<commit_before># AuthService Plugin

The Ambassador API Gateway provides a highly flexible mechanism for authentication, via the `AuthService` resource.  An `AuthService` configures Ambassador to use an external service to check authentication and authorization for incoming requests. Each incoming request is authenticated before routing to its destination.

All requests are validated by the `AuthService` (unless the `Mapping` applied to the request sets `bypass_auth`).  It is not possible to combine multiple `AuthService`s.  While it is possible to create multiple `AuthService` resources, they will be load-balanced between each resource in a round-robin fashion. This is useful for canarying an `AuthService` change, but is not useful for deploying multiple distinct `AuthService`s.  In order to combine multiple external services (either having multiple services apply to the same request, or selecting between different services for the different requests), instead of using an `AuthService`, use [Ambassador Edge Stack `External Filter`](../../../using/filters/).

Because of the limitations described above, **the Ambassador Edge Stack does not support `AuthService` resources, and you should instead use an [`External` `Filter`](../../../using/filters/external),** which is mostly a drop-in replacement for an `AuthService`.

## Configure an External AuthService

The currently supported version of the `AuthService` resource is `getambassador.io/v2`. Earlier versions are deprecated.

```yaml
---
apiVersion: getambassador.io/v2
kind: AuthService
metadata:
  name: authentication
spec:
  ambassador_id: string-or-string-list # optional; default is ["default"]

  auth_service: "example-auth:3000" # required
  tls: true                         # optional; default is true if `auth_service` starts with "https://" (case-insensitive), false otherwise
  proto: http                       # optional; default is "http"
  timeout_ms: 5000                  # optional; default is 5000
  #allow_request_body: true         # deprecated; use include_body instead
  include_body:                     # optional; default is null
    max_bytes: 4096                   # required
    allow_partial: true               # required
  status_on_error:                  # optional
    code: 503                         # optional; default is 403
  failure_mode_allow: false         # optional; default is false

  # the following are used only if `proto: http`; they are ignored if `proto: grpc`

  path_prefix: "/path"             # optional; default is ""
  allowed_request_headers:         # optional; default is []
  - "x-example-header"<commit_msg>Add more detail for needing ambassador auth service in AES for external filters to work<commit_after># AuthService Plugin

The Ambassador API Gateway provides a highly flexible mechanism for authentication, via the `AuthService` resource.  An `AuthService` configures Ambassador to use an external service to check authentication and authorization for incoming requests. Each incoming request is authenticated before routing to its destination.

All requests are validated by the `AuthService` (unless the `Mapping` applied to the request sets `bypass_auth`).  It is not possible to combine multiple `AuthService`s.  While it is possible to create multiple `AuthService` resources, they will be load-balanced between each resource in a round-robin fashion. This is useful for canarying an `AuthService` change, but is not useful for deploying multiple distinct `AuthService`s.  In order to combine multiple external services (either having multiple services apply to the same request, or selecting between different services for the different requests), instead of using an `AuthService`, use [Ambassador Edge Stack `External Filter`](../../../using/filters/).

Because of the limitations described above, **the Ambassador Edge Stack does not support `AuthService` resources, and you should instead use an [`External` `Filter`](../../../using/filters/external),** which is mostly a drop-in replacement for an `AuthService`. Note at AES deploys its own AuthService, which External Filter relies on. You must be sure the AES AuthService exists before External Filters will work.

## Configure an External AuthService

The currently supported version of the `AuthService` resource is `getambassador.io/v2`. Earlier versions are deprecated.

```yaml
---
apiVersion: getambassador.io/v2
kind: AuthService
metadata:
  name: authentication
spec:
  ambassador_id: string-or-string-list # optional; default is ["default"]

  auth_service: "example-auth:3000" # required
  tls: true                         # optional; default is true if `auth_service` starts with "https://" (case-insensitive), false otherwise
  proto: http                       # optional; default is "http"
  timeout_ms: 5000                  # optional; default is 5000
  #allow_request_body: true         # deprecated; use include_body instead
  include_body:                     # optional; default is null
    max_bytes: 4096                   # required
    allow_partial: true               # required
  status_on_error:                  # optional
    code: 503                         # optional; default is 403
  failure_mode_allow: false         # optional; default is false

  # the following are used only if `proto: http`; they are ignored if `proto: grpc`

  path_prefix: "/path"             # optional; default is ""
  allowed_request_headers:         # optional; default is []
  - "x-example-header"
{'fraction_non_alphanumeric': 0.072579185520362, 'fraction_numerical': 0.008687782805429865, 'mean_word_length': 3.3857142857142857, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2263567', 'n_tokens_mistral': 1381, 'n_tokens_neox': 1272, 'n_words': 620}