The 'auth callout' feature introduced in NATS 2.10 is there exactly for that (integrating NATS auth with whatever existing IdP system you already have): the client app passes whatever you use as it's credentials at connection time the server then passes them to the security callout service (something you write, following a template that receives whatever the client app passed as credentials and then works with whatever system you have to check those credentials and whatnot and then generates on the fly and returns to the servers equivalent NATS credentials which in turns uses them for that client connection.
(
https://github.com/nats-io/nats-architecture-and-design/blob...)