Custom Authentication Integration

[naoko]

Hello,
We want to use ForgeRock as authentication service for Tyk.
What would be the best way to accomplish this?

[Martin]

Hi Naoko,

We recently released the Tyk Identity Broker to help bridge the gap between IDMs and Tyk, you can can send your traffic to TIB, it will proxy or validate against the third party provider (there are various ways, and generic handlers are provided) and then use that validation to generate an API token for the user so hey can use Tyk.

While it does this, it embeds identity information within the token metadata in Tyk so that it can be used upstream in your services using our API, or header injection modules.

The Tyk Identity Broker is available open source and we encourage users to modify it to their needs. It acts very similarly to Amazons Secure Token Service for integrations like this.

We tested it against Auth0 here:

Tyk.io + Auth0

Imported Google Group message. Sender:Martin Buhr. Date:Friday, 15 January 2016 13:08:32 UTC. Hi Carl, There’s a problem here, because each user will need it’s own ID (key) in Tyk, and since you can’t influence the identifier (sub OR kid) in the JWT that is provided using Auth0 you’re stuck since the Tyk ID (key) will never be the same as the Auth0 ID, although I guess you could use custom tokens to make them match, but that’s not great. The way Tyk validates JWT’s is that one key has one s…

What kind of flow are you thinking of using?