# Kong DB-less mode and dynamic Consumers

**URL:** <https://discuss.konghq.com/t/kong-db-less-mode-and-dynamic-consumers/5046>\
**Category:** General\
**Created:** [December 1, 2019, 3:04pm UTC](https://discuss.konghq.com/t/kong-db-less-mode-and-dynamic-consumers/5046 "2019-12-01T15:04:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rasouza](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/rasouza/32/1549_2.png) [@rasouza](https://discuss.konghq.com/u/rasouza)\
**Post date:** [December 1, 2019, 3:04pm UTC](https://discuss.konghq.com/t/kong-db-less-mode-and-dynamic-consumers/5046/1 "2019-12-01T15:04:39Z")

</div>

I’m studying a little bit more about service mesh (istio) and found out Kong has awesome features to work with, so I decided to integrate it in my service mesh.

I’m trying to achieve End-User Authentication feature in my service mesh, and reading a little bit more I got stuck in Consumers part. It says a Consumer is a human trying to access a Service, and since Kong in k8s is recommended without DB (due to delcarative configs) how will I implement authentication feature for my microservices for each user?

In database mode, it seems fine to keep Kong db in sync with my ‘users’ microservice db, then it’s just a matter of using a plugin. Although it seems a bad practice to create a Consumer yaml for each user that signs up in my system

How do I approach this?

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [December 2, 2019, 8:49pm UTC](https://discuss.konghq.com/t/kong-db-less-mode-and-dynamic-consumers/5046/2 "2019-12-02T20:49:22Z")

</div>

Depending upon the scale of consumers, you’ve three options:

- If there are not going to be a lot of consumers, then you can create KongConsumer resource for each user that signs up. A lot mean, less than a thousand (no data to back this up).
- If you have a lot of consumers, then you should deploy Kong with a database and then configure the consumers in Kong’s database. Please note that only the consumers are configured via your sync script/app. Rest of the configuration will be taken care of by Kong.
- If you can, you should rather integrate an IdP with Kong, meaning, you don’t need a consumer resource for each of your user and also get to run Kong in DB-less mode.

---

<div class="post-metadata">

**Author:** ![rasouza](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/rasouza/32/1549_2.png) [@rasouza](https://discuss.konghq.com/u/rasouza)\
**Post date:** [December 26, 2019, 5:09am UTC](https://discuss.konghq.com/t/kong-db-less-mode-and-dynamic-consumers/5046/3 "2019-12-26T05:09:54Z")

</div>

Thanks for replying! Can you please explain a little more about the third option? How do I integrate with as IdP? Is there a famous one well used by community? How does that work?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [December 26, 2019, 11:29pm UTC](https://discuss.konghq.com/t/kong-db-less-mode-and-dynamic-consumers/5046/4 "2019-12-26T23:29:49Z")

</div>

You can use Nokia’s OIDC plugin and integrate any IdP that supports the OIDC protocol.

Kong then doesn’t store any identity information and relies on a third party to do that.

OIDC is supported by most IdP providers like Okta, Google, Ping etc.