Ping + Kong + Cloudflare

techhadoop

How to integrate kong api gateway with ping identity and Cloudflare

Integrating Kong API Gateway with Ping Identity (for authentication) and Cloudflare (for CDN and DDoS protection) provides a secure and scalable architecture. Here’s how you can configure these integrations step by step:

1. Integrating Kong API Gateway with Ping Identity

Ping Identity provides authentication and authorization capabilities via OpenID Connect (OIDC) and SAML. Kong supports these standards through its plugins.

Step 1. Configure Ping Identity

  1. Set Up an Application in Ping Identity:
    • Log in to the Ping Identity admin console.
    • Create a new application and configure it for OIDC or SAML depending on your requirements.
    • Set the Redirect URI to point to Kong’s OIDC callback endpoint:
https://<KONG_URL>/oauth2/callback
  1. Retrieve the client ID, client secret, and the issuer URL from Ping Identity.
  2. Define User Scopes and Roles:
    • Configure the required scopes (e.g., read, write) and roles in Ping Identity.

Step 2. Configure Kong

  1. Install the OIDC Plugin:
    • Enable the OpenID Connect (OIDC) plugin on a service or route in Kong:

curl -i -X POST http://<KONG_ADMIN_URL>/services/<SERVICE_ID>/plugins \

     –data “name=openid-connect” \

     –data “config.issuer=https://<PING_IDENTITY_ISSUER>” \

     –data “config.client_id=<CLIENT_ID>” \

     –data “config.client_secret=<CLIENT_SECRET>” \

     –data “config.redirect_uri=https://<KONG_URL>/oauth2/callback” \

     –data “config.scopes=email profile openid”

  1. Customize the OIDC Plugin (Optional):
    • Configure additional settings like introspection endpoints, token lifetimes, and role mappings as needed.

Step 3. Test the Integration:

  • Use a client application to make a request to Kong.
  • The request should be redirected to Ping Identity for authentication.
  • Once authenticated, Kong will enforce the access policies.

2. Integrating Kong with Cloudflare

Cloudflare acts as a reverse proxy, providing features like SSL termination, caching, and DDoS protection.

Step 1. Set Up Cloudflare

  1. Point DNS to Cloudflare:
    • Update your domain’s DNS settings to route traffic through Cloudflare.
  2. Configure SSL:
    • Choose an SSL mode in Cloudflare (Full or Full Strict is recommended).
    • Install a Cloudflare origin certificate on Kong servers for secure communication between Cloudflare and Kong.

Step 2. Secure Kong with Cloudflare

  1. Restrict Direct Access to Kong:
    • Use a firewall to allow traffic only from Cloudflare IP ranges. Cloudflare publishes its IP list here.
  2. Enable Kong Rate Limiting Plugin:
    • Protect your APIs from excessive usage:

curl -i -X POST http://<KONG_ADMIN_URL>/services/<SERVICE_ID>/plugins \

     –data “name=rate-limiting” \

     –data “config.minute=100” \

     –data “config.hour=1000”

Step 3. Configure Cloudflare Caching and Security:

  • Enable caching for static responses if applicable.
  • Turn on DDoS protection and configure WAF (Web Application Firewall) rules to block malicious traffic.

3. Combined Workflow: Kong + Ping Identity + Cloudflare

  1. Client Requests:
    • Clients send requests to Cloudflare, which routes them to Kong.
  2. Authentication with Ping Identity:
    • Cloudflare forwards the request to Kong.
    • If authentication is required, Kong redirects the user to Ping Identity.
    • Ping Identity authenticates the user and issues tokens, which Kong validates.
  3. API Routing and Response:
    • Kong routes the request to the upstream service and applies plugins (rate limiting, transformations, etc.).
    • The response is sent back through Cloudflare to the client.

Diagram

This integration combines Kong, Ping Identity, and Cloudflare into a secure and efficient architecture.

High-Level Diagram:

  1. Client → Cloudflare: Traffic flows through Cloudflare for SSL termination and security.
  2. Cloudflare → Kong: Cloudflare forwards traffic to Kong.
  3. Kong ↔ Ping Identity: Kong integrates with Ping Identity for authentication and token validation.
  4. Kong → Upstream Service: Kong forwards authenticated and authorized requests to backend services.

Leave a comment