We have a use case for allowing access to several services using the same session generated by our OIDC plugin. With this being a subset of services using a global plugin is not ideal. How can this be achieved?
Kong Gateway: Sharing OIDC session across plugin instances
Uses:
Kong Gateway
TL;DR
How do I share an OIDC session across multiple scoped plugin instances?
Configure each scoped OIDC plugin instance with the same issuer and the same Config.Session Secret, and enable session management on each.
A session created against one instance is then accepted by the others. Use with caution, as a shared secret can have unintended consequences if misconfigured.
Solution
This can be done by using the same session secret across multiple plugin instances. This should only be done with extreme caution and this can lead to unintended consequences if improperly configured.
To configure this:
- Create your first scoped OIDC plugin, i.e: service level. Configure the plugin as needed for your desired auth methods and additionally enable:
- Session Management
Config.Session Secret
- Configure a new instance of the plugin for the 2nd entity you wish to protect (service/routes/etc):
- Configure the same issuer as for step 1
- Enable session management, no other auth methods are required
- Configure the same
Config.Session Secretas done for the first instance.
You can now consume the first service using the desired auth method and a new session will be created. Upon accessing the second service the same cookie will be passed back to the server and validated allowing access.