What is the best architectural way to connect Envoy filter (API Gateway), PingFederate (Auth Server) and OPA (Policy Engine) for an IAM solution?

Question

I would like to deploy this on Kubernetes. Would it make sense for both the Auth Server and the Policy engine to talk to the API Gateway independently or is it more accurate for only the Auth Server to talk to the API Gateway and the OPA to talk to the API Gateway only via the Auth Server

Answer 1

At Curity we have some good resources related to this. Usually the first key consideration is around components that use data sources:

• APIs
• Authorization Server

These are always deployed with a reverse proxy / gateway in front of them, so that an attacker has to breach 2 layers to access data sources - this is covered in our IAM Primer.

In addition the gateway can then provide some interesting capabilities:

• Token Introspection and Caching

• Dynamic Routing

In terms of OPA it depends how you will use it - here are a couple of possible options:

• Gateway calls OPA to perform high level checks to grant or deny accesx as in this OPA use case

• The API calls OPA and passes it a Claims Principal, then uses the response to decide how to filter results, as described in our Claims Best Practices article