Biscuit to ApiKey Bridge Plugin

The Biscuit API Key Bridge Plugin is a pre-routing plugin designed for Cloud APIM. It extracts an API key from the request Biscuit Token, ensuring secure access control.

Configuration

The plugin requires the following configuration parameters:

Parameter	Type	Description
keypair_ref	String	Reference to the Biscuit Keypair used for token verification.
enforce	Boolean	If true, the plugin enforces API key validation. Defaults to true.
extractor_type	String	Specifies how the token is extracted. Possible values: header, cookie, query.
extractor_name	String	The name of the field where the token is stored. Defaults to Authorization.
client_id_key	String	The name of the Client ID key from the biscuit token.

Default Configuration

{
  "keypair_ref": "",
  "enforce": true,
  "extractor_type": "header",
  "extractor_name": "Authorization",
  "client_id_key": "client_id"
}

Plugin Behavior

Pre-Routing Logic

1. Retrieves the Biscuit token from the specified source (extractor_type and extractor_name).
2. Validates the token using the referenced Biscuit Keypair.
3. Extracts the client_id from the token (using 'client_id_key' or default 'client_id' symbol from biscuit).
4. Checks if the corresponding API Key exists and is active.
5. If the API Key is inactive and enforce is true, the request is rejected.

Error Handling

• If the Biscuit token is missing and enforce is true, an unauthorized error is returned.
• If the Biscuit token is invalid or cannot be verified, an internal server error is returned.
• If the extracted API Key does not exist, an unauthorized error is returned.