# Kong Plugin for Forward Authentication

**URL:** <https://discuss.konghq.com/t/kong-plugin-for-forward-authentication/7838>\
**Category:** General\
**Tags:** kubernetes, kong-gateway\
**Created:** [February 3, 2021, 2:38pm UTC](https://discuss.konghq.com/t/kong-plugin-for-forward-authentication/7838 "2021-02-03T14:38:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zigzagbond](https://avatars.discourse-cdn.com/v4/letter/z/b5a626/32.png) [@zigzagbond](https://discuss.konghq.com/u/zigzagbond)\
**Post date:** [February 3, 2021, 2:38pm UTC](https://discuss.konghq.com/t/kong-plugin-for-forward-authentication/7838/1 "2021-02-03T14:38:15Z")

</div>

I am looking for Kong Plugin for Ingress Controller where for every user request, it will first authenticate against an API endpoint and if the response is OK, it will redirect to actual user request.  
We have recently moved from Traefik to Kong and there is a similar [feature in Traefik](https://doc.traefik.io/traefik/v1.7/configuration/entrypoints/#forward-authentication)  
Any pointers would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![traines](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/traines/32/158_2.png) [@traines](https://discuss.konghq.com/u/traines)\
**Post date:** [February 3, 2021, 5:44pm UTC](https://discuss.konghq.com/t/kong-plugin-for-forward-authentication/7838/2 "2021-02-03T17:44:52Z")

</div>

The authentication scheme that Traefik doc covers doesn’t provide specifics, but it sounds similar to what [Open Policy Agent](https://www.openpolicyagent.org/) provides.

There are a few community plugins that integrate with OPA:

> **[wada-ama/kong-plugin-opa](https://github.com/wada-ama/kong-plugin-opa)**
>
> Integration of the Open Policy Agent (OPA) with the Kong API Gateway

> **[TravelNest/kong-authorization-opa](https://github.com/TravelNest/kong-authorization-opa)**
>
> Kong Plugin for Authorization (via Open Policy Agent)

---

<div class="post-metadata">

**Author:** ![zigzagbond](https://avatars.discourse-cdn.com/v4/letter/z/b5a626/32.png) [@zigzagbond](https://discuss.konghq.com/u/zigzagbond)\
**Post date:** [February 4, 2021, 3:43am UTC](https://discuss.konghq.com/t/kong-plugin-for-forward-authentication/7838/3 "2021-02-04T03:43:24Z")

</div>

Thanks for your reply.  
In the Traefik, we were doing like below

```
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ngnpb-ingress
  namespace: ngnpb
  annotations:
    kubernetes.io/ingress.class: traefik
    ingress.kubernetes.io/protocol: h2c
    ingress.kubernetes.io/auth-type: forward
    ingress.kubernetes.io/auth-url: http://mgmt-security.ngnpb.svc.cluster.local:29091/validateToken
    ingress.kubernetes.io/auth-response-headers: Authorization, Role, User
spec:
  rules:
  - http:
      paths:
      - path: /api
        backend:
          serviceName: mgmt-security
          servicePort: 29092

```

As you can see above, in the annotations we are providing _ **auth-url** _, so every request to _ **/api** _  
will first go to auth-url and if user is authenticated then only it will redirect to _ **/api** _.  
Hope this is clear now.

---

<div class="post-metadata">

**Author:** ![alexanderccc](https://avatars.discourse-cdn.com/v4/letter/a/35a633/32.png) [@alexanderccc](https://discuss.konghq.com/u/alexanderccc)\
**Post date:** [January 31, 2025, 3:16am UTC](https://discuss.konghq.com/t/kong-plugin-for-forward-authentication/7838/4 "2025-01-31T03:16:22Z")

</div>

Any updates on this?  
I’ve been happily using Kong for a long time now and with the recent introduction of Authentik in my cluster, I’d like to leverage forward auth with it, rather than having another proxy to handle this.

Right now I use a caddy proxy after Kong to handle the forward auth with the implementation described here

> **[Caddy | authentik](https://docs.goauthentik.io/docs/add-secure-apps/providers/proxy/server_caddy)**
>
> The configuration template shown below apply to both single-application and domain-level forward auth.

Has anyone been able to develop a plugin to handle this in Kong or has any tips on how this could be implemented with it?