CyberArk Conjur Secrets Manager and Kong

Questions
,
1

Hello Team,
I am working on an integration where Kong acts as a Trusted Broker to retrieve secrets from CyberArk Conjur using the authn-jwt authenticator.

The proposed flow:

  1. Client authenticates to Kong (OIDC/API Key).

  2. Kong performs a Client Credentials grant with Ping IDP to obtain its own Workload JWT.

  3. Kong exchanges this JWT with Conjur for a short-lived access token.

  4. Kong retrieves the backend API secret and injects it into the upstream request.

Since this requires an ‘outbound’ identity handshake before the ‘upstream’ call, would you recommend building this as a custom Lua plugin in the access phase, or is there a way to leverage the existing OIDC plugin for this multi-step token exchange? Any insights on performance overhead for this JIT secret retrieval would be greatly appreciated.

image
image1408×768 149 KB

Regards
Nirmal

2

Hi Nirmal,

If you are using Kong Enterprise Edition, we have a plugin called upstream-OAuth that does an outbound client credentials flow. You can try to use that to see if it fits your need. OIDC plugin works on the request (consumer to Kong)

-Veena