Package io.envoyproxy.envoy.extensions.filters.http.ext_authz.v3

Class ExtAuthz

java.lang.Object
com.google.protobuf.AbstractMessageLite
com.google.protobuf.AbstractMessage
com.google.protobuf.GeneratedMessageV3
io.envoyproxy.envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
All Implemented Interfaces:
com.google.protobuf.Message, com.google.protobuf.MessageLite, com.google.protobuf.MessageLiteOrBuilder, com.google.protobuf.MessageOrBuilder, ExtAuthzOrBuilder, Serializable
public final class ExtAuthz extends com.google.protobuf.GeneratedMessageV3 implements ExtAuthzOrBuilder
 [#next-free-field: 32]
Protobuf type envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
See Also:

  • Field Details

    • GRPC_SERVICE_FIELD_NUMBER

      public static final int GRPC_SERVICE_FIELD_NUMBER
      See Also:

    • HTTP_SERVICE_FIELD_NUMBER

      public static final int HTTP_SERVICE_FIELD_NUMBER
      See Also:

    • TRANSPORT_API_VERSION_FIELD_NUMBER

      public static final int TRANSPORT_API_VERSION_FIELD_NUMBER
      See Also:

    • FAILURE_MODE_ALLOW_FIELD_NUMBER

      public static final int FAILURE_MODE_ALLOW_FIELD_NUMBER
      See Also:

    • FAILURE_MODE_ALLOW_HEADER_ADD_FIELD_NUMBER

      public static final int FAILURE_MODE_ALLOW_HEADER_ADD_FIELD_NUMBER
      See Also:

    • WITH_REQUEST_BODY_FIELD_NUMBER

      public static final int WITH_REQUEST_BODY_FIELD_NUMBER
      See Also:

    • CLEAR_ROUTE_CACHE_FIELD_NUMBER

      public static final int CLEAR_ROUTE_CACHE_FIELD_NUMBER
      See Also:

    • STATUS_ON_ERROR_FIELD_NUMBER

      public static final int STATUS_ON_ERROR_FIELD_NUMBER
      See Also:

    • VALIDATE_MUTATIONS_FIELD_NUMBER

      public static final int VALIDATE_MUTATIONS_FIELD_NUMBER
      See Also:

    • METADATA_CONTEXT_NAMESPACES_FIELD_NUMBER

      public static final int METADATA_CONTEXT_NAMESPACES_FIELD_NUMBER
      See Also:

    • TYPED_METADATA_CONTEXT_NAMESPACES_FIELD_NUMBER

      public static final int TYPED_METADATA_CONTEXT_NAMESPACES_FIELD_NUMBER
      See Also:

    • ROUTE_METADATA_CONTEXT_NAMESPACES_FIELD_NUMBER

      public static final int ROUTE_METADATA_CONTEXT_NAMESPACES_FIELD_NUMBER
      See Also:

    • ROUTE_TYPED_METADATA_CONTEXT_NAMESPACES_FIELD_NUMBER

      public static final int ROUTE_TYPED_METADATA_CONTEXT_NAMESPACES_FIELD_NUMBER
      See Also:

    • FILTER_ENABLED_FIELD_NUMBER

      public static final int FILTER_ENABLED_FIELD_NUMBER
      See Also:

    • FILTER_ENABLED_METADATA_FIELD_NUMBER

      public static final int FILTER_ENABLED_METADATA_FIELD_NUMBER
      See Also:

    • DENY_AT_DISABLE_FIELD_NUMBER

      public static final int DENY_AT_DISABLE_FIELD_NUMBER
      See Also:

    • INCLUDE_PEER_CERTIFICATE_FIELD_NUMBER

      public static final int INCLUDE_PEER_CERTIFICATE_FIELD_NUMBER
      See Also:

    • STAT_PREFIX_FIELD_NUMBER

      public static final int STAT_PREFIX_FIELD_NUMBER
      See Also:

    • BOOTSTRAP_METADATA_LABELS_KEY_FIELD_NUMBER

      public static final int BOOTSTRAP_METADATA_LABELS_KEY_FIELD_NUMBER
      See Also:

    • ALLOWED_HEADERS_FIELD_NUMBER

      public static final int ALLOWED_HEADERS_FIELD_NUMBER
      See Also:

    • DISALLOWED_HEADERS_FIELD_NUMBER

      public static final int DISALLOWED_HEADERS_FIELD_NUMBER
      See Also:

    • INCLUDE_TLS_SESSION_FIELD_NUMBER

      public static final int INCLUDE_TLS_SESSION_FIELD_NUMBER
      See Also:

    • CHARGE_CLUSTER_RESPONSE_STATS_FIELD_NUMBER

      public static final int CHARGE_CLUSTER_RESPONSE_STATS_FIELD_NUMBER
      See Also:

    • ENCODE_RAW_HEADERS_FIELD_NUMBER

      public static final int ENCODE_RAW_HEADERS_FIELD_NUMBER
      See Also:

    • DECODER_HEADER_MUTATION_RULES_FIELD_NUMBER

      public static final int DECODER_HEADER_MUTATION_RULES_FIELD_NUMBER
      See Also:

    • ENABLE_DYNAMIC_METADATA_INGESTION_FIELD_NUMBER

      public static final int ENABLE_DYNAMIC_METADATA_INGESTION_FIELD_NUMBER
      See Also:

    • FILTER_METADATA_FIELD_NUMBER

      public static final int FILTER_METADATA_FIELD_NUMBER
      See Also:

    • EMIT_FILTER_STATE_STATS_FIELD_NUMBER

      public static final int EMIT_FILTER_STATE_STATS_FIELD_NUMBER
      See Also:

    • MAX_DENIED_RESPONSE_BODY_BYTES_FIELD_NUMBER

      public static final int MAX_DENIED_RESPONSE_BODY_BYTES_FIELD_NUMBER
      See Also:

    • ENFORCE_RESPONSE_HEADER_LIMITS_FIELD_NUMBER

      public static final int ENFORCE_RESPONSE_HEADER_LIMITS_FIELD_NUMBER
      See Also:

  • Method Details

    • newInstance

      protected Object newInstance(com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter unused)
      Overrides:
      newInstance in class com.google.protobuf.GeneratedMessageV3

    • getDescriptor

      public static final com.google.protobuf.Descriptors.Descriptor getDescriptor()

    • internalGetFieldAccessorTable

      protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()
      Specified by:
      internalGetFieldAccessorTable in class com.google.protobuf.GeneratedMessageV3

    • getServicesCase

      public ExtAuthz.ServicesCase getServicesCase()
      Specified by:
      getServicesCase in interface ExtAuthzOrBuilder

    • hasGrpcService

      public boolean hasGrpcService()
       gRPC service configuration (default timeout: 200ms).
      .envoy.config.core.v3.GrpcService grpc_service = 1;
      Specified by:
      hasGrpcService in interface ExtAuthzOrBuilder
      Returns:
      Whether the grpcService field is set.

    • getGrpcService

      public GrpcService getGrpcService()
       gRPC service configuration (default timeout: 200ms).
      .envoy.config.core.v3.GrpcService grpc_service = 1;
      Specified by:
      getGrpcService in interface ExtAuthzOrBuilder
      Returns:
      The grpcService.

    • getGrpcServiceOrBuilder

      public GrpcServiceOrBuilder getGrpcServiceOrBuilder()
       gRPC service configuration (default timeout: 200ms).
      .envoy.config.core.v3.GrpcService grpc_service = 1;
      Specified by:
      getGrpcServiceOrBuilder in interface ExtAuthzOrBuilder

    • hasHttpService

      public boolean hasHttpService()
       HTTP service configuration (default timeout: 200ms).
      .envoy.extensions.filters.http.ext_authz.v3.HttpService http_service = 3;
      Specified by:
      hasHttpService in interface ExtAuthzOrBuilder
      Returns:
      Whether the httpService field is set.

    • getHttpService

      public HttpService getHttpService()
       HTTP service configuration (default timeout: 200ms).
      .envoy.extensions.filters.http.ext_authz.v3.HttpService http_service = 3;
      Specified by:
      getHttpService in interface ExtAuthzOrBuilder
      Returns:
      The httpService.

    • getHttpServiceOrBuilder

      public HttpServiceOrBuilder getHttpServiceOrBuilder()
       HTTP service configuration (default timeout: 200ms).
      .envoy.extensions.filters.http.ext_authz.v3.HttpService http_service = 3;
      Specified by:
      getHttpServiceOrBuilder in interface ExtAuthzOrBuilder

    • getTransportApiVersionValue

      public int getTransportApiVersionValue()
       API version for ext_authz transport protocol. This describes the ext_authz gRPC endpoint and
 version of messages used on the wire.
      .envoy.config.core.v3.ApiVersion transport_api_version = 12 [(.validate.rules) = { ... }
      Specified by:
      getTransportApiVersionValue in interface ExtAuthzOrBuilder
      Returns:
      The enum numeric value on the wire for transportApiVersion.

    • getTransportApiVersion

      public ApiVersion getTransportApiVersion()
       API version for ext_authz transport protocol. This describes the ext_authz gRPC endpoint and
 version of messages used on the wire.
      .envoy.config.core.v3.ApiVersion transport_api_version = 12 [(.validate.rules) = { ... }
      Specified by:
      getTransportApiVersion in interface ExtAuthzOrBuilder
      Returns:
      The transportApiVersion.

    • getFailureModeAllow

      public boolean getFailureModeAllow()
       Changes the filter's behavior on errors:

 * When set to ``true``, the filter will ``accept`` the client request even if communication with
   the authorization service has failed, or if the authorization service has returned an HTTP 5xx
   error.

 * When set to ``false``, the filter will ``reject`` client requests and return ``Forbidden``
   if communication with the authorization service has failed, or if the authorization service
   has returned an HTTP 5xx error.

 Errors can always be tracked in the :ref:`stats <config_http_filters_ext_authz_stats>`.

 Defaults to ``false``.
      bool failure_mode_allow = 2;
      Specified by:
      getFailureModeAllow in interface ExtAuthzOrBuilder
      Returns:
      The failureModeAllow.

    • getFailureModeAllowHeaderAdd

      public boolean getFailureModeAllowHeaderAdd()
       When ``failure_mode_allow`` and ``failure_mode_allow_header_add`` are both set to ``true``,
 ``x-envoy-auth-failure-mode-allowed: true`` will be added to request headers if the communication
 with the authorization service has failed, or if the authorization service has returned a
 HTTP 5xx error.
      bool failure_mode_allow_header_add = 19;
      Specified by:
      getFailureModeAllowHeaderAdd in interface ExtAuthzOrBuilder
      Returns:
      The failureModeAllowHeaderAdd.

    • hasWithRequestBody

      public boolean hasWithRequestBody()
       Enables the filter to buffer the client request body and send it within the authorization request.
 The ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization
 request indicating whether the body data is partial.
      .envoy.extensions.filters.http.ext_authz.v3.BufferSettings with_request_body = 5;
      Specified by:
      hasWithRequestBody in interface ExtAuthzOrBuilder
      Returns:
      Whether the withRequestBody field is set.

    • getWithRequestBody

      public BufferSettings getWithRequestBody()
       Enables the filter to buffer the client request body and send it within the authorization request.
 The ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization
 request indicating whether the body data is partial.
      .envoy.extensions.filters.http.ext_authz.v3.BufferSettings with_request_body = 5;
      Specified by:
      getWithRequestBody in interface ExtAuthzOrBuilder
      Returns:
      The withRequestBody.

    • getWithRequestBodyOrBuilder

      public BufferSettingsOrBuilder getWithRequestBodyOrBuilder()
       Enables the filter to buffer the client request body and send it within the authorization request.
 The ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization
 request indicating whether the body data is partial.
      .envoy.extensions.filters.http.ext_authz.v3.BufferSettings with_request_body = 5;
      Specified by:
      getWithRequestBodyOrBuilder in interface ExtAuthzOrBuilder

    • getClearRouteCache

      public boolean getClearRouteCache()
       Clears the route cache in order to allow the external authorization service to correctly affect
 routing decisions. The filter clears all cached routes when all of the following holds:

 * This field is set to ``true``.
 * The status returned from the authorization service is an HTTP 200 or gRPC 0.
 * At least one ``authorization response header`` is added to the client request, or is used to
   alter another client request header.

 Defaults to ``false``.
      bool clear_route_cache = 6;
      Specified by:
      getClearRouteCache in interface ExtAuthzOrBuilder
      Returns:
      The clearRouteCache.

    • hasStatusOnError

      public boolean hasStatusOnError()
       Sets the HTTP status that is returned to the client when the authorization server returns an error
 or cannot be reached.

 The default status is ``HTTP 403 Forbidden``.
      .envoy.type.v3.HttpStatus status_on_error = 7;
      Specified by:
      hasStatusOnError in interface ExtAuthzOrBuilder
      Returns:
      Whether the statusOnError field is set.

    • getStatusOnError

      public HttpStatus getStatusOnError()
       Sets the HTTP status that is returned to the client when the authorization server returns an error
 or cannot be reached.

 The default status is ``HTTP 403 Forbidden``.
      .envoy.type.v3.HttpStatus status_on_error = 7;
      Specified by:
      getStatusOnError in interface ExtAuthzOrBuilder
      Returns:
      The statusOnError.

    • getStatusOnErrorOrBuilder

      public HttpStatusOrBuilder getStatusOnErrorOrBuilder()
       Sets the HTTP status that is returned to the client when the authorization server returns an error
 or cannot be reached.

 The default status is ``HTTP 403 Forbidden``.
      .envoy.type.v3.HttpStatus status_on_error = 7;
      Specified by:
      getStatusOnErrorOrBuilder in interface ExtAuthzOrBuilder

    • getValidateMutations

      public boolean getValidateMutations()
       When set to ``true``, the filter will check the :ref:`ext_authz response
 <envoy_v3_api_msg_service.auth.v3.CheckResponse>` for invalid header and
 query parameter mutations. If the response is invalid, the filter will send a local reply
 to the downstream request with status ``HTTP 500 Internal Server Error``.

 .. note::
   Both ``headers_to_remove`` and ``query_parameters_to_remove`` are validated, but invalid elements in
   those fields should not affect any headers and thus will not cause the filter to send a local reply.

 When set to ``false``, any invalid mutations will be visible to the rest of Envoy and may cause
 unexpected behavior.

 If you are using ext_authz with an untrusted ext_authz server, you should set this to ``true``.

 Defaults to ``false``.
      bool validate_mutations = 24;
      Specified by:
      getValidateMutations in interface ExtAuthzOrBuilder
      Returns:
      The validateMutations.

    • getMetadataContextNamespacesList

      public com.google.protobuf.ProtocolStringList getMetadataContextNamespacesList()
       Specifies a list of metadata namespaces whose values, if present, will be passed to the
 ext_authz service. The :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>`
 is passed as an opaque ``protobuf::Struct``.

 .. note::
   This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.

 For example, if the ``jwt_authn`` filter is used and :ref:`payload_in_metadata
 <envoy_v3_api_field_extensions.filters.http.jwt_authn.v3.JwtProvider.payload_in_metadata>` is set,
 then the following will pass the jwt payload to the authorization server.

 .. code-block:: yaml

    metadata_context_namespaces:
    - envoy.filters.http.jwt_authn
      repeated string metadata_context_namespaces = 8;
      Specified by:
      getMetadataContextNamespacesList in interface ExtAuthzOrBuilder
      Returns:
      A list containing the metadataContextNamespaces.

    • getMetadataContextNamespacesCount

      public int getMetadataContextNamespacesCount()
       Specifies a list of metadata namespaces whose values, if present, will be passed to the
 ext_authz service. The :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>`
 is passed as an opaque ``protobuf::Struct``.

 .. note::
   This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.

 For example, if the ``jwt_authn`` filter is used and :ref:`payload_in_metadata
 <envoy_v3_api_field_extensions.filters.http.jwt_authn.v3.JwtProvider.payload_in_metadata>` is set,
 then the following will pass the jwt payload to the authorization server.

 .. code-block:: yaml

    metadata_context_namespaces:
    - envoy.filters.http.jwt_authn
      repeated string metadata_context_namespaces = 8;
      Specified by:
      getMetadataContextNamespacesCount in interface ExtAuthzOrBuilder
      Returns:
      The count of metadataContextNamespaces.

    • getMetadataContextNamespaces

      public String getMetadataContextNamespaces(int index)
       Specifies a list of metadata namespaces whose values, if present, will be passed to the
 ext_authz service. The :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>`
 is passed as an opaque ``protobuf::Struct``.

 .. note::
   This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.

 For example, if the ``jwt_authn`` filter is used and :ref:`payload_in_metadata
 <envoy_v3_api_field_extensions.filters.http.jwt_authn.v3.JwtProvider.payload_in_metadata>` is set,
 then the following will pass the jwt payload to the authorization server.

 .. code-block:: yaml

    metadata_context_namespaces:
    - envoy.filters.http.jwt_authn
      repeated string metadata_context_namespaces = 8;
      Specified by:
      getMetadataContextNamespaces in interface ExtAuthzOrBuilder
      Parameters:
      index - The index of the element to return.
      Returns:
      The metadataContextNamespaces at the given index.

    • getMetadataContextNamespacesBytes

      public com.google.protobuf.ByteString getMetadataContextNamespacesBytes(int index)
       Specifies a list of metadata namespaces whose values, if present, will be passed to the
 ext_authz service. The :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>`
 is passed as an opaque ``protobuf::Struct``.

 .. note::
   This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.

 For example, if the ``jwt_authn`` filter is used and :ref:`payload_in_metadata
 <envoy_v3_api_field_extensions.filters.http.jwt_authn.v3.JwtProvider.payload_in_metadata>` is set,
 then the following will pass the jwt payload to the authorization server.

 .. code-block:: yaml

    metadata_context_namespaces:
    - envoy.filters.http.jwt_authn
      repeated string metadata_context_namespaces = 8;
      Specified by:
      getMetadataContextNamespacesBytes in interface ExtAuthzOrBuilder
      Parameters:
      index - The index of the value to return.
      Returns:
      The bytes of the metadataContextNamespaces at the given index.

    • getTypedMetadataContextNamespacesList

      public com.google.protobuf.ProtocolStringList getTypedMetadataContextNamespacesList()
       Specifies a list of metadata namespaces whose values, if present, will be passed to the
 ext_authz service. :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>`
 is passed as a ``protobuf::Any``.

 .. note::
   This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.

 This works similarly to ``metadata_context_namespaces`` but allows Envoy and the ext_authz server to share
 the protobuf message definition in order to perform safe parsing.
      repeated string typed_metadata_context_namespaces = 16;
      Specified by:
      getTypedMetadataContextNamespacesList in interface ExtAuthzOrBuilder
      Returns:
      A list containing the typedMetadataContextNamespaces.

    • getTypedMetadataContextNamespacesCount

      public int getTypedMetadataContextNamespacesCount()
       Specifies a list of metadata namespaces whose values, if present, will be passed to the
 ext_authz service. :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>`
 is passed as a ``protobuf::Any``.

 .. note::
   This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.

 This works similarly to ``metadata_context_namespaces`` but allows Envoy and the ext_authz server to share
 the protobuf message definition in order to perform safe parsing.
      repeated string typed_metadata_context_namespaces = 16;
      Specified by:
      getTypedMetadataContextNamespacesCount in interface ExtAuthzOrBuilder
      Returns:
      The count of typedMetadataContextNamespaces.

    • getTypedMetadataContextNamespaces

      public String getTypedMetadataContextNamespaces(int index)
       Specifies a list of metadata namespaces whose values, if present, will be passed to the
 ext_authz service. :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>`
 is passed as a ``protobuf::Any``.

 .. note::
   This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.

 This works similarly to ``metadata_context_namespaces`` but allows Envoy and the ext_authz server to share
 the protobuf message definition in order to perform safe parsing.
      repeated string typed_metadata_context_namespaces = 16;
      Specified by:
      getTypedMetadataContextNamespaces in interface ExtAuthzOrBuilder
      Parameters:
      index - The index of the element to return.
      Returns:
      The typedMetadataContextNamespaces at the given index.

    • getTypedMetadataContextNamespacesBytes

      public com.google.protobuf.ByteString getTypedMetadataContextNamespacesBytes(int index)
       Specifies a list of metadata namespaces whose values, if present, will be passed to the
 ext_authz service. :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>`
 is passed as a ``protobuf::Any``.

 .. note::
   This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service.

 This works similarly to ``metadata_context_namespaces`` but allows Envoy and the ext_authz server to share
 the protobuf message definition in order to perform safe parsing.
      repeated string typed_metadata_context_namespaces = 16;
      Specified by:
      getTypedMetadataContextNamespacesBytes in interface ExtAuthzOrBuilder
      Parameters:
      index - The index of the value to return.
      Returns:
      The bytes of the typedMetadataContextNamespaces at the given index.

    • getRouteMetadataContextNamespacesList

      public com.google.protobuf.ProtocolStringList getRouteMetadataContextNamespacesList()
       Specifies a list of route metadata namespaces whose values, if present, will be passed to the
 ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
 :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
 :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>` is passed as an opaque ``protobuf::Struct``.
      repeated string route_metadata_context_namespaces = 21;
      Specified by:
      getRouteMetadataContextNamespacesList in interface ExtAuthzOrBuilder
      Returns:
      A list containing the routeMetadataContextNamespaces.

    • getRouteMetadataContextNamespacesCount

      public int getRouteMetadataContextNamespacesCount()
       Specifies a list of route metadata namespaces whose values, if present, will be passed to the
 ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
 :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
 :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>` is passed as an opaque ``protobuf::Struct``.
      repeated string route_metadata_context_namespaces = 21;
      Specified by:
      getRouteMetadataContextNamespacesCount in interface ExtAuthzOrBuilder
      Returns:
      The count of routeMetadataContextNamespaces.

    • getRouteMetadataContextNamespaces

      public String getRouteMetadataContextNamespaces(int index)
       Specifies a list of route metadata namespaces whose values, if present, will be passed to the
 ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
 :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
 :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>` is passed as an opaque ``protobuf::Struct``.
      repeated string route_metadata_context_namespaces = 21;
      Specified by:
      getRouteMetadataContextNamespaces in interface ExtAuthzOrBuilder
      Parameters:
      index - The index of the element to return.
      Returns:
      The routeMetadataContextNamespaces at the given index.

    • getRouteMetadataContextNamespacesBytes

      public com.google.protobuf.ByteString getRouteMetadataContextNamespacesBytes(int index)
       Specifies a list of route metadata namespaces whose values, if present, will be passed to the
 ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
 :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
 :ref:`filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.filter_metadata>` is passed as an opaque ``protobuf::Struct``.
      repeated string route_metadata_context_namespaces = 21;
      Specified by:
      getRouteMetadataContextNamespacesBytes in interface ExtAuthzOrBuilder
      Parameters:
      index - The index of the value to return.
      Returns:
      The bytes of the routeMetadataContextNamespaces at the given index.

    • getRouteTypedMetadataContextNamespacesList

      public com.google.protobuf.ProtocolStringList getRouteTypedMetadataContextNamespacesList()
       Specifies a list of route metadata namespaces whose values, if present, will be passed to the
 ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
 :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
 :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>` is passed as a ``protobuf::Any``.
      repeated string route_typed_metadata_context_namespaces = 22;
      Specified by:
      getRouteTypedMetadataContextNamespacesList in interface ExtAuthzOrBuilder
      Returns:
      A list containing the routeTypedMetadataContextNamespaces.

    • getRouteTypedMetadataContextNamespacesCount

      public int getRouteTypedMetadataContextNamespacesCount()
       Specifies a list of route metadata namespaces whose values, if present, will be passed to the
 ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
 :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
 :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>` is passed as a ``protobuf::Any``.
      repeated string route_typed_metadata_context_namespaces = 22;
      Specified by:
      getRouteTypedMetadataContextNamespacesCount in interface ExtAuthzOrBuilder
      Returns:
      The count of routeTypedMetadataContextNamespaces.

    • getRouteTypedMetadataContextNamespaces

      public String getRouteTypedMetadataContextNamespaces(int index)
       Specifies a list of route metadata namespaces whose values, if present, will be passed to the
 ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
 :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
 :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>` is passed as a ``protobuf::Any``.
      repeated string route_typed_metadata_context_namespaces = 22;
      Specified by:
      getRouteTypedMetadataContextNamespaces in interface ExtAuthzOrBuilder
      Parameters:
      index - The index of the element to return.
      Returns:
      The routeTypedMetadataContextNamespaces at the given index.

    • getRouteTypedMetadataContextNamespacesBytes

      public com.google.protobuf.ByteString getRouteTypedMetadataContextNamespacesBytes(int index)
       Specifies a list of route metadata namespaces whose values, if present, will be passed to the
 ext_authz service at :ref:`route_metadata_context <envoy_v3_api_field_service.auth.v3.AttributeContext.route_metadata_context>` in
 :ref:`CheckRequest <envoy_v3_api_field_service.auth.v3.CheckRequest.attributes>`.
 :ref:`typed_filter_metadata <envoy_v3_api_field_config.core.v3.Metadata.typed_filter_metadata>` is passed as a ``protobuf::Any``.
      repeated string route_typed_metadata_context_namespaces = 22;
      Specified by:
      getRouteTypedMetadataContextNamespacesBytes in interface ExtAuthzOrBuilder
      Parameters:
      index - The index of the value to return.
      Returns:
      The bytes of the routeTypedMetadataContextNamespaces at the given index.

    • hasFilterEnabled

      public boolean hasFilterEnabled()
       Specifies if the filter is enabled.

 If :ref:`runtime_key <envoy_v3_api_field_config.core.v3.RuntimeFractionalPercent.runtime_key>` is specified,
 Envoy will lookup the runtime key to get the percentage of requests to filter.

 If this field is not specified, the filter will be enabled for all requests.
      .envoy.config.core.v3.RuntimeFractionalPercent filter_enabled = 9;
      Specified by:
      hasFilterEnabled in interface ExtAuthzOrBuilder
      Returns:
      Whether the filterEnabled field is set.

    • getFilterEnabled

      public RuntimeFractionalPercent getFilterEnabled()
       Specifies if the filter is enabled.

 If :ref:`runtime_key <envoy_v3_api_field_config.core.v3.RuntimeFractionalPercent.runtime_key>` is specified,
 Envoy will lookup the runtime key to get the percentage of requests to filter.

 If this field is not specified, the filter will be enabled for all requests.
      .envoy.config.core.v3.RuntimeFractionalPercent filter_enabled = 9;
      Specified by:
      getFilterEnabled in interface ExtAuthzOrBuilder
      Returns:
      The filterEnabled.

    • getFilterEnabledOrBuilder

      public RuntimeFractionalPercentOrBuilder getFilterEnabledOrBuilder()
       Specifies if the filter is enabled.

 If :ref:`runtime_key <envoy_v3_api_field_config.core.v3.RuntimeFractionalPercent.runtime_key>` is specified,
 Envoy will lookup the runtime key to get the percentage of requests to filter.

 If this field is not specified, the filter will be enabled for all requests.
      .envoy.config.core.v3.RuntimeFractionalPercent filter_enabled = 9;
      Specified by:
      getFilterEnabledOrBuilder in interface ExtAuthzOrBuilder

    • hasFilterEnabledMetadata

      public boolean hasFilterEnabledMetadata()
       Specifies if the filter is enabled with metadata matcher.
 If this field is not specified, the filter will be enabled for all requests.

 .. note::

   This field is only evaluated if the filter is instantiated. If the filter is marked with
   ``disabled: true`` in the :ref:`HttpFilter
   <envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpFilter>`
   configuration or in per-route configuration via :ref:`ExtAuthzPerRoute
   <envoy_v3_api_msg_extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute>`,
   the filter will not be instantiated and this field will have no effect.

 .. tip::

   For dynamic filter activation based on metadata (such as metadata set by a preceding
   filter), consider using :ref:`ExtensionWithMatcher
   <envoy_v3_api_msg_extensions.common.matching.v3.ExtensionWithMatcher>` instead. This
   provides a more flexible matching framework that can evaluate conditions before filter
   instantiation. See the :ref:`ext_authz filter documentation
   <config_http_filters_ext_authz>` for examples.
      .envoy.type.matcher.v3.MetadataMatcher filter_enabled_metadata = 14;
      Specified by:
      hasFilterEnabledMetadata in interface ExtAuthzOrBuilder
      Returns:
      Whether the filterEnabledMetadata field is set.

    • getFilterEnabledMetadata

      public MetadataMatcher getFilterEnabledMetadata()
       Specifies if the filter is enabled with metadata matcher.
 If this field is not specified, the filter will be enabled for all requests.

 .. note::

   This field is only evaluated if the filter is instantiated. If the filter is marked with
   ``disabled: true`` in the :ref:`HttpFilter
   <envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpFilter>`
   configuration or in per-route configuration via :ref:`ExtAuthzPerRoute
   <envoy_v3_api_msg_extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute>`,
   the filter will not be instantiated and this field will have no effect.

 .. tip::

   For dynamic filter activation based on metadata (such as metadata set by a preceding
   filter), consider using :ref:`ExtensionWithMatcher
   <envoy_v3_api_msg_extensions.common.matching.v3.ExtensionWithMatcher>` instead. This
   provides a more flexible matching framework that can evaluate conditions before filter
   instantiation. See the :ref:`ext_authz filter documentation
   <config_http_filters_ext_authz>` for examples.
      .envoy.type.matcher.v3.MetadataMatcher filter_enabled_metadata = 14;
      Specified by:
      getFilterEnabledMetadata in interface ExtAuthzOrBuilder
      Returns:
      The filterEnabledMetadata.

    • getFilterEnabledMetadataOrBuilder

      public MetadataMatcherOrBuilder getFilterEnabledMetadataOrBuilder()
       Specifies if the filter is enabled with metadata matcher.
 If this field is not specified, the filter will be enabled for all requests.

 .. note::

   This field is only evaluated if the filter is instantiated. If the filter is marked with
   ``disabled: true`` in the :ref:`HttpFilter
   <envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpFilter>`
   configuration or in per-route configuration via :ref:`ExtAuthzPerRoute
   <envoy_v3_api_msg_extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute>`,
   the filter will not be instantiated and this field will have no effect.

 .. tip::

   For dynamic filter activation based on metadata (such as metadata set by a preceding
   filter), consider using :ref:`ExtensionWithMatcher
   <envoy_v3_api_msg_extensions.common.matching.v3.ExtensionWithMatcher>` instead. This
   provides a more flexible matching framework that can evaluate conditions before filter
   instantiation. See the :ref:`ext_authz filter documentation
   <config_http_filters_ext_authz>` for examples.
      .envoy.type.matcher.v3.MetadataMatcher filter_enabled_metadata = 14;
      Specified by:
      getFilterEnabledMetadataOrBuilder in interface ExtAuthzOrBuilder

    • hasDenyAtDisable

      public boolean hasDenyAtDisable()
       Specifies whether to deny the requests when the filter is disabled.
 If :ref:`runtime_key <envoy_v3_api_field_config.core.v3.RuntimeFeatureFlag.runtime_key>` is specified,
 Envoy will lookup the runtime key to determine whether to deny requests for filter-protected paths
 when the filter is disabled. If the filter is disabled in ``typed_per_filter_config`` for the path,
 requests will not be denied.

 If this field is not specified, all requests will be allowed when disabled.

 If a request is denied due to this setting, the response code in :ref:`status_on_error
 <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.status_on_error>` will
 be returned.
      .envoy.config.core.v3.RuntimeFeatureFlag deny_at_disable = 11;
      Specified by:
      hasDenyAtDisable in interface ExtAuthzOrBuilder
      Returns:
      Whether the denyAtDisable field is set.

    • getDenyAtDisable

      public RuntimeFeatureFlag getDenyAtDisable()
       Specifies whether to deny the requests when the filter is disabled.
 If :ref:`runtime_key <envoy_v3_api_field_config.core.v3.RuntimeFeatureFlag.runtime_key>` is specified,
 Envoy will lookup the runtime key to determine whether to deny requests for filter-protected paths
 when the filter is disabled. If the filter is disabled in ``typed_per_filter_config`` for the path,
 requests will not be denied.

 If this field is not specified, all requests will be allowed when disabled.

 If a request is denied due to this setting, the response code in :ref:`status_on_error
 <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.status_on_error>` will
 be returned.
      .envoy.config.core.v3.RuntimeFeatureFlag deny_at_disable = 11;
      Specified by:
      getDenyAtDisable in interface ExtAuthzOrBuilder
      Returns:
      The denyAtDisable.

    • getDenyAtDisableOrBuilder

      public RuntimeFeatureFlagOrBuilder getDenyAtDisableOrBuilder()
       Specifies whether to deny the requests when the filter is disabled.
 If :ref:`runtime_key <envoy_v3_api_field_config.core.v3.RuntimeFeatureFlag.runtime_key>` is specified,
 Envoy will lookup the runtime key to determine whether to deny requests for filter-protected paths
 when the filter is disabled. If the filter is disabled in ``typed_per_filter_config`` for the path,
 requests will not be denied.

 If this field is not specified, all requests will be allowed when disabled.

 If a request is denied due to this setting, the response code in :ref:`status_on_error
 <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.status_on_error>` will
 be returned.
      .envoy.config.core.v3.RuntimeFeatureFlag deny_at_disable = 11;
      Specified by:
      getDenyAtDisableOrBuilder in interface ExtAuthzOrBuilder

    • getIncludePeerCertificate

      public boolean getIncludePeerCertificate()
       Specifies if the peer certificate is sent to the external service.

 When this field is ``true``, Envoy will include the peer X.509 certificate, if available, in the
 :ref:`certificate<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.certificate>`.
      bool include_peer_certificate = 10;
      Specified by:
      getIncludePeerCertificate in interface ExtAuthzOrBuilder
      Returns:
      The includePeerCertificate.

    • getStatPrefix

      public String getStatPrefix()
       Optional additional prefix to use when emitting statistics. This allows distinguishing
 emitted statistics between configured ``ext_authz`` filters in an HTTP filter chain. For example:

 .. code-block:: yaml

   http_filters:
     - name: envoy.filters.http.ext_authz
       typed_config:
         "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
         stat_prefix: waf # This emits ext_authz.waf.ok, ext_authz.waf.denied, etc.
     - name: envoy.filters.http.ext_authz
       typed_config:
         "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
         stat_prefix: blocker # This emits ext_authz.blocker.ok, ext_authz.blocker.denied, etc.
      string stat_prefix = 13;
      Specified by:
      getStatPrefix in interface ExtAuthzOrBuilder
      Returns:
      The statPrefix.

    • getStatPrefixBytes

      public com.google.protobuf.ByteString getStatPrefixBytes()
       Optional additional prefix to use when emitting statistics. This allows distinguishing
 emitted statistics between configured ``ext_authz`` filters in an HTTP filter chain. For example:

 .. code-block:: yaml

   http_filters:
     - name: envoy.filters.http.ext_authz
       typed_config:
         "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
         stat_prefix: waf # This emits ext_authz.waf.ok, ext_authz.waf.denied, etc.
     - name: envoy.filters.http.ext_authz
       typed_config:
         "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
         stat_prefix: blocker # This emits ext_authz.blocker.ok, ext_authz.blocker.denied, etc.
      string stat_prefix = 13;
      Specified by:
      getStatPrefixBytes in interface ExtAuthzOrBuilder
      Returns:
      The bytes for statPrefix.

    • getBootstrapMetadataLabelsKey

      public String getBootstrapMetadataLabelsKey()
       Optional labels that will be passed to :ref:`labels<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.labels>` in
 :ref:`destination<envoy_v3_api_field_service.auth.v3.AttributeContext.destination>`.
 The labels will be read from :ref:`metadata<envoy_v3_api_msg_config.core.v3.Node>` with the specified key.
      string bootstrap_metadata_labels_key = 15;
      Specified by:
      getBootstrapMetadataLabelsKey in interface ExtAuthzOrBuilder
      Returns:
      The bootstrapMetadataLabelsKey.

    • getBootstrapMetadataLabelsKeyBytes

      public com.google.protobuf.ByteString getBootstrapMetadataLabelsKeyBytes()
       Optional labels that will be passed to :ref:`labels<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.labels>` in
 :ref:`destination<envoy_v3_api_field_service.auth.v3.AttributeContext.destination>`.
 The labels will be read from :ref:`metadata<envoy_v3_api_msg_config.core.v3.Node>` with the specified key.
      string bootstrap_metadata_labels_key = 15;
      Specified by:
      getBootstrapMetadataLabelsKeyBytes in interface ExtAuthzOrBuilder
      Returns:
      The bytes for bootstrapMetadataLabelsKey.

    • hasAllowedHeaders

      public boolean hasAllowedHeaders()
       Check request to authorization server will include the client request headers that have a correspondent match
 in the list. If this option isn't specified, then
 all client request headers are included in the check request to a gRPC authorization server, whereas no client request headers
 (besides the ones allowed by default - see note below) are included in the check request to an HTTP authorization server.
 This inconsistency between gRPC and HTTP servers is to maintain backwards compatibility with legacy behavior.

 .. note::

  For requests to an HTTP authorization server: in addition to the user's supplied matchers, ``Host``, ``Method``, ``Path``,
  ``Content-Length``, and ``Authorization`` are **additionally included** in the list.

 .. note::

  For requests to an HTTP authorization server: the value of ``Content-Length`` will be set to ``0`` and the request to the
  authorization server will not have a message body. However, the check request can include the buffered
  client request body (controlled by :ref:`with_request_body
  <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.with_request_body>` setting);
  consequently, the value of ``Content-Length`` in the authorization request reflects the size of its payload.

 .. note::

  This can be overridden by the field ``disallowed_headers`` below. That is, if a header
  matches for both ``allowed_headers`` and ``disallowed_headers``, the header will NOT be sent.
      .envoy.type.matcher.v3.ListStringMatcher allowed_headers = 17;
      Specified by:
      hasAllowedHeaders in interface ExtAuthzOrBuilder
      Returns:
      Whether the allowedHeaders field is set.

    • getAllowedHeaders

      public ListStringMatcher getAllowedHeaders()
       Check request to authorization server will include the client request headers that have a correspondent match
 in the list. If this option isn't specified, then
 all client request headers are included in the check request to a gRPC authorization server, whereas no client request headers
 (besides the ones allowed by default - see note below) are included in the check request to an HTTP authorization server.
 This inconsistency between gRPC and HTTP servers is to maintain backwards compatibility with legacy behavior.

 .. note::

  For requests to an HTTP authorization server: in addition to the user's supplied matchers, ``Host``, ``Method``, ``Path``,
  ``Content-Length``, and ``Authorization`` are **additionally included** in the list.

 .. note::

  For requests to an HTTP authorization server: the value of ``Content-Length`` will be set to ``0`` and the request to the
  authorization server will not have a message body. However, the check request can include the buffered
  client request body (controlled by :ref:`with_request_body
  <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.with_request_body>` setting);
  consequently, the value of ``Content-Length`` in the authorization request reflects the size of its payload.

 .. note::

  This can be overridden by the field ``disallowed_headers`` below. That is, if a header
  matches for both ``allowed_headers`` and ``disallowed_headers``, the header will NOT be sent.
      .envoy.type.matcher.v3.ListStringMatcher allowed_headers = 17;
      Specified by:
      getAllowedHeaders in interface ExtAuthzOrBuilder
      Returns:
      The allowedHeaders.

    • getAllowedHeadersOrBuilder

      public ListStringMatcherOrBuilder getAllowedHeadersOrBuilder()
       Check request to authorization server will include the client request headers that have a correspondent match
 in the list. If this option isn't specified, then
 all client request headers are included in the check request to a gRPC authorization server, whereas no client request headers
 (besides the ones allowed by default - see note below) are included in the check request to an HTTP authorization server.
 This inconsistency between gRPC and HTTP servers is to maintain backwards compatibility with legacy behavior.

 .. note::

  For requests to an HTTP authorization server: in addition to the user's supplied matchers, ``Host``, ``Method``, ``Path``,
  ``Content-Length``, and ``Authorization`` are **additionally included** in the list.

 .. note::

  For requests to an HTTP authorization server: the value of ``Content-Length`` will be set to ``0`` and the request to the
  authorization server will not have a message body. However, the check request can include the buffered
  client request body (controlled by :ref:`with_request_body
  <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.with_request_body>` setting);
  consequently, the value of ``Content-Length`` in the authorization request reflects the size of its payload.

 .. note::

  This can be overridden by the field ``disallowed_headers`` below. That is, if a header
  matches for both ``allowed_headers`` and ``disallowed_headers``, the header will NOT be sent.
      .envoy.type.matcher.v3.ListStringMatcher allowed_headers = 17;
      Specified by:
      getAllowedHeadersOrBuilder in interface ExtAuthzOrBuilder

    • hasDisallowedHeaders

      public boolean hasDisallowedHeaders()
       If set, specifically disallow any header in this list to be forwarded to the external
 authentication server. This overrides the above ``allowed_headers`` if a header matches both.
      .envoy.type.matcher.v3.ListStringMatcher disallowed_headers = 25;
      Specified by:
      hasDisallowedHeaders in interface ExtAuthzOrBuilder
      Returns:
      Whether the disallowedHeaders field is set.

    • getDisallowedHeaders

      public ListStringMatcher getDisallowedHeaders()
       If set, specifically disallow any header in this list to be forwarded to the external
 authentication server. This overrides the above ``allowed_headers`` if a header matches both.
      .envoy.type.matcher.v3.ListStringMatcher disallowed_headers = 25;
      Specified by:
      getDisallowedHeaders in interface ExtAuthzOrBuilder
      Returns:
      The disallowedHeaders.

    • getDisallowedHeadersOrBuilder

      public ListStringMatcherOrBuilder getDisallowedHeadersOrBuilder()
       If set, specifically disallow any header in this list to be forwarded to the external
 authentication server. This overrides the above ``allowed_headers`` if a header matches both.
      .envoy.type.matcher.v3.ListStringMatcher disallowed_headers = 25;
      Specified by:
      getDisallowedHeadersOrBuilder in interface ExtAuthzOrBuilder

    • getIncludeTlsSession

      public boolean getIncludeTlsSession()
       Specifies if the TLS session level details like SNI are sent to the external service.

 When this field is ``true``, Envoy will include the SNI name used for TLSClientHello, if available, in the
 :ref:`tls_session<envoy_v3_api_field_service.auth.v3.AttributeContext.tls_session>`.
      bool include_tls_session = 18;
      Specified by:
      getIncludeTlsSession in interface ExtAuthzOrBuilder
      Returns:
      The includeTlsSession.

    • hasChargeClusterResponseStats

      public boolean hasChargeClusterResponseStats()
       Whether to increment cluster statistics (e.g. cluster.<cluster_name>.upstream_rq_*) on authorization failure.
 Defaults to ``true``.
      .google.protobuf.BoolValue charge_cluster_response_stats = 20;
      Specified by:
      hasChargeClusterResponseStats in interface ExtAuthzOrBuilder
      Returns:
      Whether the chargeClusterResponseStats field is set.

    • getChargeClusterResponseStats

      public com.google.protobuf.BoolValue getChargeClusterResponseStats()
       Whether to increment cluster statistics (e.g. cluster.<cluster_name>.upstream_rq_*) on authorization failure.
 Defaults to ``true``.
      .google.protobuf.BoolValue charge_cluster_response_stats = 20;
      Specified by:
      getChargeClusterResponseStats in interface ExtAuthzOrBuilder
      Returns:
      The chargeClusterResponseStats.

    • getChargeClusterResponseStatsOrBuilder

      public com.google.protobuf.BoolValueOrBuilder getChargeClusterResponseStatsOrBuilder()
       Whether to increment cluster statistics (e.g. cluster.<cluster_name>.upstream_rq_*) on authorization failure.
 Defaults to ``true``.
      .google.protobuf.BoolValue charge_cluster_response_stats = 20;
      Specified by:
      getChargeClusterResponseStatsOrBuilder in interface ExtAuthzOrBuilder

    • getEncodeRawHeaders

      public boolean getEncodeRawHeaders()
       Whether to encode the raw headers (i.e., unsanitized values and unconcatenated multi-line headers)
 in the authorization request. Works with both HTTP and gRPC clients.

 When this is set to ``true``, header values are not sanitized. Headers with the same key will also
 not be combined into a single, comma-separated header.
 Requests to gRPC services will populate the field
 :ref:`header_map<envoy_v3_api_field_service.auth.v3.AttributeContext.HttpRequest.header_map>`.
 Requests to HTTP services will be constructed with the unsanitized header values and preserved
 multi-line headers with the same key.

 If this field is set to ``false``, header values will be sanitized, with any non-UTF-8-compliant
 bytes replaced with ``'!'``. Headers with the same key will have their values concatenated into a
 single comma-separated header value.
 Requests to gRPC services will populate the field
 :ref:`headers<envoy_v3_api_field_service.auth.v3.AttributeContext.HttpRequest.headers>`.
 Requests to HTTP services will have their header values sanitized and will not preserve
 multi-line headers with the same key.

 It is recommended to set this to ``true`` unless you rely on the previous behavior.

 It is set to ``false`` by default for backwards compatibility.
      bool encode_raw_headers = 23;
      Specified by:
      getEncodeRawHeaders in interface ExtAuthzOrBuilder
      Returns:
      The encodeRawHeaders.

    • hasDecoderHeaderMutationRules

      public boolean hasDecoderHeaderMutationRules()
       Rules for what modifications an ext_authz server may make to the request headers before
 continuing decoding or forwarding upstream.

 If set, enables header mutation checking against the configured rules. Note that
 :ref:`HeaderMutationRules <envoy_v3_api_msg_config.common.mutation_rules.v3.HeaderMutationRules>`
 has defaults that change ext_authz behavior. Also note that if this field is set,
 ext_authz can no longer append to ``:``-prefixed headers.

 If unset, header mutation rule checking is completely disabled.

 Regardless of what is configured here, ext_authz cannot remove ``:``-prefixed headers.

 This field and ``validate_mutations`` have different use cases. ``validate_mutations`` enables
 correctness checks for all header and query parameter mutations (for example, invalid characters).
 This field allows the filter to reject mutations to specific headers.
      .envoy.config.common.mutation_rules.v3.HeaderMutationRules decoder_header_mutation_rules = 26;
      Specified by:
      hasDecoderHeaderMutationRules in interface ExtAuthzOrBuilder
      Returns:
      Whether the decoderHeaderMutationRules field is set.

    • getDecoderHeaderMutationRules

      public HeaderMutationRules getDecoderHeaderMutationRules()
       Rules for what modifications an ext_authz server may make to the request headers before
 continuing decoding or forwarding upstream.

 If set, enables header mutation checking against the configured rules. Note that
 :ref:`HeaderMutationRules <envoy_v3_api_msg_config.common.mutation_rules.v3.HeaderMutationRules>`
 has defaults that change ext_authz behavior. Also note that if this field is set,
 ext_authz can no longer append to ``:``-prefixed headers.

 If unset, header mutation rule checking is completely disabled.

 Regardless of what is configured here, ext_authz cannot remove ``:``-prefixed headers.

 This field and ``validate_mutations`` have different use cases. ``validate_mutations`` enables
 correctness checks for all header and query parameter mutations (for example, invalid characters).
 This field allows the filter to reject mutations to specific headers.
      .envoy.config.common.mutation_rules.v3.HeaderMutationRules decoder_header_mutation_rules = 26;
      Specified by:
      getDecoderHeaderMutationRules in interface ExtAuthzOrBuilder
      Returns:
      The decoderHeaderMutationRules.

    • getDecoderHeaderMutationRulesOrBuilder

      public HeaderMutationRulesOrBuilder getDecoderHeaderMutationRulesOrBuilder()
       Rules for what modifications an ext_authz server may make to the request headers before
 continuing decoding or forwarding upstream.

 If set, enables header mutation checking against the configured rules. Note that
 :ref:`HeaderMutationRules <envoy_v3_api_msg_config.common.mutation_rules.v3.HeaderMutationRules>`
 has defaults that change ext_authz behavior. Also note that if this field is set,
 ext_authz can no longer append to ``:``-prefixed headers.

 If unset, header mutation rule checking is completely disabled.

 Regardless of what is configured here, ext_authz cannot remove ``:``-prefixed headers.

 This field and ``validate_mutations`` have different use cases. ``validate_mutations`` enables
 correctness checks for all header and query parameter mutations (for example, invalid characters).
 This field allows the filter to reject mutations to specific headers.
      .envoy.config.common.mutation_rules.v3.HeaderMutationRules decoder_header_mutation_rules = 26;
      Specified by:
      getDecoderHeaderMutationRulesOrBuilder in interface ExtAuthzOrBuilder

    • hasEnableDynamicMetadataIngestion

      public boolean hasEnableDynamicMetadataIngestion()
       Enable or disable ingestion of dynamic metadata from the ext_authz service.

 If ``false``, the filter will ignore dynamic metadata injected by the ext_authz service. If the
 ext_authz service tries injecting dynamic metadata, the filter will log, increment the
 ``ignored_dynamic_metadata`` stat, then continue handling the response.

 If ``true``, the filter will ingest dynamic metadata entries as normal.

 If unset, defaults to ``true``.
      .google.protobuf.BoolValue enable_dynamic_metadata_ingestion = 27;
      Specified by:
      hasEnableDynamicMetadataIngestion in interface ExtAuthzOrBuilder
      Returns:
      Whether the enableDynamicMetadataIngestion field is set.

    • getEnableDynamicMetadataIngestion

      public com.google.protobuf.BoolValue getEnableDynamicMetadataIngestion()
       Enable or disable ingestion of dynamic metadata from the ext_authz service.

 If ``false``, the filter will ignore dynamic metadata injected by the ext_authz service. If the
 ext_authz service tries injecting dynamic metadata, the filter will log, increment the
 ``ignored_dynamic_metadata`` stat, then continue handling the response.

 If ``true``, the filter will ingest dynamic metadata entries as normal.

 If unset, defaults to ``true``.
      .google.protobuf.BoolValue enable_dynamic_metadata_ingestion = 27;
      Specified by:
      getEnableDynamicMetadataIngestion in interface ExtAuthzOrBuilder
      Returns:
      The enableDynamicMetadataIngestion.

    • getEnableDynamicMetadataIngestionOrBuilder

      public com.google.protobuf.BoolValueOrBuilder getEnableDynamicMetadataIngestionOrBuilder()
       Enable or disable ingestion of dynamic metadata from the ext_authz service.

 If ``false``, the filter will ignore dynamic metadata injected by the ext_authz service. If the
 ext_authz service tries injecting dynamic metadata, the filter will log, increment the
 ``ignored_dynamic_metadata`` stat, then continue handling the response.

 If ``true``, the filter will ingest dynamic metadata entries as normal.

 If unset, defaults to ``true``.
      .google.protobuf.BoolValue enable_dynamic_metadata_ingestion = 27;
      Specified by:
      getEnableDynamicMetadataIngestionOrBuilder in interface ExtAuthzOrBuilder

    • hasFilterMetadata

      public boolean hasFilterMetadata()
       Additional metadata to be added to the filter state for logging purposes. The metadata will be
 added to StreamInfo's filter state under the namespace corresponding to the ext_authz filter
 name.
      .google.protobuf.Struct filter_metadata = 28;
      Specified by:
      hasFilterMetadata in interface ExtAuthzOrBuilder
      Returns:
      Whether the filterMetadata field is set.

    • getFilterMetadata

      public com.google.protobuf.Struct getFilterMetadata()
       Additional metadata to be added to the filter state for logging purposes. The metadata will be
 added to StreamInfo's filter state under the namespace corresponding to the ext_authz filter
 name.
      .google.protobuf.Struct filter_metadata = 28;
      Specified by:
      getFilterMetadata in interface ExtAuthzOrBuilder
      Returns:
      The filterMetadata.

    • getFilterMetadataOrBuilder

      public com.google.protobuf.StructOrBuilder getFilterMetadataOrBuilder()
       Additional metadata to be added to the filter state for logging purposes. The metadata will be
 added to StreamInfo's filter state under the namespace corresponding to the ext_authz filter
 name.
      .google.protobuf.Struct filter_metadata = 28;
      Specified by:
      getFilterMetadataOrBuilder in interface ExtAuthzOrBuilder

    • getEmitFilterStateStats

      public boolean getEmitFilterStateStats()
       When set to ``true``, the filter will emit per-stream stats for access logging. The filter state
 key will be the same as the filter name.

 If using Envoy gRPC, emits latency, bytes sent / received, upstream info, and upstream cluster
 info. If not using Envoy gRPC, emits only latency.

 .. note::
   Stats are ONLY added to filter state if a check request is actually made to an ext_authz service.

 If this is ``false`` the filter will not emit stats, but filter_metadata will still be respected if
 it has a value.

 Field ``latency_us`` is exposed for CEL and logging when using gRPC or HTTP service.
 Fields ``bytesSent`` and ``bytesReceived`` are exposed for CEL and logging only when using gRPC service.
      bool emit_filter_state_stats = 29;
      Specified by:
      getEmitFilterStateStats in interface ExtAuthzOrBuilder
      Returns:
      The emitFilterStateStats.

    • getMaxDeniedResponseBodyBytes

      public int getMaxDeniedResponseBodyBytes()
       Sets the maximum size (in bytes) of the response body that the filter will send downstream
 when a request is denied by the external authorization service.

 If the authorization server returns a response body larger than this configured limit,
 the body will be truncated to ``max_denied_response_body_bytes`` before being sent to the
 downstream client.

 If this field is not set or is set to 0, no truncation will occur, and the entire
 denied response body will be forwarded.
      uint32 max_denied_response_body_bytes = 30;
      Specified by:
      getMaxDeniedResponseBodyBytes in interface ExtAuthzOrBuilder
      Returns:
      The maxDeniedResponseBodyBytes.

    • getEnforceResponseHeaderLimits

      public boolean getEnforceResponseHeaderLimits()
       When set to ``true``, the filter will enforce the response header map's count and size limits
 by sending a local reply when those limits are violated.

 When set to ``false``, the filter will ignore the response header map's limits and add / set
 all response headers as specified by the external authorization service.

 Recommendation: enable if the external authorization service is not trusted. Otherwise, leave
 it ``false``.

 Defaults to ``false``.
      bool enforce_response_header_limits = 31;
      Specified by:
      getEnforceResponseHeaderLimits in interface ExtAuthzOrBuilder
      Returns:
      The enforceResponseHeaderLimits.

    • isInitialized

      public final boolean isInitialized()
      Specified by:
      isInitialized in interface com.google.protobuf.MessageLiteOrBuilder
      Overrides:
      isInitialized in class com.google.protobuf.GeneratedMessageV3

    • writeTo

      public void writeTo(com.google.protobuf.CodedOutputStream output) throws IOException
      Specified by:
      writeTo in interface com.google.protobuf.MessageLite
      Overrides:
      writeTo in class com.google.protobuf.GeneratedMessageV3
      Throws:
      IOException

    • getSerializedSize

      public int getSerializedSize()
      Specified by:
      getSerializedSize in interface com.google.protobuf.MessageLite
      Overrides:
      getSerializedSize in class com.google.protobuf.GeneratedMessageV3

    • equals

      public boolean equals(Object obj)
      Specified by:
      equals in interface com.google.protobuf.Message
      Overrides:
      equals in class com.google.protobuf.AbstractMessage

    • hashCode

      public int hashCode()
      Specified by:
      hashCode in interface com.google.protobuf.Message
      Overrides:
      hashCode in class com.google.protobuf.AbstractMessage

    • parseFrom

      public static ExtAuthz parseFrom(ByteBuffer data) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException

    • parseFrom

      public static ExtAuthz parseFrom(ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException

    • parseFrom

      public static ExtAuthz parseFrom(com.google.protobuf.ByteString data) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException

    • parseFrom

      public static ExtAuthz parseFrom(com.google.protobuf.ByteString data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException

    • parseFrom

      public static ExtAuthz parseFrom(byte[] data) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException

    • parseFrom

      public static ExtAuthz parseFrom(byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException

    • parseFrom

      public static ExtAuthz parseFrom(InputStream input) throws IOException
      Throws:
      IOException

    • parseFrom

      public static ExtAuthz parseFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException
      Throws:
      IOException

    • parseDelimitedFrom

      public static ExtAuthz parseDelimitedFrom(InputStream input) throws IOException
      Throws:
      IOException

    • parseDelimitedFrom

      public static ExtAuthz parseDelimitedFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException
      Throws:
      IOException

    • parseFrom

      public static ExtAuthz parseFrom(com.google.protobuf.CodedInputStream input) throws IOException
      Throws:
      IOException

    • parseFrom

      public static ExtAuthz parseFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException
      Throws:
      IOException

    • newBuilderForType

      public ExtAuthz.Builder newBuilderForType()
      Specified by:
      newBuilderForType in interface com.google.protobuf.Message
      Specified by:
      newBuilderForType in interface com.google.protobuf.MessageLite

    • newBuilder

      public static ExtAuthz.Builder newBuilder()

    • newBuilder

      public static ExtAuthz.Builder newBuilder(ExtAuthz prototype)

    • toBuilder

      public ExtAuthz.Builder toBuilder()
      Specified by:
      toBuilder in interface com.google.protobuf.Message
      Specified by:
      toBuilder in interface com.google.protobuf.MessageLite

    • newBuilderForType

      protected ExtAuthz.Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent)
      Specified by:
      newBuilderForType in class com.google.protobuf.GeneratedMessageV3

    • getDefaultInstance

      public static ExtAuthz getDefaultInstance()

    • parser

      public static com.google.protobuf.Parser<ExtAuthz> parser()

    • getParserForType

      public com.google.protobuf.Parser<ExtAuthz> getParserForType()
      Specified by:
      getParserForType in interface com.google.protobuf.Message
      Specified by:
      getParserForType in interface com.google.protobuf.MessageLite
      Overrides:
      getParserForType in class com.google.protobuf.GeneratedMessageV3

    • getDefaultInstanceForType

      public ExtAuthz getDefaultInstanceForType()
      Specified by:
      getDefaultInstanceForType in interface com.google.protobuf.MessageLiteOrBuilder
      Specified by:
      getDefaultInstanceForType in interface com.google.protobuf.MessageOrBuilder