How to configure rate-limiting on consumer

bel81 · October 19, 2021, 1:37pm

Hello,

I have created a consumer with username=XXX and custom.id=XXX and attached to him the rate-limit plug-in.
Then I have set the global LDAP authentication plugin name=“ldap-auth”. The ldap-auth plug-in works well having
“Authentication base64(username:password)” headers. But it seems that the “username=XXX” is not matched with the consumer XXX as rate-limits are not applied.

I have created the rate-limit plug-in with the following request:

curl -X POST http://localhost:8001/consumers/XXX/plugins
–data “name=rate-limiting”
–data “config.minute=2”
–data “config.policy=cluster”

When I send 3 requests on behalf of the user XXX, it does not prevent me from sending more requests.
On the other hand, when I set the rate-limit plug-in on route, it works.

How is the mapping of the API request to the consumer entity done?
I use docker image of the latest Kong version (2.6.0)

Update on troubleshooting:

I’ve used “key-auth” to match API request with the consumer. So i assume it is matched with the defined consumer, however no information headers are returned back to client, such as:

RateLimit-Limit: 6
RateLimit-Remaining: 4
RateLimit-Reset:

On the other hand, when I set rate-limiting plug-in on a route then I get these headers back and it works.

Update: I have cleared by Postgres DB of Kong and completely redone the following basic scenario

github.com/Kong/kong

Rate Limiting by consumer id not working

opened 02:33PM - 18 May 21 UTC

closed 08:46AM - 27 May 21 UTC

eseite47

pending author feedback plugins/rate-limiting

### Summary I have two rate limiting plugins set up on a route: one for all c…onsumers, and one for a specific consumer id. I would expect the more specific plugin to apply when calling the route (per #6553) but no matter what i try, only the rate limiting apply to all consumers apply. ### Steps To Reproduce 1. Route Set Up ``` { "id": "b3b[...]", "path_handling": "v0", "paths": [ "\/v1\/my-route" ], "destinations": null, "headers": {}, "protocols": [ "http", "https" ], "created_at": 1610120374, "snis": [], "service": { "id": "136[...]" }, "name": "my-route", "strip_path": false, "preserve_host": false, "regex_priority": 0, "updated_at": 1611150996, "sources": null, "methods": [], "https_redirect_status_code": 426, "hosts": [*redacted*], "tags": [] } ``` 2. Rate Limiting Plugin for all consumer on my-route ``` { "created_at": 1616501241, "id": "805[...]", "tags": [], "enabled": true, "protocols": [ "grpc", "grpcs", "http", "https" ], "name": "rate-limiting", "consumer": null, "service": null, "route": { "id": "b3b[...]" }, "config": { "hide_client_headers": false, "minute": 20, "policy": "cluster", "month": null, "redis_timeout": 2000, "limit_by": "consumer", "redis_password": null, "second": null, "day": null, "redis_database": 0, "year": null, "hour": null, "redis_host": null, "redis_port": 6379, "header_name": null, "fault_tolerant": true } } ``` 3. Rate Limiting Plugin for my-route for consumer 4c7 ``` { "created_at": 1621347893, "id": "59a[...]", "tags": null, "enabled": true, "protocols": [ "grpc", "grpcs", "http", "https" ], "name": "rate-limiting", "consumer": { "id": "4c7[...]" }, "service": null, "route": { "id": "b3b[...]" }, "config": { "hide_client_headers": false, "minute": 10, "policy": "cluster", "month": null, "redis_timeout": 2000, "limit_by": "consumer", "redis_password": null, "second": null, "day": null, "redis_database": 0, "year": null, "hour": null, "redis_host": null, "redis_port": 6379, "header_name": null, "fault_tolerant": true } } ``` When calling "my-route" with the API keys associated with the 4c7 consumer, I would expect my rate to get limited after 10 calls per minute, as defined above. Instead, I hit the rate limit after 20 request per minute, which is the limit for all consumers. When I disable the rate limit for all consumers, I do not get rate limited at all. What is the issue? How can I fix the configuration to reflect the rate limiting desired? Thanks in advance for the help! ### Additional Details & Logs - Kong version 2.1.0 I can provide more details if it becomes relevant

The result is the same. Only route rate-limiting plugin is applied.

Thanks for any hint or suggestions how to better troubleshoot it.

bel81 · October 20, 2021, 2:34pm

Actually, the referenced example above with httpbin API worked for me in the end.
So then I mounted into it my application and it worked as well.
But then I added the “ldap-auth” plug-in and I got to the problem that I described here.

Isn’t it a bug? I didn’t read anywhere that it cannot be used together.

fomm · October 20, 2021, 11:25pm

Hi bel81,

from what you describe, it seems that you have

LDAP auth → Global
Keyauth → on Route
rate limiting → Consumer

Did you use keyauth and LDAP at the same time? So when you authenticate, you need to pass in apiKey and Authorization basic header. Is that right?

bel81 · October 21, 2021, 6:25am

Hi fomm,

yes, i was using LDAP auth with Key auth and rate limiting at the same time.
I’ve tried LDAP auth globally and also on a route only.

I am actually using Authorization LDAP base64(username:password) header.
I’ve tried also to configure Key auth’s key as “Authorization” storing the “LDAP base64(username:password)” on the consumers/USERID/key-auth directly but having LDAP auth plug-in anywhere causes that the rate-limiting is not properly evaluated for the consumer.

fomm · October 21, 2021, 10:29am

I think that is because LDAP auth plugin does NOT have consumer mapping.

When you are using multiple authentication plugins in AND method, the last plugin executed sets the credential.

Because LDAP auth plugin has a lower priority(1002) than key auth (1003), LDAP auth plugin will be used for consumer mapping but it does not have this function.

You can verify that by using basic auth and LDAP auth plugin. See if you can get the header.

#################################################

I just tested it and basic auth + LDAP auth works as I expected.

bel81 · October 21, 2021, 1:03pm

Thanks for you time and the answer.

What I see as a problem is that I will have to provision users’ credentials in to Kong DB in order to be able to use rate-limits per client/consumer. Then the LDAP plugin is useless. One authentication is enough.

Topic		Replies	Views
Kong ingress controller rate-limit plugin seems to ignore consumer	6	694	February 27, 2020
Multiple Rate-Limit plugins on the same route Questions plugins	0	48	August 7, 2024
Configuring Rate limiting plugin Questions	9	1102	April 26, 2019
How to apply rate limiting for consumer without any credential plugin	0	263	June 29, 2023
Rate-limiting by credential Announcements	5	1115	August 27, 2018

How to configure rate-limiting on consumer

Related topics