Chaining openID token

Question

I'm working in microservices environment, where each service authenticates using OpenID Connect to an authentication service (local IdP), based on Users I keep locally on my Database.

Now, I want these services to be able to authenticate using Azure, Google, etc.

Can (and should) I modify my authentication service to allow redirection to another IdP, and replace or chain the token to my proprietary token for my services? Is there a simpler way?

How can I allow users to login both using name / password OR external IdP?

Answer 1

There is a designed process, but it's not simpler. This is called federated identity. You'll likely need an IDM like Keycloak to handle the configuration and protocols.