title: How can my EKS web application retrieve the current user authenticated by AWS ALB through OKTA OIDC
body: <p>I'm working with a web application deployed on Amazon Elastic Kubernetes Service (<a href="https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html" rel="nofollow noreferrer">EKS</a>). The user authentication is done through Okta. That all works fine but if I'm logged in, I want the web application to show my name, that is, the name of the <strong>current user</strong>.</p>
  
  <p>There's a <a href="https://medium.com/swlh/aws-alb-authentication-with-okta-oidc-using-terraform-902cd8289db4" rel="nofollow noreferrer">blog post</a> that closely describes the type of setup that I have, which was also done through Terraform. So far, my online searches for this have led me to answers on how to setup the authentication (which is already done) not on how to get the current user.</p>
  
  <p>My basic understanding is this: the original request goes to the Application Load Balancer (ALB) with handles the authentication with Okta. The end result is a session cookie, that the application sends via the browser with future requests, so that they end up on the target IP where the backend can respond. This is the relevant text on the authentication flow from the <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html" rel="nofollow noreferrer">AWS documentation</a>:</p>
  
  <blockquote>
    <p>"After the load balancer validates the ID token, it exchanges the
    access token with the IdP user info endpoint to get the user claims.</p>
    
    <p>The load balancer creates the authentication session cookie and sends
    it to the client so that the client's user agent can send the cookie
    to the load balancer when making requests."</p>
  </blockquote>
  
  <p>I can see from the load balancer listener rules that there is a user info endpoint: <em><a href="https://myorg.okta.com/oauth2/v1/userinfo" rel="nofollow noreferrer">https://myorg.okta.com/oauth2/v1/userinfo</a></em> but can the client application use it to retrieve the user details, and if so, how? I tried to <code>curl</code> it with the session cookie but got a 400 error.</p>
  
  <p>There is also an API documented on the <a href="https://developer.okta.com/docs/reference/api/users/#get-current-user" rel="nofollow noreferrer">Okta site</a> that "Fetches the current user linked to API token or session cookie":</p>
  
  <pre><code>curl -v -X GET \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Authorization: SSWS ${api_token}" \
  "https://${yourOktaDomain}/api/v1/users/me"
  </code></pre>
  
  <p>I don't have an API token so I tried using the <em>AWSELBAuthSessionCookie</em> instead but got:</p>
  
  <p><code>{"errorCode":"E0000011","errorSummary":"Invalid token provided","errorLink":"E0000011","errorId":"oaeRNui7fSPQIq_LWuGro5EbV","errorCauses":[]}</code></p>
  
  <p>Any answer with a summary of steps and links to relevant documentation would be great. Thank you.</p>