Signed visitor identity for endpoints behind single sign-on

When an endpoint asks visitors to sign in, your app wants to know who is calling. Plain headers such as X-User-Email say who signed in, but your app has no way to check that they came from ngris.

Now every request the edge passes to your app after sign-in carries X-Ngris-Signature, a token signed by ngris that names the person and their roles on the endpoint. Your app checks it with ngris's public keys and its own endpoint ID, so a token made for another endpoint doesn't pass. The edge also removes any identity headers a visitor sends before it adds its own. It works for agent tunnels and for apps hosted on ngris alike.

When Priya opens the console, the token in her requests says:

How it works#

• On every request after sign-in, whether people sign in with an OAuth provider, a password or a token.
• Check it with any JWT library. The public keys are at https://api.ngris.com/.well-known/ngris-edge-jwks.json. Check that the issuer is https://api.ngris.com/edge-identity and that the audience is your endpoint's ID, shown next to its hostname at the top of its settings.
• No forged headers. The edge drops X-Ngris-Signature and the identity headers a visitor sends, then adds its own. Plain X-User-* headers, if you forward them, are a convenience; the token is the one to trust.
• Roles included. The token lists the person's roles on the endpoint, so your app can decide what they may do.

Get started#

1. In the dashboard, go to Gateway → Endpoints, open the endpoint and click Add Method on its Authentication tab to add OAuth / SSO.
2. Add a provider with Add OAuth Provider on the OAuth / SSO tab, and your people and roles on Access Control.
3. In your app, check the X-Ngris-Signature header against the public keys above, with the issuer and your endpoint's ID.
4. Read the docs: Verify the signed identity, with code for Node.js, Python and Go, and RBAC & OAuth.