Hello, tl;dr the question is: "How to make oauthkeeper use Ory API Key to make sending requests to Ory network /admin endpoint possible?" So, the situation looks as follows: 1. We created a client in Ory Network and with Ory CLI we validated that it works 2. Agents outside of our clusters authenticate the oaut2 client with the Ory Netwrok and receives back the token 3. Agents make request to our cluster with the received token 4. In our cluster Emissary Ingress receives the request with the token and passes it to oauthkeeper 5. Oauthkeeper tries to validate the token via https://<project-endpoint>/admin/oauth2/introspect But the last part is not being successful, and from the logs we are receiving:

msg=The authentication handler encountered an error audience=application authentication_handler=oauth2_introspection error=map[message:Introspection returned status code 401 but expected 200] granted=false

So, I suppose we need to pass the API Key (which we have) to the oauthkeepr in order to be able to use mentioned endpoint. Does anyone know how to do this?

I think you are looking for https://github.com/ory/oathkeeper/issues/969

Hmmm, this issue mentions Ory Keto, while I'm asking about Oauthkeeper, so I don't think it's what I'm looking for

The issue is about adding arbitrary headers to the

remote_json

authorizer, which then allows you to include the Ory Network API key to do the call.

Yeah, but aren't authenticators called BEFORE authorizers?

ahh so you need additional headers on the authenticator, sorry, different story but similar issue

yes, exactly 🙂 to cloud Hydra exactly, as the introspection endpoint is under /admin, so the API key must be provided as a bearer token

it should be a fairly quick fix, contributions welcome

looking at the

pre_authentication

configuration block it seems it should be possible to work around this issue by creating a dummy client and using its credentials to obtain the token, but we wondered if there isn't any better (i.e. api key-based) approach possible

oh nice, I did not realize it is already supported

yeah, neither did we 😄