We are trying to implement an authorization and authentication service for our product.
Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in Database for accessing our product since we have different kinds of client applications that use either one of these security mechanisms. Each of such IAM systems would also hold the necessary authorisation roles as well in their respective formats as expected.
We are thinking of building an API Gateway between our clients and backend microservices, that has a pluggable security module that can cater to requests from either SSO, LDAP, Username+Password in Database based clients to authenticate and authorise the incoming requests accordingly and issue a JWT for system-wide use within the downstream internal microservices in our backend. Does this design approach seem reasonable for my usecase?