Ocelot without IdentityServer, but with GCP Identity Platform?

[pburrows]

I am evaluating using Ocelot for a project, but I do not, in any way, want to use IdentityServer. A lot of the documentation seems to specifically reference IdentityServer (and the very outdated IdentityServer4), to the point that it isn't clear if it is possible to use Ocelot without SOME amount of IdentityServer set up. I am planning to use GCP Identity Platform for the IdP and want to make sure I can configure Ocelot to use that without having to set up IdentityServer.

Thanks!

[raman-m]

Hello, Patrick!
It's great news that you're considering using Ocelot for your project. Allow me to assist you in making the final decision. 😉

I am evaluating using Ocelot for a project, but I do not, in any way, want to use IdentityServer.

To clarify, the main Ocelot package does not directly reference IdentityServer:

• A search for IdentityServer4 reference confirms that there is no reference to it in the Ocelot package. However, references exist in the Ocelot.Administration and testing projects.

Therefore, using the Ocelot package does not inherently mean you are utilizing IdentityServer functionality.

---

A lot of the documentation seems to specifically reference IdentityServer (and the very outdated IdentityServer4),

Indeed, a search for the keyword "IdentityServer" reveals a significant issue: authentication has been developed using IdentityServer4 since 2017. Consequently, our documentation may mislead developers into using IdentityServer4, when in fact, any authentication solution or package with a .NET driver's package can be used. The issue is confined to the Ocelot.Administration package, which directly references IdentityServer4. Our team needs to retire this package and introduce a new one named Ocelot.Administration.IdentityServer4.

---

it isn't clear if it is possible to use Ocelot without SOME amount of IdentityServer set up.

It is indeed possible to use Ocelot without necessarily setting up IdentityServer. Like any ASP.NET Core application, Ocelot's Authentication documentation outlines a variety of authentication providers that can be utilized, such as:

• General JWT Tokens
• Identity Server Bearer Tokens. So, as a team, we just propose to use, and don't require!
• Auth0 by Okta
• put your favorite auth-lib into the list

You can configure any authentication provider during the app startup, including Google Auth. For integrating Google authentication, the Google.Apis.Auth.AspNetCore3 library is recommended for ASP.NET Core 3 applications, and for more general purposes, the Microsoft.AspNetCore.Authentication.Google package can be used.

---

I am planning to use GCP Identity Platform for the IdP and want to make sure I can configure Ocelot to use that without having to set up IdentityServer.

Successful integration with GCP services necessitates a .NET driver with released packages. Allow me to research this...
It appears feasible because Google enables integration from .NET applications using google-cloud-dotnet tools. Could you please check the proposed list of APIs?

Yahoo... The next library you need to learn is Google.Cloud.Iam.Admin.V1 🥳
Thus, you must reference the Google.Cloud.Iam.Admin.V1 package from NuGet.

---

P.S. and FYI

Ocelot doesn't need any direct settings to operate any Auth providers because that's beyond its scope. Ocelot simply executes the code of any attached Auth Sidecar library. The developer is responsible for setting up the auth provider.
The final solution may require the replacement of some interface objects in the DI-container.
We will assist you with the integration if you decide to proceed with GCP.
Best of luck!

[raman-m]

The current File-model, mapped from JSON, includes only the following properties:

Ocelot/src/Ocelot/Configuration/File/FileAuthenticationOptions.cs

Lines 18 to 23 in d310508

	public List<string> AllowedScopes { get; set; }
	[Obsolete("Use the " + nameof(AuthenticationProviderKeys) + " property!")]
	public string AuthenticationProviderKey { get; set; }
	public string[] AuthenticationProviderKeys { get; set; }

aka a list of scopes and the key for the authentication policy established in the C# application startup code. Thus, Ocelot is authentication-library agnostic, delegating the responsibility to the developer to implement valid C# code for successful authentication.

[pburrows]

What an amazingly thorough answer! Thank you @raman-m!