Claim based routing / partition routing

[mogliang]

Expected Behavior / New Feature

we have one service with several deployed instances, each instances serve a group of users. we use this way to do horizontal scaling.

Right now, we want to use gateway as the single api address for all instances, each http request will attach token with claim which indicates the userid. I'm wondering if Ocelot can help on this scenario?

Actual Behavior / Motivation for New Feautre

Specifications

• Version:
• Platform:
• Subsystem:

[TomPallister]

@mogliang thanks for your interest in Ocelot!

At the moment you cannot do this with Ocelot. However it is an interesting idea. I will think about it and get back to you ASAP!

[TomPallister]

Expected Behavior / New Feature
I'm looking for direction on how to route to a specific downtream resource based on a value in .net identity claim. Ex) user has claim TenantId = "xxx" and this would route them to a specic downstream resource I have setup.

Actual Behavior / Motivation for New Feature
Need to support multi tenant multi site routing with single enpoint visible to user

Steps to Reproduce the Problem
Go to example.com
User would login and get a claim "TenantId": "xxx"
Route is setup to check for "TenantId" claim and route to specific resource based on TenantId value

[mvdburght]

I managed to get this working with the current version of Ocelot, just by adding a custom AspNetCore middleware before Ocelot in the pipeline:

public class HostNameByTenantHeaderMiddleware
    {
        private readonly RequestDelegate _next;

        public HostNameByTenantHeaderMiddleware(RequestDelegate next)
        {
            _next = next;
        }

        public async Task InvokeAsync(HttpContext context)
        {
            var tenantId = context.Request.Headers["SomeHeaderThatConainsTheTenantId"].ToString();

            if (!string.IsNullOrEmpty(tenantId))
            {
                context.Request.Host = HostString.FromUriComponent(tenantId);
            }
            
            await _next(context);
        }
    }

In your Ocelot.json you can use the UpstreamHost to supply different configurations per tenant.

It should be easy to change this to substract the TenantId from a claim.

[raman-m]

Hello @mvdburght !
Good recipe!
Can we develop your idea?

[raman-m]

@mogliang on Jul 10, 2018

Hi Mog!

Right now, we want to use gateway as the single api address for all instances, each http request will attach token with claim which indicates the userid.

If you want then start to contribute! And fork the Ocelot repo first...

I'm wondering if Ocelot can help on this scenario?

Sure thing!
You need to develop custom service discovery provider!
OR
In Consul you can define a set of users by full name (user ID) as service name and provide hosts for them.
In Ocelot you will have SD vs Consul setup but seems you have to make pairs userid-servicename and then find appropriate service entry.
My recommendation is to define a new class and inherit it from the Consul class. the rest of work is adding to DI container with replacement by new class.

[raman-m]

@mogliang Are you still with Ocelot?

[raman-m]

But you need simple host rewrite... I believe Middleware Injection should help.
You may override AuthenticationMiddleware, PreAuthorizationMiddleware etc. because seems you need to read HttpContext.User property