feat: add multi-auth plugin

[madhawa-gunasekara]

Description

Add multiple authentication for routes. This is the implementation of multi-auth plugin

{
   "plugins":{
      "multi-auth":{
         "auth_plugins":[
            {
               "basic-auth":{ }
            },
            {
               "key-auth":{
                  "query":"apikey",
                  "hide_credentials":true,
                  "header":"apikey"
               }
            },
            {
               "jwt-auth":{
                  "cookie":"jwt",
                  "query":"jwt",
                  "hide_credentials":true,
                  "header":"authorization"
               }
            }
         ]
      }
   }
}

Fixes #10196

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

[moonming]

There is no test case to cover jwt?

[madhawa-gunasekara]

I added the test cases to cover jwt as well.
This is kind of a wrapper plugin to enable different authentication methods using "or" relationship.
I just added these 3 plugins to show case the compatibility of any plugin with type 'auth'.

[moonming]

For multiple different plug-ins, is there an "and" relationship or an "or" relationship between them? In other words, if there are two authentication plug-ins, do both plug-ins need to be verified?

[madhawa-gunasekara]

I added details in here

[markokocic]

Actually, it will go through the list of configured auth plugins, and exit after the first one is successfully authenticated. That means route can be shared between different consumers using different auth methods. If a consumer is using basic, he would be able to authenticate using basic, if another user uses jwt, he would be able to authenticate using jwt.

Maybe the doc can be clearer about the intent and use case.

[shreemaan-abhishek]

@madhawa-gunasekara did you see this?

[madhawa-gunasekara]

Yes, I will improve the docs

[madhawa-gunasekara]

Hi @moonming,

I fixed the changes you mentioned, can you rereview again?

[markokocic]

Better example and a more realistic use case is to have multiple consumers using different authentication plugins using the same route with multi-auth.

[madhawa-gunasekara]

I will add it as an example

[markokocic]

As already mentioned, docs should state that authentication plugins will be tried in the order specified in plugin config, and as soon as one one match, it will let that consumer proceed with the service call.

[markokocic]

I had only doc changes suggested. Functionality is fine.

[moonming]

@madhawa-gunasekara good job 👍
@markokocic thanks for your review

[SatriyoJati]

it said that it is only support for auth plugin with type 'auth', is authz-keycloak included to this type?

[SatriyoJati]

since when i combine key-auth with authz-keycloak, it shown this error
{"error_msg":"failed to check the configuration of plugin multi-auth err: authz-keycloak plugin is not supported"}