Hi,
I'm trying to understand how to setup policys to allow multiple ways of auth with a proxy.
In short we have 3 different scenarios.
1. Service to service calls from GCP cloud run, gke, workflow etc. In this case I would like to send the service account JWT, validate it and if possible extract the roles to check that the SA may invoke the proxy.
2. Calls from non-GCP hosted services. In this case I'd like to use OAuth2 with app credentials from the Portal.
3. User generated calls from internal apps where the user is authed using Azure AD SSO. In this case I'd like to send an Azure AD JWT along, have it validated and extract roles/claims to check if the user may invoke the proxy. In some cases users in department A may only read, and department B may update so I would like to check this on endpoint level or uri based.
Is this possible? Or is it a bad approach?
LinkedIn
Twitter
