How to add authentication to an unauthenticated request

[studersi]

We have a new, somewhat untypical use-case that we are unclear how best to implement with mod_auth_openidc. In fact, we are unsure, whether `mod_auth_openidc is even the right tool for this or if the approach is correct in general.

We have unauthenticated clients that need to consume an authenticated API through a reverse proxy with mod_quth_openidc.

flowchart LR
  Client--unauthenticated---Proxy[Reverse Proxy with mod_auth_openidc]--authenticated---API

Loading

One idea was to use an OIDC Client Credential Flow on the reverse proxy for this but it does not look like mod_quth_openidc supports this.

Is there a way to achieve this with mod_quth_openidc and are there any plans to support this use-case?

Also, are there any general issues with this approach, aside from the fact that an authenticated API is exposed without authentication?

[zandbelt]

mod_sts using the Client Credentials exchange type supports that scenario, see: https://github.com/OpenIDC/mod_sts?tab=readme-ov-file#oauth-20-client-credentials-cc; one could consider this an OAuth-flavored alternative to using a service credential to talk to downstream services where in the past basic authentication or a client certificate would be used, which is why it was added to mod_sts (on user demand); I don't see an issue with that (as long as the access token scope is restricted).

[studersi]

Thank you for the quick reply, we will give mod_sts a try!