Tyk comes with support for OpenID Connect Identity Tokens provided by any standards compliant OIDC provider.
The OIDC Flow:
- User requests access to resource via a supported OIDC Provider (e.g. Google)
- User logs into resource provider and grants scope access to their data
- Identity Provider generates OAuth token set and OIDC ID Token, ID Token is signed by provider with their public key
- User’s Client utilises OIDC ID Token as access token for an API Managed by Tyk Gateway
- Tyk Gateway validates OIDC ID Token signature
- Tyk Gateway checks the IDP is a recognised IDP (registered as approved)
- Tyk Verifies the client ID as one that is trusted and pre-registered with Tyk Gateway
- If the client ID is valid, Tyk applies the policy ID matched with this client to the user session
- Tyk then validates the users session according to the quotas, rate limits and access rules for the matching policy for either the bearer of the token across all clients they use from this IDP or validates the session on a per client / per identity basis, e.g. User Alice will have different Access Rules depending on whether they are using a mobile client or a web client.
With this flow, Tyk does not need to be aware of the user or the token in advance, it only needs to know about the approved IDPs, approved ClientIDs within those IDPs and which Policy to apply to those Client IDs.
An example flow with Auth0:
Behaviour – Internal Tokens
When an OIDC token is processed, Tyk actually generates an internal representation of the bearer, this ID is a hash of the organisation and user-id provided by the IDP for this user. Tyk uses this internal ID to hang policy rules off of during the lifetime of the users usage of the API.
It is useful for the downstream service to be abel to query this data somehow in order to manage access (e.g. to invalidate the token at some point). To make this possible, Tyk adds the internal Token ID to the meta-data of the session object.
It is possible to inject this as a header into the request moving upstream to the underlying service using header injection and invoking the reserved meta data field:
In order to make OIDC Access tokens meaningful in analytics data, Tyk will also set na ALias for the itnernal token so the user can be easily identified in analytics. The OIDC Alias will always be the
ClientID + User ID provided by the IDP. This can then be queried separately by
Setting up OIDC
To set up an API Definition to use OIDC, add the following block to the definition, and ensure no other access methods are enabled:
Set to true to enable the OpenID Connect check
A list of authorised providers and their client IDs/Matched Policies
The list of client IDs and policy IDs to apply to users thereof.
Note: Client IDs are Base64 encoded, so the map is:
When a valid user appears from a matching IDP/Client ID, the policy listed in this entry will be applied to their token across OIDC ID Tokens.
Enable this to have the policy applied to the combination of the User ID AND the Client ID, this is best served by an example:
When alice uses the mobile app to log into the API, Tyk applies the same rate limit and access rules as if she had logged in via the web app or the desktop client.
When alice uses the mobile app to log into the API, Tyk applies different rate limit and access rules than if she had logged in via the web app or the desktop client, in fact, each client and user combination will have it’s own internal representation.