Identity-Aware Proxy

[electroheadfx]

Description 📓

is exist an implementation with Google Identity-Aware Proxy (IAP) ? I'm not sure to find it in the doc. I think its totally different implementation with Google Auth2 identity

How to reproduce ☕️

https://cloud.google.com/iap/docs/enable-external-identities

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[kriswuollett]

@electroheadfx there doesn't appear to be any implementation for Google IAP which I'd imagine being called a jwt auth type. NextAuth only has oauth, email, and credentials. If you take a look at the credentials' authorize callback you'll see that there is headers available:

next-auth/packages/next-auth/src/core/routes/callback.ts

Lines 325 to 329 in 0e6c51a

	user = await provider.authorize(credentials, {
	query,
	body,
	headers,
	method,

I'm interested in this as well, and I'd probably approach it as creating a custom credentials provider with a jwt field, use a custom signIn page parameter that is handled in middleware that posts to the callback which in turn should let the provider verify the JWT:

next-auth/packages/core/src/lib/routes/callback.ts

Lines 261 to 265 in 45f423e

	user = await provider.authorize(
	credentials,
	// prettier-ignore
	new Request(url, { headers, method, body: JSON.stringify(body) })
	)

And if verified the middleware should then redirect the user to the originally requested URL after optionally using the People API to add details like photos beforehand.

@balazsorban44, perhaps something like a jwt provider type could be created to avoid writing a workaround-like custom middleware? Could take in the parameters like the jose.JWTVerifyGetKey and header name to find the JWT.

[garnerp]

@kriswuollett did you ever end up making this work?

[kriswuollett]

@garnerp no, I haven't yet, other project priorities put this in the back of the queue.

[aryzle]

I opted to follow the example here https://github.com/vercel/examples/tree/main/edge-middleware/jwt-authentication instead of using NextAuth

[garnerp]

I see a lot of value in taking advantage of using next-auth's session/jwt capabilities and the client hooks and server side getServerSession. Did you end up building all of that in yourself? I can see the above example would be sufficient to stop anyone from getting into your application's protected routes based on a valid JWT.

[aryzle]

I did not see much value in next-auth's session/jwt capabilities for our use case, I just pass the the user info we need to the client through a cookie, otherwise things happen server side. Also passing an exp time to the client so we can check it and if expired force a login.

What pieces of the session/jwt capabilities do you see as most valuable? hopefully I'm not missing something 😄