Handling external authentication with routing.yml

Question

I am building a new page (general use of "page", not literally referring to the node type) in my Drupal site that should only be accessible to members that have a certain permission. I have defined the routing for this in mymodule.routing.yml as follows:

mymodule.connector:
  path: '/mymodule/connector'
  defaults:
    _controller: \Drupal\mymodule\Controller\MymoduleConnectorController::content
  requirements:
    _permission: 'view mymodule entity'

This so far is working nicely, my accounts with this permission are able to view the content.

I also need /mymodule/connector to be accessible via an ajax request from a web view app that I made, which uses the same login credentials as my Drupal site, so essentially I need external authentication to work. I have tried to accomplish it by adding basic auth to my routing as explained here:

mymodule.connector:
  path: '/mymodule/connector'
  defaults:
    _controller: \Drupal\mymodule\Controller\MymoduleConnectorController::content
  requirements:
    _permission: 'view mymodule entity'
  options:
    _auth: ['basic_auth']

However, when testing with Postman, using Basic Auth with my user credentials, this is a 403 error.

Is something wrong with my routing? I am not sure what else it could be as I am not very experienced with authentication.

Answer 1

I can't believe I missed this. I simply had to go to /admin/modules and enable these:

Answer 2

Thank for putting this up. I have been spending hours trying to get key_auth to work with a custom endpoint in one of my contrib modules, and what I was missing was the options key:

spectra.post_api:
  path: '/spectra/post'
  defaults:
    _title: 'Spectra POST API'
    _controller: '\Drupal\spectra\Controller\SpectraController::post_api'
  methods: [POST]
  options:
      _auth: ['key_auth', 'cookie']
  requirements:
    _permission: 'access spectra post api'

Just to expand on your solution, the auth array can include multiple parameters, and in my case, I did not need RESTful Web Services or any of the listed modules. However, HTTP Basic Auth might need them.