# Combine OAuth2 with existing serverside Authentication methods

**URL:** <https://discuss.konghq.com/t/combine-oauth2-with-existing-serverside-authentication-methods/1733>\
**Category:** Questions\
**Created:** [August 22, 2018, 12:28pm UTC](https://discuss.konghq.com/t/combine-oauth2-with-existing-serverside-authentication-methods/1733 "2018-08-22T12:28:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zetisam](https://avatars.discourse-cdn.com/v4/letter/z/f19dbf/32.png) [@zetisam](https://discuss.konghq.com/u/zetisam)\
**Post date:** [August 22, 2018, 12:28pm UTC](https://discuss.konghq.com/t/combine-oauth2-with-existing-serverside-authentication-methods/1733/1 "2018-08-22T12:28:22Z")

</div>

Our API is currently accessible using Basic Authentication directly on the API server itself. The user credentials are stored in our database and we perform credential checking locally.

Now I’ve implemented the OAuth2 plugin using the Kong guidelines. As a first attempt I’ve set this up using a separate route, and everything is working correctly.

Now I want to combine this with the way we currently work, in order to maintain some backwards compatibility for at least several months. So essentially the user can either use OAuth2, or the Authorization header is passed on to the backend for us to do the checking.

I know I can use the “basic authentication” plugin in Kong, but that would require me to recreate all my users as consumers in kong, and keep them synced. Which is too much hassle…

Are there solutions for this?

---

<div class="post-metadata">

**Author:** ![zetisam](https://avatars.discourse-cdn.com/v4/letter/z/f19dbf/32.png) [@zetisam](https://discuss.konghq.com/u/zetisam)\
**Post date:** [August 22, 2018, 1:25pm UTC](https://discuss.konghq.com/t/combine-oauth2-with-existing-serverside-authentication-methods/1733/2 "2018-08-22T13:25:47Z")

</div>

Answering my own question here, because I have figured it out. I hope it can help someone else.

I’ve created a new kong consumer called ‘anonymous’ (but the name doesn’t matter). I’ve then enabled anonymous access in the OAuth config using the UUID of the consumer. This way, when OAuth fails, it assumes the anonymous consumer is logged in.

Also the ‘hide credentials’ setting in OAuth must be set to false.

In my backend I just ignore the anonymous user, and parse the Authorization headers like I used to.

---

<div class="post-metadata">

**Author:** ![Cooper](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/cooper/32/9_2.png) [@Cooper](https://discuss.konghq.com/u/Cooper)\
**Post date:** [August 22, 2018, 4:45pm UTC](https://discuss.konghq.com/t/combine-oauth2-with-existing-serverside-authentication-methods/1733/3 "2018-08-22T16:45:30Z")

</div>

Good news @zetisam, thanks for sharing!

For others that find this thread, you may care to also review Kong’s documentation on [Anonymous Access](https://docs.konghq.com/latest/auth/).

---

<div class="post-metadata">

**Author:** ![zetisam](https://avatars.discourse-cdn.com/v4/letter/z/f19dbf/32.png) [@zetisam](https://discuss.konghq.com/u/zetisam)\
**Post date:** [August 23, 2018, 9:28am UTC](https://discuss.konghq.com/t/combine-oauth2-with-existing-serverside-authentication-methods/1733/4 "2018-08-23T09:28:35Z")

</div>

Didn’t come across that link in my searches (was looking for stuff like ‘passthrough’ etc, not ‘anonymous’).  
Reading the article in the documentation clears things up 🙂

The multiple authentication bit is also very useful