Stéphane Tailland
24 lines
995 B
YAML
24 lines
995 B
YAML
# For agents we build ourselves — real OIDC identity, unlike key-auth
|
|
# callers (see key-auth.yaml). No token exchange: the upstream auth to
|
|
# OpenRouter is handled entirely by ai-proxy-advanced's own static
|
|
# credential, this plugin only authenticates/authorizes the calling agent.
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-llm-openid-connect
|
|
namespace: ${NAMESPACE}
|
|
plugin: openid-connect
|
|
config:
|
|
issuer: ${OIDC_ISSUER}
|
|
audience_required: ${AGENT_AUDIENCE}
|
|
auth_methods:
|
|
- bearer
|
|
display_errors: false
|
|
ssl_verify: true
|
|
# Lets a request that fails THIS plugin fall through to key-auth instead
|
|
# of being rejected outright — "OR" auth across both plugins. Requires
|
|
# request-termination bound to this same consumer (see consumer.yaml) to
|
|
# actually reject a request that fails every auth plugin — without it,
|
|
# anonymous fallback alone would let unauthenticated requests through.
|
|
anonymous: ${LLM_ANONYMOUS_CONSUMER_ID}
|