One Auth Gateway to authenticate them all
summary
A single authentication gateway runs on EKS with Envoy/Istio and ORY Oathkeeper to centralize auth for four brands, verifying every inbound request, replacing external tokens with an internal JWT and supporting Cognito, Azure AD, Hydra and social logins via custom authenticators. Token revocation uses Redis, short caches use in‑memory maps, and the deployment scales in production. Policy configuration lives in YAML and has grown to 2000+ lines, which works but creates operational friction.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:07Johannes Group
- 5:00Objectives
- 7:25Why Ory Keeper
- 14:07Responsibility of Ory Keeper
- 15:56Internal JWT token
- 17:16Customizations
- 20:59Learnings
- 24:30QA
related talks
37mOne Auth to Rule them All: Centralizing Authentication with Azure and API Gateway
36mAdvanced Authentication patterns at the Edge
27mCentralise legacy auth at the ingress gateway
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
27mAdvanced Authentication patterns at the Edge
39mAuthN and AuthZ at Cruise: Crawl, Walk, Run
47mAuthentication and Authorization in the World of Media and Identity Providers
59mAchieving Zero Trust with AWS application networking