title: Authentication with Kong
body: <p>I'm looking at <a href="https://getkong.org/" rel="noreferrer">Kong</a> to replace my current hand-rolled NodeJS API gateway. Currently I have a user service that handles authentication (written in Django) by providing a JWT back upon login, which the client then passes in through a header. My current API gateway then intercepts any calls, does a validation call back to the user service, and replaces the JWT Header with <code>X-User-Id</code> and <code>X-User-Email</code>. </p>
  
  <p>As far as I can tell, Kong can do roughly the same thing. I'm trying to figure out the flow of how this should work <em>in a perfect world</em>. I still have the opportunity to replace much of the infrastructure, so rewriting some services is not completely out of the question. </p>
  
  <p>So, in my mind, what would happen is the following:</p>
  
  <ol>
  <li>User registers on my site. I then create a new consumer with their username/id on Kong</li>
  <li>User logs in. This is where I get stuck. Do I log in (or in this case, simply authenticate the user as being said user), ask Kong for the JWT for this consumer, and return that? What if I wanted some more data in the payload of the JWT? What happens on Kong's side when the JWT expires?</li>
  <li>When the user requests a service, Kong will the sniff out the JWT from the headers, replace it with <code>X-Consumer-*</code> - is that correct? </li>
  </ol>
  
  <p>Please do correct me if my thinking is wrong, or if there is a better way to achieve this. I'm fairly new to the whole microservices thing. </p>