Identity Facade: Authorization code grant

[Pratyush_]

Hi Team,

I came across an article of Identity Facade,Article and I have implemented the same as a POC infront of Auth0. All works well from apigee perspective, but for the Single page app, I have an issue where the frontend applications is using the Auth0 provided library(React for example) are unable to keep using the same library. As apigee responds with a opaque token, Auth0 library is unable to decode the id_token, if we directly pass the id_token coming from Auth0 back to the client application, it fails as the domain won't match.

Any solution or recommended plugin for this scenarios would really help.

@strebel @dchiesa1 

[strebel]

Assuming your client app needs to read certain claims from the token you could try to generate a proper JWT instead of the opaque token as described here: 

https://cloud.google.com/apigee/docs/api-platform/security/oauth/using-jwt-oauth?hl=en#generating

if you followed the reference implementation you'd have to replace this policy https://github.com/apigee/devrel/blob/main/references/identity-facade/apiproxy/policies/OA2-Generate...

I'd just recommend not to include the Auth0 token in any claims of the Apigee generated JWT, otherwise clients could extract the wrapped token and call the underlying API without the API facade.