Google Oauth IdToken to backend

[Pdev]

Hello, 

I was wondering if there was any way to forward the Google Id Token to the backend when using a Google Oauth2.0 Server.
Right now, the fortiweb puts in "authorization" header "Bearer + Google AccessToken"

But I would like this header to contain "Bearer + Google IdToken"

The difference for me is that Google IdToken is a Jwt that can be decoded and verified easily in my backend and so can be used as is to authenticate everything in my backend.

On the other hand the AccessToken is opaque and only give me access to GoogleApis. So this means I would need to mint my own Jwt with the infos I get from /userinfos google endpoint.

Thanks in advance, 

Jules

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Pdev]

up

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

Hello Pdev,

I found this solution. Can you tell us if it helps, please?

To forward the Google ID token instead of the access token in the "Authorization" header when using a Google OAuth 2.0 server with FortiWeb, you would need to customize the handling of tokens. However, FortiWeb's default behavior is to use the access token for authorization purposes. Here are the general steps you might consider:

1. Custom Header Configuration: Check if FortiWeb allows customization of headers to include the ID token. This might involve scripting or using advanced configuration options.
   
   
2. Token Handling: If FortiWeb does not natively support forwarding the ID token, you may need to handle token exchange and forwarding through custom scripts or middleware that can intercept and modify the request before it reaches the backend.
   
   
3. Backend Verification: Ensure your backend is set up to decode and verify the JWT (ID token) for authentication purposes.
   
   
4. Consult Documentation: Review FortiWeb's documentation or contact Fortinet support for any specific features or updates that might support this requirement.

If these options are not feasible within FortiWeb's current capabilities, you may need to implement additional infrastructure to handle token management outside of FortiWeb.