clawrenceks / ReferenceTokenExchange

ASP.NET Core Middleware providing reference token exchange with Identity Server 4
5 stars 2 forks source link

How to make ReferenceTokenExchange work in an ApiGateway that calls out to multiple APIs? #8

Open kbrownhbs opened 6 years ago

kbrownhbs commented 6 years ago

Scenario:

We have an architecture where a client calls out to multiple services via an API Gateway. Let's label the parts of the system as follow: CLIENT GATEWAY (scope 'gateway') API-A (scope 'A') API-B (scope 'B')

Upon user login, CLIENT is issued a reference token that has scope 'gateway' which is submitted with subsequent requests. For requests targeting API-A, the API gateway must exchange the reference token for an access token with scope 'A'. Similarly, for requests targeting API-B, the API gateway must exchange the reference token for an access token with scope 'B'.

The current cache needs to be extended to support multiple scopes per reference token. One possible solution is to change cache storage to a Dictionary (actually ConcurrentDictionary) where the key is scope concatenated with reference token i.e. $"{scope}:{referenceToken}"