auth-bridge

The reference implementation of the http-bridge contract, for adapting SAML, LDAP, mTLS or a legacy session service.

auth-bridge is the reference implementation of the HTTP bridge contract. Use it when your identity technology is not OAuth/OIDC — SAML, LDAP, mTLS, API keys, a legacy session service — or when you already run auth-bridge in front of Keycloak.

Gate One reaches it with authProvider.type: "http-bridge". The bridge owns the session; Gate One still enforces auth, auth.identity and MCP scope checks on every request.

Where the code lives

The reference implementation is services/auth-bridge/ in the Gate One source repository, and it ships as services_<version>_src.tar.gz in each release. It is a small Node.js service with its own Dockerfile; it is not part of the gate-one binary.

Run it

The bridge runs as its own container on the internal network. Build it and start it with its documented environment (see services/auth-bridge/README.md in the source repository):

docker build -t gate-one-auth-bridge services/auth-bridge
docker run -d --name auth-bridge --network internal gate-one-auth-bridge

Then point Gate One at it:

{
  "authProvider": {
    "type": "http-bridge",
    "baseUrl": "http://auth-bridge:8080"
  }
}

A non-conforming service needs an adapter that implements the same endpoints; the contract is the specification.

Where to go next