Steps to test:
1) Create workspace
curl --request POST \
--url http://localhost:8001/workspaces \
--header 'Content-Type: multipart/form-data' \
--header 'kong-admin-token: <token>' \
--form name=teamA
2) Create Service
curl --request POST \
--url http://localhost:8001/teamA/services \
--header 'Content-Type: multipart/form-data' \
--header 'kong-admin-token: <token>' \
--form name=mockbin \
--form url=http://mockbin.org/request
3) Create Route
curl --request POST \
--url http://localhost:8001/teamA/services/mockbin/routes \
--header 'Content-Type: multipart/form-data' \
--header 'kong-admin-token: <token>' \
--form name=mockbin \
--form paths=/mockbin
4) Create OAuth2 plugin
curl --request POST \
--url http://localhost:8001/teamA/services/mockbin/plugins \
--header 'Content-Type: multipart/form-data' \
--header 'kong-admin-token: admin' \
--form name=oauth2 \
--form config.scopes=email \
--form config.enable_authorization_code=true \
--form config.enable_client_credentials=true
5) Create consumer
curl --request POST \
--url http://localhost:8001/teamA/consumers \
--header 'Content-Type: multipart/form-data' \
--header 'kong-admin-token: admin' \
--form username=user1
At this point we can generate tokens successfully.
Example call:
curl --request POST -k \
--url 'https://localhost:8443/mockbin/oauth2/token' \
--header 'Content-Type: multipart/form-data' \
--header 'kong-admin-token: admin' \
--form client_id=456 \
--form client_secret=789 \
--form grant_type=client_credentials
To begin Rate Limiting them we need to do the following:
6) Create a service with the /oauth2/token endpoint.
curl --request POST \
--url http://localhost:8001/teamA/services \
--header 'Content-Type: application/json' \
--header 'Kong-Admin-Token: admin' \
--data '{
"name": "Oauth",
"retries": 0,
"host": "localhost",
"path": "/mockbin/oauth2/token",
"port": 8443,
"protocol":"https"
}'
7) Create a route for the previous service
curl --request POST \
--url http://localhost:8001/teamA/services/Oauth/routes \
--header 'Content-Type: multipart/form-data' \
--header 'kong-admin-token: admin' \
--form name=oauthRoute \
--form paths=/oauth
At this point we can call the new service/route to generate a token.
8) Add a Rate Limiting Advanced (RLA) plugin.
curl --request POST \
--url http://localhost:8001/teamA/services/mockbin/plugins \
--header 'Content-Type: application/json' \
--header 'kong-admin-token: admin' \
--data '{
"name": "rate-limiting-advanced",
"config":
{
"limit":[3],
"window_size":[30],
"sync_rate": -1,
"strategy": "local"
}
}'
We can now proxy the token endpoint for exactly 3 times in 30 seconds and then it will rate limit the token creation.
Direct access to the token endpoint is still possible and should be blocked using external means if this is a requirement.