Support for Multiple authorizers

This is a Feature Proposal

Description

Be able to specify multiple authorizers for a single api end point:

At the moment we are restricted to have only one (at least I could not find in the docs how to specify multiples), example:

- http:
    path: graphql
    method: post
    cors:
      origins:
        - '*'
    authorizer:
      arn: arn:aws:cognito-idp:us-east-1:XXXXX:userpool/us-east-XXXXXX
      identitySource: method.request.header.Authorization

I can configure multiple authorizers using the API Gateway Web UI.

In my case I have 2 UserPools and also Facebook authentication (that I’ll implement as a custom authorizer). A user authenticated in any of these should be able to access the API.

[crcommons]

@AshUK How do you assign multiple user pools to an API gateway with serverless?

[HyperBrain]

I think you can only set one authorizer per APIG endpoint. Nevertheless, you can create multiple authorizers and assign them to different endpoints.

The AWS documentation refers to a single authorizer in the method configurations only. E.g. here:

Choose one of the available Amazon Cognito User Pool authorizers from the drop-down list. http://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html

Under Authorization Settings, expand the Authorization drop-down list to select the custom authorizer you just created (myTestApiAuthorizer), and then choose the checkmark icon to save the choice. http://docs.aws.amazon.com/apigateway/latest/developerguide/use-custom-authorizer.html

IMO, to support all of the authentication methods on a single endpoint, you’d have to write your own custom authorizer, that internally evaluates the Authorization header and does the access control validation for the needed authentication providers internally.