We are attempting to integrate a legacy client-server application with data from an analytics provider who requires a user-specific OIDC token in order to provide authorization and auditing in their database. The client-server application is performing a secure, but proprietary, login. The user is successfully identified by this process, but no token is produced. Are there any ways that Descope can help us bridge this gap? Thanks

Have you seen this https://docs.descope.com/identity-federation/applications/oidc-apps ?

Hi, I need more info, but looks to me like it's more of an outbound app: https://docs.descope.com/identity-federation/outbound-apps Can you share some more info?

Thank you @Meir Wahnon and @Tal Kapitolnik and sorry for the lack of clarity up front. A few more details: -- we aren't able to change the legacy app login implementation -- we must do this without asking the user to log in again I posed the question to the online help chat bot and this is what it suggested:

Given that your login is proprietary and server-side, I'd suggest exploring a combination of:
1. **Pre-provisioning users** in Descope (via the Management SDK/API)
2. Using the **Impersonation API** or **Session Migration** to generate a Descope JWT after your proprietary login succeeds
3. Configuring an **Inbound App** so the analytics provider can consume a properly formatted OIDC token

Do these suggestions make sense to you?

Hi, still find it hard to understand exactly what you need to do. Want to have a session on it? What is your availability? cc @Tal Aharoni

Thanks @Tal Kapitolnik. Maybe this will help, and if not, I will want to schedule some time. We have a non-browser legacy client authenticating to a back-end server in a proprietary manner, using an application database, etc (think 1995). So users are authenticating, but they are not creating any kind of JWT, etc. We need to integrate data from a third-party database that relies on per-user OIDC tokens to authenticate and authorize data access. So we have an authenticated user identity, keyed by a username, from the legacy client. But we don't have any kind of token to provide to this database. The question is, does Descope have any functionality that would allow us to translate our proprietary user identity into a user-specific OIDC-compliant token, in order to access this data.

Ok. now I understand. We can issue an OIDC-compliant JWT based on attributes that the user has or that we can get from input or calling an API. We have an action that is called

Generate JWT / Sign Up or In with 3rd party IDP

that allows you to create a JWT without authenticating the user on our side, just need to figure out how we can get the legacy token and how it looks like.

Thanks @Tal Kapitolnik. We effectively have a user object from the legacy system - so the username would be the unique value. We can always map those usernames to some other unique identifier, if that facilitates the workflow with Descope

We can map the username to loginid and then it will be unique. If what you are looking for is to pass the username as an input and get an OIDC-compliant JWT, we have an sdk function for it. What is your backend stack?

It is node.js and sql server

So the management call the you need to make from the node SDK is documented here: https://github.com/descope/node-sdk?tab=readme-ov-file#manage-jwts Let me know if you need more help with it.