API call to Authentik to get user info from GO backend application

[trail spruce]

Hi, could someone please guide me on how to identify the api caller. (username or email)
I have successfully set up Authentik reverse proxy provider. Now the user will be prompted with Authentik flow login page if the source is protected by nginx.
Then the user will be logged in and will probably makes a subsequent api call to my rest api backend server from the web application.

The question is how could my GO server knows who made the call so I could implement something like role middleware, or owner middleware? From projects I have worked with, our GO backend will read the data from previously issued JWT, check the token validity, and provide the context of caller UID. Is there a way my Go backend server could communicate with Authentik server?

I'm a mobile dev learning backend, sorry if my explanation is a bit confusing. 😅

[dire condor]

Hi @trail spruce did you end up figuring this one out? I am attempting to get user info for my backend as well

[agile agate]

I am in the same boat and still no clear documentation on how to approach this. So far what I deduced was Contacting the authentik service from my backend application requires a token (where do I get such token from, it’s not provided on the headers when the backend application gets request passed to it) or a combination of csrf cookie and current session cookie. I also tried to use the outpost path while attaching the authentik_proxy cookie and id cookies but got a 404. The outpost is nginx using the provided config.

[dire condor]

I made anther post about it here: https://discordapp.com/channels/809154715984199690/1237934572633850057

I'm writing a backend and had to ask the same set of questions. What helped me understand was reading the https://datatracker.ietf.org/doc/html/rfc6749#section-4 (mostly the start of section 4) and experimenting with a few oauth code examples in which every language you're using.

I didn't end up configuring an outpost. I needed to configure a provider and application

[dire condor]

I realise I may have not been initially helpful. What is sounds like you need is an "Authorization Code Grant". This allows your server to send your user-agent (the browser) to the auth server (authentik) to get authenticated and bring back a code to the server (through the redirect URL) so the server can spend the code to convert it into a token. Section 4.1 of that RFC explains how that works. I am writing my backend in rust and this example helped me understand: https://docs.rs/oauth2/latest/oauth2/index.html#example-asynchronous-api

The line that has .exchange_code(AuthorizationCode::new("some authorization code".to_string())), you just need to use the code URL query parameter in place of the "some authorization code". Hope that makes sense