How do I implement oauth2 with kong api gateway?

1
votes

I want to implement an api gateway for a bunch of micro services running on laravel. In front of the gateway there is an angular client where the user has to login with the username and password. The idea is that the user sends the request with the credentials to the gateway which forwards it to the authentication service. If the data is correct, a token will be issued, which will be included in every further request.

I think I will implement the gateway with kong and the oauth2 plugin. I have already looked at their documentation https://docs.konghq.com/hub/kong-inc/oauth2/#resource-owner-password-credentials but I don't really understand the flow.

Does the angular client have to communicate directly with the authentication service on the first request? And if so, does the authentication service need an own url? I think it would make more sense if all the request would go through the gateway, wouldn't it?

Thank you!

1
laravelauthenticationoauth-2.0api-gatewaykong
It really depends on your implementation, but Angular app is SPA usually. SPA apps should use OpenID Connect Code Flow with PKCE and it should be implemented by SPA app itself (e.g. github.com/damienbod/angular-auth-oidc-client). Auth proxy (kong in your question) will not be able to provide user identity to SPA app without nonstandard app/gateway hacking. - Jan Garaj

1 Answers

1
votes

From what I understood, your angular app can send username:password to kong gateway and that will proxy the request to your authentication service. You can verify if the user is legit in your auth service.

1) if legit, then make a request to /oauth2/token endpoint provided by kong's oauth2 plugin. Kong will return your auth service an access_token which you can return back to the user

2) If not legit then throw an error.

Does the angular client have to communicate directly with the authentication service on the first request?

Only if your auth service is a third party service you can do that.