If authorization and user aggregation are needed in API Gateway, what is better — a ready-made solution or your own?

When choosing between a ready-made solution and a custom-developed one for user authentication and aggregation in API Gateway, several factors should be considered:

• Development speed and reliability: Ready-made solutions are usually time-tested, have support and updates, which reduces security risks and bugs.
• Flexibility and customization: If requirements are specific and ready-made solutions do not cover the needed functionality, it might be worth developing your own.
• Support and scalability: Ready-made solutions often scale better and integrate with other services.
• Security: Ready-made solutions generally meet security standards and are regularly updated.

In most cases, it is better to use proven ready-made solutions (e.g., OAuth providers, OpenID Connect, Keycloak) for user authentication and management, and develop custom solutions only when there is a clear need for unique functionality or integration.

Example of using a ready-made solution with Keycloak in Go:

import (
    "github.com/Nerzal/gocloak/v11"
)

func authenticateUser(username, password string) (bool, error) {
    client := gocloak.NewClient("https://keycloak.example.com")
    token, err := client.Login("realm", "clientID", "clientSecret", username, password)
    if err != nil {
        return false, err
    }
    return token.AccessToken != "", nil
}