)
a4bacbdaae is described below
commit a4bacbdaaec19c15f95d770acdf8b360e46e3484
Author: Nic <[email protected]>
AuthorDate: Tue Aug 18 11:44:54 2026 +0800
feat(ldap-auth): add hide_credentials (#13832)
---
apisix/plugins/ldap-auth.lua | 9 ++-
docs/en/latest/plugins/ldap-auth.md | 1 +
docs/zh/latest/plugins/ldap-auth.md | 1 +
t/plugin/ldap-auth.t | 117 ++++++++++++++++++++++++++++++++++++
4 files changed, 127 insertions(+), 1 deletion(-)
diff --git a/apisix/plugins/ldap-auth.lua b/apisix/plugins/ldap-auth.lua
index b22e0ed8b7..b45aefdaf4 100644
--- a/apisix/plugins/ldap-auth.lua
+++ b/apisix/plugins/ldap-auth.lua
@@ -31,6 +31,7 @@ local schema = {
use_tls = { type = "boolean", default = false },
tls_verify = { type = "boolean", default = false },
uid = { type = "string", default = "cn" },
+ hide_credentials = { type = "boolean", default = false },
realm = schema_def.get_realm_schema("ldap"),
},
required = {"base_dn","ldap_uri"},
@@ -162,7 +163,13 @@ function _M.rewrite(conf, ctx)
end
consumer_mod.attach_consumer(ctx, consumer, consumer_conf)
- core.log.info("hit basic-auth access")
+ -- the header carries the directory password, which is usually reusable
+ -- beyond this API, so it should not reach the upstream unless asked for
+ if conf.hide_credentials then
+ core.request.set_header(ctx, "Authorization", nil)
+ end
+
+ core.log.info("hit ldap-auth access")
end
return _M
diff --git a/docs/en/latest/plugins/ldap-auth.md
b/docs/en/latest/plugins/ldap-auth.md
index 0515d59b60..a2c51dd039 100644
--- a/docs/en/latest/plugins/ldap-auth.md
+++ b/docs/en/latest/plugins/ldap-auth.md
@@ -55,6 +55,7 @@ For Route:
| use_tls | boolean | False | `false` | If set to `true` uses TLS.
|
| tls_verify| boolean | False | `false` | Whether to verify the
server certificate when `use_tls` is enabled; If set to `true`, you must set
`ssl_trusted_certificate` in `config.yaml`, and make sure the host of
`ldap_uri` matches the host in server certificate. |
| uid | string | False | `cn` | uid attribute.
|
+| hide_credentials | boolean | False | `false` | If true, do not pass the
`Authorization` request header to the Upstream service. The header carries the
directory password, which is usually reusable beyond this API. |
| realm | string | False | ldap | The realm to include in the
`WWW-Authenticate` header when authentication fails. |
## Enable plugin
diff --git a/docs/zh/latest/plugins/ldap-auth.md
b/docs/zh/latest/plugins/ldap-auth.md
index 5ecd0b83ae..a34b6a448e 100644
--- a/docs/zh/latest/plugins/ldap-auth.md
+++ b/docs/zh/latest/plugins/ldap-auth.md
@@ -51,6 +51,7 @@ Route 端：
| use_tls | boolean | 否 | false | 如果设置为 `true` 则表示启用 TLS。
|
| tls_verify| boolean | 否 | false | 是否校验 LDAP 服务器的证书。如果设置为
`true`，你必须设置 `config.yaml` 里面的 `ssl_trusted_certificate`，并且确保 `ldap_uri` 里的
host 和服务器证书中的 host 匹配。 |
| uid | string | 否 | cn | UID 属性。
|
+| hide_credentials | boolean | 否 | false | 如果设置为 `true`，则不会将 `Authorization`
请求头传递给上游服务。该请求头中携带的目录密码通常在本 API 之外也可复用。|
| realm | string | 否 | ldap |在身份验证失败时，应包含在 `WWW-Authenticate` 标头中的域。|
## 启用插件
diff --git a/t/plugin/ldap-auth.t b/t/plugin/ldap-auth.t
index 95c370832d..8b31aa6b6f 100644
--- a/t/plugin/ldap-auth.t
+++ b/t/plugin/ldap-auth.t
@@ -731,3 +731,120 @@ Authorization: Basic Y29tbWEsdXNlcjpjb21tYXBhc3M=
hello world
--- error_log
find consumer commauser
+
+
+
+=== TEST 33: enable ldap-auth without hide_credentials
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "user01",
+ "plugins": {
+ "ldap-auth": {
+ "user_dn": "cn=user01,ou=users,dc=example,dc=org"
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ ngx.say(body)
+ return
+ end
+
+ code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "ldap-auth": {
+ "base_dn": "ou=users,dc=example,dc=org",
+ "ldap_uri": "127.0.0.1:1389",
+ "uid": "cn"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/uri"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 34: the credentials reach the upstream
+--- request
+GET /uri
+--- more_headers
+Authorization: Basic dXNlcjAxOnBhc3N3b3JkMQ==
+--- response_body
+uri: /uri
+authorization: Basic dXNlcjAxOnBhc3N3b3JkMQ==
+host: localhost
+x-consumer-username: user01
+x-real-ip: 127.0.0.1
+
+
+
+=== TEST 35: enable ldap-auth with hide_credentials
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "ldap-auth": {
+ "base_dn": "ou=users,dc=example,dc=org",
+ "ldap_uri": "127.0.0.1:1389",
+ "uid": "cn",
+ "hide_credentials": true
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/uri"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 36: the credentials do not reach the upstream
+--- request
+GET /uri
+--- more_headers
+Authorization: Basic dXNlcjAxOnBhc3N3b3JkMQ==
+--- response_body
+uri: /uri
+host: localhost
+x-consumer-username: user01
+x-real-ip: 127.0.0.1
