Hi,
I’m trying to secure a Kong Gateway service using the OpenId plugin. The redirect to the ID provider works fine, and then the provider redirects back to my service route with a code and authState in the query string. I was expecting that Kong would intercept this and exchange the code for a token, and then pass that down in the header to the ultimate http service.
Am I misunderstanding how this works? Does my http service need to manually exchange the code for a token - that seems a bit strange?
I’ve tried with ngrok as well - they provide a redirect oauth endpoint which exchanges the code for the token and passes it on to the protected http service, so I assumed Kong worked similiarly (although I can’t find a redirected URL, so I was thinking perhaps Kong inspected the query string and if there is a code it automatically exchanges it for a token before proceeding with proxying the route)