Not able to rate limit Kong's Outh2 plugin default endpoints

[adarsh279]

Is there an existing issue for this?

• I have searched the existing issues

Kong version ($ kong version)

2.8.1.0

Current Behavior

I have configured one of my microservices with Kong Oauth2 plugin and exposed a route for accessing the API.

I am using client_credentials flow to authenticate the API.

Default endpoint for token generation is /oauth2/token.

Token generation works fine and the exposed API works with the access token.

Now, I have a new requirement to apply rate limit on both the token (default) endpoint and the service endpoint.

I am able to configure service endpoint with rate limit however the default oauth token endpoint rate limit is not working if configured.

Is there a limitation with Kong on this ? Please help with your suggestions

Expected Behavior

No response

Steps To Reproduce

No response

Anything else?

No response

[bungle]

I think Kong EE has a new plugin ordering feature that could be used in this case:
https://docs.konghq.com/gateway/latest/kong-enterprise/plugin-ordering/get-started/

@jschmid1, do you agree?

Unfortunately we don't have it in the Kong CE, but you can download the EE for free (AFAIK).

[jschmid1]

+1 plugin ordering could help in this situation

[adarsh279]

Hi @bungle @jschmid1,
Thanks for the suggestions.
I am using 2.8.1 Kong version currently and I dont see this plugin available under 2.8.x enterprise mode.

Is it only available post 3.x version or do you have any plan to add it in any latest 2.8.x versions as well?

Also I couldnt find this plugin in the kong pluginhub page,
https://docs.konghq.com/hub/

[jschmid1]

Plugin ordering is only available on 3.0 and there are no plans to backport it to 2.8 right now.

[yaduvesh]

@adarsh279 We've used the approach listed here to rate limit the oauth token endpoint to prevent excess token generation