Any way to forward an auth session from OAuth system to another system (with API key)?

Question

Description

This is a long shot, but I'm in dire need of advice. If you know of a more appropriate forum for this type of question please share!

I'm working with a legacy OAuth system using email + password grant type (deprecated, I know: it's out of my control).

I have to somehow connect this authentication service with a database backend for which I have an API key for.

Existing architecture

Everything already exists other than whatever middleware solution that should handle the authentication validation and request header modifying.

Ideal flow

User logs in with OAuth service with email + password, gets access token
User sends backend request to some middleware, which does introspection / validates access token
Middleware appends API key to request header to retrieve backend data

Things I've considered

Traefik instance + auth forwarding This seems to expect authentication to be done in the middleware rather than passing and introspecting an access token. Also the OAuth service's introspection endpoint requires client ID and client secret as documented here.
Ory Oathkeeper This seems to expect arguments which would be used for regular OAuth2 redirect flow, such as pre_authorization.

Can you clarify your question? What is the problem you are trying to solve? Does the legacy OAuth service not provide a token? In your diagram, which parts are missing or not functioning the way you want? — Greg Burghardt, Sep 9, 2022 at 16:57
So the legacy OAuth service is PingFederate? Could you federate it with a different OAuth provider which would be under your control, so that you can decouple your new system from the legacy OAuth service? For example: auth0.com/docs/authenticate/identity-providers/… — Ben Cottrell, Sep 9, 2022 at 19:55
@GregBurghardt I can see that my post was missing context. I've added some more information and updated the diagram. Yes, the legacy OAuth service has a working token endpoint and working introspection endpoint, but these are unfortunately not associated with the backend service. — cjhines, Sep 10, 2022 at 12:02

cjhines · Accepted Answer · 2022-09-15 16:25:59Z

I was able to accomplish this with Ory Oathkeeper.

There is an unmerged pull request there which makes it possible to authenticate against some URL before forwarding the request + response.

Most importantly this method forwards all request elements. In this case I needed the body to be forwarded for the client ID + secret.

The authenticator configuration looks like this:

authenticators:
  remote_json:
    enabled: true
    config:
      service_url: <REDACTED>
      preserve_path: true
      method: "POST"

1 Answer 1