Mixed OIDC/OAuth 2.0 with multiple issuers?

[towo]

Cheers,

I'm currently running into the problem of figuring out the 'correct' way to handle a flow that allows:

1. A normal web browser user to use OIDC to authorize themselves for a site.
2. A service (specifically: GitLab CI) presenting an access token issued by the GitLab instance
3. Another service just using either an access token by another provisioner or possibly a headless OIDC authorization with the module, but I'm not sure that's possible

Previously, this could be done with the SPA/"Backend for Frontend" approach, and I could just use on OIDCOAuthVerifyJwksUri that validates the GitLab tokens. But seeing as that falls under the umbrella of the deprecated feature set, and that it's not possible to specify multiple OIDCOAuthVerifyJwksUri, this needs another solution.

From what I can tell so far, I'd probably need to split it up to either have different vhosts or at least different Locations so that I can use mod_oauth2 as well as mod_auth_openidc, and just have to deal with the duplication.

Am I overlooking a more convenient way? The simplified workflow for this desired solution would be:

1. Check if bearer token is presented
2. Check if bearer token is an access token that validates with either issuer A or issuer B
3. Grant access if successfully verified
4. Go through normal OIDC Authentication Flow if not a valid access token, discarding it entirely

The authorization part can be done fairly securely with some nested RequireAny and RequireAll using e.g. Require claim iss:A and Require claim azp:my-special-client without problem, so that's not an issue; only the one-stop landing page approach is, really.

[zandbelt]

You can use mod_oauth2 to handle the bearer token with 2 issuers and use mod_auth_openidc for the OIDC flow by loading both modules and configuring AuthType auth-openidc; both modules will handle this AuthType. Just be aware that you'll need to use Require oauth2_claim for access control with mod_oauth2 so RequireAny is needed to apply Require claim in the same location.

[towo]

Ah, they're still interoperable, that's nice. Thanks for the info!