Authentication

Basic Auth in Kong

Basic Authentication may seem like a trivial mechanism because it only uses a username and a password. However, using it correctly means separating three ideas: the HTTP standard, the validation performed by Kong Gateway, and the identity that Kong associates with valid credentials. In this article we will look at those three layers and build a reproducible lab with Kong Ingress Controller. The goal is not simply to copy files and blindly apply them. First we will understand what each resource represents, then we will apply it, and finally we will check what happens inside Kong.

Sunday, July 26, 2026 | 8 minutes Read

Key Auth in Kong

An API key may look like little more than a random string that a client adds to every request. To use it correctly, however, it helps to separate three ideas: the credential presented by the client, the validation performed by Kong Gateway, and the identity of the Consumer associated with that credential. This article covers those three layers and builds a reproducible lab with Kong Ingress Controller. We will first understand each resource, then apply it, and finally verify what happens inside Kong.

Sunday, July 26, 2026 | 8 minutes Read

HMAC Auth in Kong

HMAC Authentication proves that a request was created by a client that knows a shared secret without sending that secret in the request. In addition to authenticating the client, the signature detects changes to the signed elements while they are in transit. This article explains how an HMAC signature is built and validated by Kong Gateway, and how the Consumer relates to its credential. We then build a reproducible Kong Ingress Controller lab and protect /hmac-auth.

Sunday, July 26, 2026 | 7 minutes Read

JWT Auth in Kong

A JSON Web Token carries claims about an identity inside a signed token. Kong can verify its signature and time constraints before the request reaches the backend. This article separates the token structure, the cryptographic credential stored in Kong, and the Consumer representing the client. We then build a reproducible Kong Ingress Controller lab with an HS256-signed JWT and a /jwt route. This lab continues directly from Installing KIC. It reuses the kong Gateway, the echo Service, and the 192.168.121.200 address assigned by MetalLB to kong-gateway-proxy.

Sunday, July 26, 2026 | 7 minutes Read

Session in Kong

The Session plugin lets an authenticated client reuse its identity through a cookie. It does not authenticate clients on its own and must work alongside another mechanism that validates the first request. This lab combines Session with Key Auth. The first request presents an API key, Kong creates a session, and later requests use only the cookie. We also configure an explicit anonymous branch to prevent requests without either credential from reaching the backend.

Sunday, July 26, 2026 | 7 minutes Read

LDAP Auth in Kong

LDAP Authentication lets Kong validate a username and password directly against a corporate directory. The backend does not receive those credentials and does not need to implement LDAP. This article explains how the authentication header is built, how Kong locates the user in the directory, and how to protect /ldap-auth through Kong Ingress Controller. This lab continues from Installing KIC. It reuses the kong Gateway, the echo Service, and the 192.168.121.200 address assigned by MetalLB to kong-gateway-proxy.

Sunday, July 26, 2026 | 5 minutes Read