<p><strong>Background</strong></p>

<p>So, on the journey from monolith(s) mess, to microservices, we've decided to go down the k8s route (already a WIN), on google cloud (likewise), and we're looking for an authentication and authorization solution.</p>

<p>So we're considering using Istio, which again, the RBAC element looks like a WIN, and will allow us to keep authorization outside of the applications, as well as other niceties.</p>

<p>And, cloud IAP. Sweet, we don't need to care about authentication, just grant users (all of which already have g-suite accounts) access via cloud iam.</p>

<p><strong>Question</strong></p>

<p>How do we manage &amp; inject auth data for users? IAP lets us grant access to projects, and presents data via JWT (perfect so far), but we can't add custom application permissions.</p>

<p>We would like to be able to use fine-grained permissions for endpoints, and groups/roles to grant these.  </p>

<p>After much searching, I can't find any solution, and this seems like a super common requirement.  Have I missed something (am I looking at this wrong?).</p>

<p>There's a couple of solutions I can think of:</p>

<ul>
<li><p>Istio (like you mentioned). Which supports:</p>

<ul>
<li><a href="https://istio.io/docs/concepts/security/#authentication" rel="nofollow noreferrer">Transport Authentication</a></li>
<li><a href="https://istio.io/docs/concepts/security/#authentication" rel="nofollow noreferrer">End-user Authentication</a>. <a href="https://istio.io/help/ops/security/end-user-auth/" rel="nofollow noreferrer">Here's an example on how to use it</a>.</li>
<li>For fine-grained authorization, you can use Istio <a href="https://istio.io/docs/concepts/security/#authorization" rel="nofollow noreferrer">authorization</a></li>
</ul></li>
<li><p><a href="https://www.consul.io/" rel="nofollow noreferrer">Consul</a> with <a href="https://www.consul.io/docs/platform/k8s/index.html" rel="nofollow noreferrer">Kubernetes</a> and use <a href="https://www.consul.io/docs/guides/acl.html" rel="nofollow noreferrer">ACLs</a> with ACL tokens. The tokens could also be managed by <a href="https://www.vaultproject.io/docs/secrets/consul/index.html" rel="nofollow noreferrer">Vault</a>. As of this writing, it doesn't integrate with OpenID or Oauth2 providers. Consul will help you provide that fine-grained authorization with <a href="https://learn.hashicorp.com/consul/advanced/day-1-operations/acl-guide" rel="nofollow noreferrer">ACLs</a></p></li>
</ul>
