Pass the raw ID Token to downstream requests about oidc-authservice HOT 4 OPEN

Another thing enabled by forwarding the id token is that, if desired, the backend service could verify the token / signature for an extra layer of security.

from oidc-authservice.

@SachinVarghese if I may ask, what do you need the IDToken for? You can get the ID from the HTTP headers (username and groups). Is there anything else missing?

from oidc-authservice.

Hi @yanniszark The IDToken provides additional info like user email and other extra details missing in the headers currently.

Also, more importantly, the raw ID token could be useful to make requests to another service behind the auth service. For example, a potential use case would be a Kubeflow pipeline task needing to make a Seldon Core inference using the same credentials as the user who triggered the pipeline run via the auth service. It would be great to know if you have any ideas.

from oidc-authservice.

@asetty @SachinVarghese thanks, I think this makes sense. The current authenticator abstraction can't access the ResponseWriter, so the first step would be to plumb it through and make it available in the authenticator code. Or alternatively, expose some functionality to set headers/cookies in the authenticator.

from oidc-authservice.