IAM + IdP bridge

An http-bridge provider returning identity and IAM facts while Gate One keeps policy enforcement.

This example configures authProvider.type: "http-bridge" and points it at a service implementing the bridge contract. The bridge can adapt SAML, LDAP, mTLS, API keys or a legacy session service; Gate One only sees /auth, /auth/mcp and /health.

Important

The bridge supplies identity and IAM facts (user, roles, scopes, claims), but Gate One remains the policy enforcement point. auth, auth.identity and MCP scope checks are still performed by Gate One on every request. The bridge never bypasses route policy.

The provider type remains http-bridge; http is its deprecated alias. The reference auth-bridge deployment is the IAM + IdP shape. A custom bridge may return only the authenticated user, in which case Gate One still enforces authentication but has no roles or scopes to check.

File

examples/http-bridge/routes.json

{
  "authProvider": {
    "type": "http-bridge",
    "baseUrl": "http://legacy-bridge:8080",
    "loginUrl": "https://login.example.com/login",
    "issuer": "https://auth.example.com/realms/example",
    "headers": {
      "userId": "X-User-Id",
      "username": "X-Username",
      "email": "X-Email",
      "roles": "X-Roles",
      "scopes": "X-Scopes",
      "claims": "X-Claims"
    }
  },
  "routes": [{
    "host": "app.example.com", "path": "/*", "frontend": true,
    "backend": "http://app:8080", "auth": {}
  }]
}

Run it

gate-one -check -config routes.json
gate-one -config routes.json

The bridge must be reachable at baseUrl, expose the contract endpoints, and return 200 plus identity headers for an authenticated session.

Important

  • The bridge owns the session; Gate One does not create an RP cookie for this provider.

  • A 5xx from the bridge is an outage (502), not a login failure.

Note

  • Keep the bridge on the internal network.

  • The legacy type http is an alias of http-bridge.