Description
Provide the router the ability to act as an OAuth2 Confidential Client to mint/exchange tokens with Azure AD, Okta, or other OIDC providers on behalf of the user using the OBO (On-Behalf-Of) flow.
(Additional Context: We are specifically targeting support for PocketID OIDC as part of this implementation).
Motivation
This natively bridges static AppKeys to dynamic downstream JWTs, solving the Meta-Routing paradox entirely without relying on Pass-Through Auth. The client sends a static AppKey, and the Router handles negotiating the fresh, short-lived JWT directly with the identity provider before invoking the downstream backend.
Description
Provide the router the ability to act as an OAuth2 Confidential Client to mint/exchange tokens with Azure AD, Okta, or other OIDC providers on behalf of the user using the OBO (On-Behalf-Of) flow.
(Additional Context: We are specifically targeting support for PocketID OIDC as part of this implementation).
Motivation
This natively bridges static AppKeys to dynamic downstream JWTs, solving the Meta-Routing paradox entirely without relying on Pass-Through Auth. The client sends a static AppKey, and the Router handles negotiating the fresh, short-lived JWT directly with the identity provider before invoking the downstream backend.