Retrieve Oauth2 access token of the current user from Kratos

[thomasboni]

Hello,

First, thanks for this amazing open-source project and all the work involved !

I did some research about my question but didn't find anything, let me know if it was already answered :)

To sum up: from an external service, I need to retrieve an Oauth2 access token of the current user from Kratos.

The context is the following:

• We run a distributed architecture with several services and I am working on a POC to include ORY Kratos as our Identity management service
• I enabled oidc login using Gitlab provider (with api, openid and email scopes) and everything works well for user registration/login
• I can check user identity from all my services using kratos endpoint whoami
• The goal of one of our service is to read inside a user Gitlab repository to extract some information

So, the use case is to be able from my service to :

• Check if the currently logged user has linked his Gitlab account (is it possible to retrieve it from /whoami ?)
• If yes, retrieve the Oauth2 access token from Kratos to be able to query Gitlab API on behalf of the user and access projects

The first idea that comes to me is the following: add the Oauth2 access token as a user trait and map it during oidc connection. But I have some questions/doubts on this approach:

• Is it possible to access the Oauth2 access token retrieved by Kratos inside jsonnet mapper (like we access claims ?)
• Is storing Oauth2 token as user trait a security issue ?

What do you think about the use case and the possible solution ?

Thanks

[Benehiko]

Hi @thomasboni,

This seems related to this discussion #1264 and this issue #397.

Kratos does not store the access token from the OIDC provider and only has the claims available which you can then map using jssonet shown in our docs. You can see in the Kratos code base here and here only the claims are extracted and mapped.

Currently it is not possible to retrieve the access token from Kratos and would require you to re-initialise a login request to the OIDC provider on your own service to use the token.

I hope this answers your question :)

[thomasboni]

Hi @Benehiko, yes you answered perfectly my question :), thanks !

I'm going to follow the related issue and contribute to it ;)