ACL Configuration
Configuration reference for the ACL plugin (`acl`): the parameters, each attribute with its type, whether it is required, its default and its accepted values.
Parameters
See plugin common configurations (opens in Apache APISIX docs) for configuration options available to all plugins.
external_user_label_field — string · optional · default: groups · since APISIX 3.17.0 · API7 Gateway 3.2.8.0
Key of the user labels when using an external identity provider for authentication.
The key should be a JSONPath when the user labels are in a nested JSON object and a field name otherwise.
The values to the key are expected to be in a string array and will be used for ACL tag matching.
external_user_label_field_key — string · optional · since APISIX 3.17.0 · API7 Gateway 3.2.9.5
Key of the user label field when external_user_label_field is a JSONPath. For example, if external_user_label_field is $.orgs..team, external_user_label_field_key should be configured to team.
external_user_label_field_parser — string · optional · since APISIX 3.17.0 · API7 Gateway 3.2.9.5
Valid values: segmented_text, json,or table
Type of parser to parse for user labels.
When user labels are in serialized JSON format, use the json parser to deserialize the JSON object to a structured list of strings. When user labels are delimited strings, use the segmented_text parser and configure the delimiter in external_user_label_field_separator to parse the strings into a structured list of strings. When user labels are in a list, use the table parser.
external_user_label_field_separator — string · optional · since APISIX 3.17.0 · API7 Gateway 3.2.9.5
Delimiter to use by parser when user labels are delimited; that is, when external_user_label_field_parser is segmented_text.
allow_labels — object · optional · since APISIX 3.17.0 · API7 Gateway 3.2.8.0
List of labels associated with a key that if present, the request should be allowed access.
At least one of the allow_labels and deny_labels should be configured.
deny_labels — object · optional · since APISIX 3.17.0 · API7 Gateway 3.2.8.0
List of labels associated with a key that if present, the request should be denied access.
At least one of the allow_labels and deny_labels should be configured.
rejected_code — integer · optional · default: 403 · since APISIX 3.17.0 · API7 Gateway 3.2.8.0
Valid values: greater than or equal to 200
HTTP status code to return when the request is rejected.
rejected_msg — string · optional · default: The consumer is forbidden. · since APISIX 3.17.0 · API7 Gateway 3.2.8.0
Error message to return when the request is rejected.