From e95cfa1a00a7dd43e5fc164051ceff2950e1ed98 Mon Sep 17 00:00:00 2001
From: Alisdair MacLeod <git@alisdairmacleod.co.uk>
Date: Thu, 29 Jan 2026 16:34:52 +0000
Subject: [PATCH] add support for some basic authentication methods

---
 .../modules/reverseproxy/reverseproxy.go      |  20 +-
 management/internals/shared/grpc/proxy.go     |  31 +
 proxy/internal/auth/auth.gohtml               |  12 +-
 proxy/internal/auth/link.go                   |  57 ++
 proxy/internal/auth/middleware.go             |  16 +-
 proxy/internal/auth/oidc.go                   |  15 +-
 proxy/internal/auth/password.go               |  62 ++
 proxy/internal/auth/pin.go                    |  39 +-
 proxy/server.go                               |  17 +-
 shared/management/proto/proxy_service.pb.go   | 947 +++++++++++-------
 shared/management/proto/proxy_service.proto   |  64 +-
 .../management/proto/proxy_service_grpc.pb.go |  36 +
 12 files changed, 867 insertions(+), 449 deletions(-)
 create mode 100644 proxy/internal/auth/link.go
 create mode 100644 proxy/internal/auth/password.go

diff --git a/management/internals/modules/reverseproxy/reverseproxy.go b/management/internals/modules/reverseproxy/reverseproxy.go
index 7b14423bc..96b078f45 100644
--- a/management/internals/modules/reverseproxy/reverseproxy.go
+++ b/management/internals/modules/reverseproxy/reverseproxy.go
@@ -162,25 +162,27 @@ func (r *ReverseProxy) ToProtoMapping(operation Operation, setupKey string) *pro
 	auth := &proto.Authentication{}
 
 	if r.Auth.PasswordAuth != nil && r.Auth.PasswordAuth.Enabled {
-		auth.Password = &proto.Password{
-			Enabled:  true,
-			Password: r.Auth.PasswordAuth.Password,
-		}
+		auth.Password = true
 	}
 
 	if r.Auth.PinAuth != nil && r.Auth.PinAuth.Enabled {
-		auth.Pin = &proto.Pin{
-			Enabled: true,
-			Pin:     r.Auth.PinAuth.Pin,
-		}
+		auth.Pin = true
 	}
 
 	if r.Auth.BearerAuth != nil && r.Auth.BearerAuth.Enabled {
 		auth.Oidc = &proto.OIDC{
-			Enabled: true,
+			OidcProviderUrl:  "",  // TODO:
+			OidcClientId:     "",  // TODO:
+			OidcClientSecret: "",  // TODO:
+			OidcRedirectUrl:  "",  // TODO:
+			OidcScopes:       nil, // TODO:
 		}
 	}
 
+	if r.Auth.LinkAuth != nil && r.Auth.LinkAuth.Enabled {
+		auth.Link = true
+	}
+
 	return &proto.ProxyMapping{
 		Type:      operationToProtoType(operation),
 		Id:        r.ID,
diff --git a/management/internals/shared/grpc/proxy.go b/management/internals/shared/grpc/proxy.go
index 239f977d7..791d63364 100644
--- a/management/internals/shared/grpc/proxy.go
+++ b/management/internals/shared/grpc/proxy.go
@@ -2,6 +2,7 @@ package grpc
 
 import (
 	"context"
+	"crypto/subtle"
 	"fmt"
 	"sync"
 	"time"
@@ -246,3 +247,33 @@ func (s *ProxyServiceServer) GetConnectedProxies() []string {
 	})
 	return proxies
 }
+
+func (s *ProxyServiceServer) Authenticate(ctx context.Context, req *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error) {
+	proxy, err := s.reverseProxyStore.GetReverseProxyByID(ctx, store.LockingStrengthNone, req.GetAccountId(), req.GetId())
+	if err != nil {
+		// TODO: log the error
+		return nil, status.Errorf(codes.FailedPrecondition, "failed to get reverse proxy from store: %v", err)
+	}
+	var authenticated bool
+	switch v := req.GetRequest().(type) {
+	case *proto.AuthenticateRequest_Pin:
+		auth := proxy.Auth.PinAuth
+		if auth == nil || !auth.Enabled {
+			// TODO: log
+			// Break here and use the default authenticated == false.
+			break
+		}
+		authenticated = subtle.ConstantTimeCompare([]byte(auth.Pin), []byte(v.Pin.GetPin())) == 1
+	case *proto.AuthenticateRequest_Password:
+		auth := proxy.Auth.PasswordAuth
+		if auth == nil || !auth.Enabled {
+			// TODO: log
+			// Break here and use the default authenticated == false.
+			break
+		}
+		authenticated = subtle.ConstantTimeCompare([]byte(auth.Password), []byte(v.Password.GetPassword())) == 1
+	}
+	return &proto.AuthenticateResponse{
+		Success: authenticated,
+	}, nil
+}
diff --git a/proxy/internal/auth/auth.gohtml b/proxy/internal/auth/auth.gohtml
index 355ef6bc5..508b83b79 100644
--- a/proxy/internal/auth/auth.gohtml
+++ b/proxy/internal/auth/auth.gohtml
@@ -1,4 +1,14 @@
 <!doctype html>
 {{ range . }}
-<p>{{ . }}</p>
+{{ if eq .Key "pin" }}
+<form>
+    <input name={{ . }} />
+    <button type=submit></button>
+</form>
+{{ else if eq .Key "password" }}
+<form>
+    <input name={{ . }} />
+    <button type=submit></button>
+</form>
+{{ end }}
 {{ end }}
diff --git a/proxy/internal/auth/link.go b/proxy/internal/auth/link.go
new file mode 100644
index 000000000..12a9a09f1
--- /dev/null
+++ b/proxy/internal/auth/link.go
@@ -0,0 +1,57 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const linkFormId = "email"
+
+type Link struct {
+	id, accountId string
+	client        authenticator
+}
+
+func NewLink(client authenticator, id, accountId string) Link {
+	return Link{
+		id:        id,
+		accountId: accountId,
+		client:    client,
+	}
+}
+
+func (Link) Type() Method {
+	return MethodLink
+}
+
+func (l Link) Authenticate(r *http.Request) (string, bool, any) {
+	email := r.FormValue(linkFormId)
+
+	res, err := l.client.Authenticate(r.Context(), &proto.AuthenticateRequest{
+		Id:        l.id,
+		AccountId: l.accountId,
+		Request: &proto.AuthenticateRequest_Link{
+			Link: &proto.LinkRequest{
+				Email:    email,
+				Redirect: "", // TODO: calculate this.
+			},
+		},
+	})
+	if err != nil {
+		// TODO: log error here
+		return "", false, linkFormId
+	}
+
+	if res.GetSuccess() {
+		// Use the email address as the user identifier.
+		return email, true, nil
+	}
+
+	return "", false, linkFormId
+}
+
+func (l Link) Middleware(next http.Handler) http.Handler {
+	// TODO: handle magic link redirects, should be similar to OIDC.
+	return next
+}
diff --git a/proxy/internal/auth/middleware.go b/proxy/internal/auth/middleware.go
index 4d36f0ae8..c2c086712 100644
--- a/proxy/internal/auth/middleware.go
+++ b/proxy/internal/auth/middleware.go
@@ -1,6 +1,7 @@
 package auth
 
 import (
+	"context"
 	"crypto/rand"
 	_ "embed"
 	"encoding/base64"
@@ -8,6 +9,10 @@ import (
 	"net/http"
 	"sync"
 	"time"
+
+	"google.golang.org/grpc"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
 //go:embed auth.gohtml
@@ -16,9 +21,10 @@ var authTemplate string
 type Method string
 
 var (
-	MethodBasicAuth Method = "basic"
-	MethodPIN       Method = "pin"
-	MethodBearer    Method = "bearer"
+	MethodPassword Method = "password"
+	MethodPIN      Method = "pin"
+	MethodOIDC     Method = "oidc"
+	MethodLink     Method = "link"
 )
 
 func (m Method) String() string {
@@ -36,6 +42,10 @@ type session struct {
 	CreatedAt time.Time
 }
 
+type authenticator interface {
+	Authenticate(ctx context.Context, in *proto.AuthenticateRequest, opts ...grpc.CallOption) (*proto.AuthenticateResponse, error)
+}
+
 type Scheme interface {
 	Type() Method
 	// Authenticate should check the passed request and determine whether
diff --git a/proxy/internal/auth/oidc.go b/proxy/internal/auth/oidc.go
index ec4cc781b..820d54d8e 100644
--- a/proxy/internal/auth/oidc.go
+++ b/proxy/internal/auth/oidc.go
@@ -35,14 +35,15 @@ type oidcState struct {
 
 // OIDC implements the Scheme interface for JWT/OIDC authentication
 type OIDC struct {
-	verifier    *oidc.IDTokenVerifier
-	oauthConfig *oauth2.Config
-	states      map[string]*oidcState
-	statesMux   sync.RWMutex
+	id, accountId string
+	verifier      *oidc.IDTokenVerifier
+	oauthConfig   *oauth2.Config
+	states        map[string]*oidcState
+	statesMux     sync.RWMutex
 }
 
 // NewOIDC creates a new OIDC authentication scheme
-func NewOIDC(ctx context.Context, cfg OIDCConfig) (*OIDC, error) {
+func NewOIDC(ctx context.Context, id, accountId string, cfg OIDCConfig) (*OIDC, error) {
 	if cfg.OIDCProviderURL == "" || cfg.OIDCClientID == "" {
 		return nil, fmt.Errorf("OIDC provider URL and client ID are required")
 	}
@@ -58,6 +59,8 @@ func NewOIDC(ctx context.Context, cfg OIDCConfig) (*OIDC, error) {
 	}
 
 	o := &OIDC{
+		id:        id,
+		accountId: accountId,
 		verifier: provider.Verifier(&oidc.Config{
 			ClientID: cfg.OIDCClientID,
 		}),
@@ -77,7 +80,7 @@ func NewOIDC(ctx context.Context, cfg OIDCConfig) (*OIDC, error) {
 }
 
 func (*OIDC) Type() Method {
-	return MethodBearer
+	return MethodOIDC
 }
 
 func (o *OIDC) Authenticate(r *http.Request) (string, bool, any) {
diff --git a/proxy/internal/auth/password.go b/proxy/internal/auth/password.go
new file mode 100644
index 000000000..e03d541b0
--- /dev/null
+++ b/proxy/internal/auth/password.go
@@ -0,0 +1,62 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+const (
+	passwordUserId = "password-user"
+	passwordFormId = "password"
+)
+
+type Password struct {
+	id, accountId string
+	client        authenticator
+}
+
+func NewPassword(client authenticator, id, accountId string) Password {
+	return Password{
+		id:        id,
+		accountId: accountId,
+		client:    client,
+	}
+}
+
+func (Password) Type() Method {
+	return MethodPassword
+}
+
+// Authenticate attempts to authenticate the request using a form
+// value passed in the request.
+// If authentication fails, the required HTTP form ID is returned
+// so that it can be injected into a request from the UI so that
+// authentication may be successful.
+func (p Password) Authenticate(r *http.Request) (string, bool, any) {
+	password := r.FormValue(passwordFormId)
+
+	res, err := p.client.Authenticate(r.Context(), &proto.AuthenticateRequest{
+		Id:        p.id,
+		AccountId: p.accountId,
+		Request: &proto.AuthenticateRequest_Password{
+			Password: &proto.PasswordRequest{
+				Password: password,
+			},
+		},
+	})
+	if err != nil {
+		// TODO: log error here
+		return "", false, passwordFormId
+	}
+
+	if res.GetSuccess() {
+		return passwordUserId, true, nil
+	}
+
+	return "", false, passwordFormId
+}
+
+func (p Password) Middleware(next http.Handler) http.Handler {
+	return next
+}
diff --git a/proxy/internal/auth/pin.go b/proxy/internal/auth/pin.go
index 542a0ebd1..a8c5e50e2 100644
--- a/proxy/internal/auth/pin.go
+++ b/proxy/internal/auth/pin.go
@@ -1,22 +1,26 @@
 package auth
 
 import (
-	"crypto/subtle"
 	"net/http"
+
+	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
 const (
-	userId = "pin-user"
-	formId = "pin"
+	pinUserId = "pin-user"
+	pinFormId = "pin"
 )
 
 type Pin struct {
-	pin string
+	id, accountId string
+	client        authenticator
 }
 
-func NewPin(pin string) Pin {
+func NewPin(client authenticator, id, accountId string) Pin {
 	return Pin{
-		pin: pin,
+		id:        id,
+		accountId: accountId,
+		client:    client,
 	}
 }
 
@@ -30,14 +34,27 @@ func (Pin) Type() Method {
 // so that it can be injected into a request from the UI so that
 // authentication may be successful.
 func (p Pin) Authenticate(r *http.Request) (string, bool, any) {
-	pin := r.FormValue(formId)
+	pin := r.FormValue(pinFormId)
 
-	// Compare the passed pin with the expected pin.
-	if subtle.ConstantTimeCompare([]byte(pin), []byte(p.pin)) == 1 {
-		return userId, false, nil
+	res, err := p.client.Authenticate(r.Context(), &proto.AuthenticateRequest{
+		Id:        p.id,
+		AccountId: p.accountId,
+		Request: &proto.AuthenticateRequest_Pin{
+			Pin: &proto.PinRequest{
+				Pin: pin,
+			},
+		},
+	})
+	if err != nil {
+		// TODO: log error here
+		return "", false, pinFormId
 	}
 
-	return "", false, formId
+	if res.GetSuccess() {
+		return pinUserId, true, nil
+	}
+
+	return "", false, pinFormId
 }
 
 func (p Pin) Middleware(next http.Handler) http.Handler {
diff --git a/proxy/server.go b/proxy/server.go
index 0c0b7d2d3..6009505ed 100644
--- a/proxy/server.go
+++ b/proxy/server.go
@@ -287,15 +287,17 @@ func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping)
 	// the auth and proxy mappings.
 	// Note: this does require the management server to always send a
 	// full mapping rather than deltas during a modification.
+	mgmtClient := proto.NewProxyServiceClient(s.mgmtConn)
 	var schemes []auth.Scheme
-	if mapping.GetAuth().GetPin().GetEnabled() {
-		schemes = append(schemes, auth.NewPin(
-			mapping.GetAuth().GetPin().GetPin(),
-		))
+	if mapping.GetAuth().GetPassword() {
+		schemes = append(schemes, auth.NewPassword(mgmtClient, mapping.GetId(), mapping.GetAccountId()))
 	}
-	if mapping.GetAuth().GetOidc().GetEnabled() {
+	if mapping.GetAuth().GetPin() {
+		schemes = append(schemes, auth.NewPin(mgmtClient, mapping.GetId(), mapping.GetAccountId()))
+	}
+	if mapping.GetAuth().GetOidc() != nil {
 		oidc := mapping.GetAuth().GetOidc()
-		scheme, err := auth.NewOIDC(ctx, auth.OIDCConfig{
+		scheme, err := auth.NewOIDC(ctx, mapping.GetId(), mapping.GetAccountId(), auth.OIDCConfig{
 			OIDCProviderURL:  oidc.GetOidcProviderUrl(),
 			OIDCClientID:     oidc.GetOidcClientId(),
 			OIDCClientSecret: oidc.GetOidcClientSecret(),
@@ -308,6 +310,9 @@ func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping)
 			schemes = append(schemes, scheme)
 		}
 	}
+	if mapping.GetAuth().GetLink() {
+		schemes = append(schemes, auth.NewLink(mgmtClient, mapping.GetId(), mapping.GetAccountId()))
+	}
 	s.auth.AddDomain(mapping.GetDomain(), schemes)
 	s.proxy.AddMapping(s.protoToMapping(mapping))
 }
diff --git a/shared/management/proto/proxy_service.pb.go b/shared/management/proto/proxy_service.pb.go
index 7b04c1bf4..1830d7547 100644
--- a/shared/management/proto/proxy_service.pb.go
+++ b/shared/management/proto/proxy_service.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v6.33.0
+// 	protoc        v3.21.12
 // source: proxy_service.proto
 
 package proto
@@ -244,10 +244,10 @@ type Authentication struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Password *Password `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
-	Pin      *Pin      `protobuf:"bytes,2,opt,name=pin,proto3" json:"pin,omitempty"`
-	Oidc     *OIDC     `protobuf:"bytes,3,opt,name=oidc,proto3" json:"oidc,omitempty"`
-	Link     *Link     `protobuf:"bytes,4,opt,name=link,proto3" json:"link,omitempty"`
+	Password bool  `protobuf:"varint,1,opt,name=password,proto3" json:"password,omitempty"`
+	Pin      bool  `protobuf:"varint,2,opt,name=pin,proto3" json:"pin,omitempty"`
+	Oidc     *OIDC `protobuf:"bytes,3,opt,name=oidc,proto3,oneof" json:"oidc,omitempty"`
+	Link     bool  `protobuf:"varint,4,opt,name=link,proto3" json:"link,omitempty"`
 }
 
 func (x *Authentication) Reset() {
@@ -282,18 +282,18 @@ func (*Authentication) Descriptor() ([]byte, []int) {
 	return file_proxy_service_proto_rawDescGZIP(), []int{3}
 }
 
-func (x *Authentication) GetPassword() *Password {
+func (x *Authentication) GetPassword() bool {
 	if x != nil {
 		return x.Password
 	}
-	return nil
+	return false
 }
 
-func (x *Authentication) GetPin() *Pin {
+func (x *Authentication) GetPin() bool {
 	if x != nil {
 		return x.Pin
 	}
-	return nil
+	return false
 }
 
 func (x *Authentication) GetOidc() *OIDC {
@@ -303,196 +303,29 @@ func (x *Authentication) GetOidc() *OIDC {
 	return nil
 }
 
-func (x *Authentication) GetLink() *Link {
+func (x *Authentication) GetLink() bool {
 	if x != nil {
 		return x.Link
 	}
-	return nil
-}
-
-type Password struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Enabled  bool   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
-}
-
-func (x *Password) Reset() {
-	*x = Password{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Password) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Password) ProtoMessage() {}
-
-func (x *Password) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Password.ProtoReflect.Descriptor instead.
-func (*Password) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *Password) GetEnabled() bool {
-	if x != nil {
-		return x.Enabled
-	}
 	return false
 }
 
-func (x *Password) GetPassword() string {
-	if x != nil {
-		return x.Password
-	}
-	return ""
-}
-
-type Pin struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Enabled bool   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	Pin     string `protobuf:"bytes,2,opt,name=pin,proto3" json:"pin,omitempty"`
-}
-
-func (x *Pin) Reset() {
-	*x = Pin{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Pin) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Pin) ProtoMessage() {}
-
-func (x *Pin) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Pin.ProtoReflect.Descriptor instead.
-func (*Pin) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *Pin) GetEnabled() bool {
-	if x != nil {
-		return x.Enabled
-	}
-	return false
-}
-
-func (x *Pin) GetPin() string {
-	if x != nil {
-		return x.Pin
-	}
-	return ""
-}
-
-type Link struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Enabled bool   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	LinkUrl string `protobuf:"bytes,2,opt,name=link_url,json=linkUrl,proto3" json:"link_url,omitempty"`
-}
-
-func (x *Link) Reset() {
-	*x = Link{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Link) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Link) ProtoMessage() {}
-
-func (x *Link) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Link.ProtoReflect.Descriptor instead.
-func (*Link) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *Link) GetEnabled() bool {
-	if x != nil {
-		return x.Enabled
-	}
-	return false
-}
-
-func (x *Link) GetLinkUrl() string {
-	if x != nil {
-		return x.LinkUrl
-	}
-	return ""
-}
-
 type OIDC struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Enabled           bool     `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	OidcProviderUrl   string   `protobuf:"bytes,2,opt,name=oidc_provider_url,json=oidcProviderUrl,proto3" json:"oidc_provider_url,omitempty"`
-	OidcClientId      string   `protobuf:"bytes,3,opt,name=oidc_client_id,json=oidcClientId,proto3" json:"oidc_client_id,omitempty"`
-	OidcClientSecret  string   `protobuf:"bytes,4,opt,name=oidc_client_secret,json=oidcClientSecret,proto3" json:"oidc_client_secret,omitempty"`
-	OidcRedirectUrl   string   `protobuf:"bytes,5,opt,name=oidc_redirect_url,json=oidcRedirectUrl,proto3" json:"oidc_redirect_url,omitempty"`
-	OidcScopes        []string `protobuf:"bytes,6,rep,name=oidc_scopes,json=oidcScopes,proto3" json:"oidc_scopes,omitempty"`
-	SessionCookieName string   `protobuf:"bytes,7,opt,name=session_cookie_name,json=sessionCookieName,proto3" json:"session_cookie_name,omitempty"`
+	OidcProviderUrl  string   `protobuf:"bytes,1,opt,name=oidc_provider_url,json=oidcProviderUrl,proto3" json:"oidc_provider_url,omitempty"`
+	OidcClientId     string   `protobuf:"bytes,2,opt,name=oidc_client_id,json=oidcClientId,proto3" json:"oidc_client_id,omitempty"`
+	OidcClientSecret string   `protobuf:"bytes,3,opt,name=oidc_client_secret,json=oidcClientSecret,proto3" json:"oidc_client_secret,omitempty"`
+	OidcRedirectUrl  string   `protobuf:"bytes,4,opt,name=oidc_redirect_url,json=oidcRedirectUrl,proto3" json:"oidc_redirect_url,omitempty"`
+	OidcScopes       []string `protobuf:"bytes,5,rep,name=oidc_scopes,json=oidcScopes,proto3" json:"oidc_scopes,omitempty"`
 }
 
 func (x *OIDC) Reset() {
 	*x = OIDC{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[7]
+		mi := &file_proxy_service_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -505,7 +338,7 @@ func (x *OIDC) String() string {
 func (*OIDC) ProtoMessage() {}
 
 func (x *OIDC) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[7]
+	mi := &file_proxy_service_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -518,14 +351,7 @@ func (x *OIDC) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OIDC.ProtoReflect.Descriptor instead.
 func (*OIDC) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *OIDC) GetEnabled() bool {
-	if x != nil {
-		return x.Enabled
-	}
-	return false
+	return file_proxy_service_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *OIDC) GetOidcProviderUrl() string {
@@ -563,13 +389,6 @@ func (x *OIDC) GetOidcScopes() []string {
 	return nil
 }
 
-func (x *OIDC) GetSessionCookieName() string {
-	if x != nil {
-		return x.SessionCookieName
-	}
-	return ""
-}
-
 type ProxyMapping struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -587,7 +406,7 @@ type ProxyMapping struct {
 func (x *ProxyMapping) Reset() {
 	*x = ProxyMapping{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[8]
+		mi := &file_proxy_service_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -600,7 +419,7 @@ func (x *ProxyMapping) String() string {
 func (*ProxyMapping) ProtoMessage() {}
 
 func (x *ProxyMapping) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[8]
+	mi := &file_proxy_service_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -613,7 +432,7 @@ func (x *ProxyMapping) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProxyMapping.ProtoReflect.Descriptor instead.
 func (*ProxyMapping) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{8}
+	return file_proxy_service_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *ProxyMapping) GetType() ProxyMappingUpdateType {
@@ -677,7 +496,7 @@ type SendAccessLogRequest struct {
 func (x *SendAccessLogRequest) Reset() {
 	*x = SendAccessLogRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[9]
+		mi := &file_proxy_service_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -690,7 +509,7 @@ func (x *SendAccessLogRequest) String() string {
 func (*SendAccessLogRequest) ProtoMessage() {}
 
 func (x *SendAccessLogRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[9]
+	mi := &file_proxy_service_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -703,7 +522,7 @@ func (x *SendAccessLogRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SendAccessLogRequest.ProtoReflect.Descriptor instead.
 func (*SendAccessLogRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{9}
+	return file_proxy_service_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *SendAccessLogRequest) GetLog() *AccessLog {
@@ -723,7 +542,7 @@ type SendAccessLogResponse struct {
 func (x *SendAccessLogResponse) Reset() {
 	*x = SendAccessLogResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[10]
+		mi := &file_proxy_service_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -736,7 +555,7 @@ func (x *SendAccessLogResponse) String() string {
 func (*SendAccessLogResponse) ProtoMessage() {}
 
 func (x *SendAccessLogResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[10]
+	mi := &file_proxy_service_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -749,7 +568,7 @@ func (x *SendAccessLogResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SendAccessLogResponse.ProtoReflect.Descriptor instead.
 func (*SendAccessLogResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{10}
+	return file_proxy_service_proto_rawDescGZIP(), []int{7}
 }
 
 type AccessLog struct {
@@ -775,7 +594,7 @@ type AccessLog struct {
 func (x *AccessLog) Reset() {
 	*x = AccessLog{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[11]
+		mi := &file_proxy_service_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -788,7 +607,7 @@ func (x *AccessLog) String() string {
 func (*AccessLog) ProtoMessage() {}
 
 func (x *AccessLog) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[11]
+	mi := &file_proxy_service_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -801,7 +620,7 @@ func (x *AccessLog) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessLog.ProtoReflect.Descriptor instead.
 func (*AccessLog) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{11}
+	return file_proxy_service_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *AccessLog) GetTimestamp() *timestamppb.Timestamp {
@@ -895,6 +714,313 @@ func (x *AccessLog) GetAuthSuccess() bool {
 	return false
 }
 
+type AuthenticateRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id        string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	AccountId string `protobuf:"bytes,2,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	// Types that are assignable to Request:
+	//
+	//	*AuthenticateRequest_Password
+	//	*AuthenticateRequest_Pin
+	//	*AuthenticateRequest_Link
+	Request isAuthenticateRequest_Request `protobuf_oneof:"request"`
+}
+
+func (x *AuthenticateRequest) Reset() {
+	*x = AuthenticateRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthenticateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthenticateRequest) ProtoMessage() {}
+
+func (x *AuthenticateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthenticateRequest.ProtoReflect.Descriptor instead.
+func (*AuthenticateRequest) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *AuthenticateRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *AuthenticateRequest) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+func (m *AuthenticateRequest) GetRequest() isAuthenticateRequest_Request {
+	if m != nil {
+		return m.Request
+	}
+	return nil
+}
+
+func (x *AuthenticateRequest) GetPassword() *PasswordRequest {
+	if x, ok := x.GetRequest().(*AuthenticateRequest_Password); ok {
+		return x.Password
+	}
+	return nil
+}
+
+func (x *AuthenticateRequest) GetPin() *PinRequest {
+	if x, ok := x.GetRequest().(*AuthenticateRequest_Pin); ok {
+		return x.Pin
+	}
+	return nil
+}
+
+func (x *AuthenticateRequest) GetLink() *LinkRequest {
+	if x, ok := x.GetRequest().(*AuthenticateRequest_Link); ok {
+		return x.Link
+	}
+	return nil
+}
+
+type isAuthenticateRequest_Request interface {
+	isAuthenticateRequest_Request()
+}
+
+type AuthenticateRequest_Password struct {
+	Password *PasswordRequest `protobuf:"bytes,3,opt,name=password,proto3,oneof"`
+}
+
+type AuthenticateRequest_Pin struct {
+	Pin *PinRequest `protobuf:"bytes,4,opt,name=pin,proto3,oneof"`
+}
+
+type AuthenticateRequest_Link struct {
+	Link *LinkRequest `protobuf:"bytes,5,opt,name=link,proto3,oneof"`
+}
+
+func (*AuthenticateRequest_Password) isAuthenticateRequest_Request() {}
+
+func (*AuthenticateRequest_Pin) isAuthenticateRequest_Request() {}
+
+func (*AuthenticateRequest_Link) isAuthenticateRequest_Request() {}
+
+type PasswordRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Password string `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
+}
+
+func (x *PasswordRequest) Reset() {
+	*x = PasswordRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PasswordRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PasswordRequest) ProtoMessage() {}
+
+func (x *PasswordRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PasswordRequest.ProtoReflect.Descriptor instead.
+func (*PasswordRequest) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *PasswordRequest) GetPassword() string {
+	if x != nil {
+		return x.Password
+	}
+	return ""
+}
+
+type PinRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Pin string `protobuf:"bytes,1,opt,name=pin,proto3" json:"pin,omitempty"`
+}
+
+func (x *PinRequest) Reset() {
+	*x = PinRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PinRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PinRequest) ProtoMessage() {}
+
+func (x *PinRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PinRequest.ProtoReflect.Descriptor instead.
+func (*PinRequest) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *PinRequest) GetPin() string {
+	if x != nil {
+		return x.Pin
+	}
+	return ""
+}
+
+type LinkRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email    string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	Redirect string `protobuf:"bytes,2,opt,name=redirect,proto3" json:"redirect,omitempty"`
+}
+
+func (x *LinkRequest) Reset() {
+	*x = LinkRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LinkRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinkRequest) ProtoMessage() {}
+
+func (x *LinkRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinkRequest.ProtoReflect.Descriptor instead.
+func (*LinkRequest) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *LinkRequest) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *LinkRequest) GetRedirect() string {
+	if x != nil {
+		return x.Redirect
+	}
+	return ""
+}
+
+type AuthenticateResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Success bool `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
+}
+
+func (x *AuthenticateResponse) Reset() {
+	*x = AuthenticateResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthenticateResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthenticateResponse) ProtoMessage() {}
+
+func (x *AuthenticateResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthenticateResponse.ProtoReflect.Descriptor instead.
+func (*AuthenticateResponse) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *AuthenticateResponse) GetSuccess() bool {
+	if x != nil {
+		return x.Success
+	}
+	return false
+}
+
 var File_proxy_service_proto protoreflect.FileDescriptor
 
 var file_proxy_service_proto_rawDesc = []byte{
@@ -919,116 +1045,129 @@ var file_proxy_service_proto_rawDesc = []byte{
 	0x0a, 0x0b, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a,
 	0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74,
 	0x68, 0x12, 0x16, 0x0a, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x22, 0xb1, 0x01, 0x0a, 0x0e, 0x41, 0x75,
-	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x73, 0x73,
-	0x77, 0x6f, 0x72, 0x64, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x21,
-	0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x69, 0x6e, 0x52, 0x03, 0x70, 0x69,
-	0x6e, 0x12, 0x24, 0x0a, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x10, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4f, 0x49, 0x44,
-	0x43, 0x52, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x12, 0x24, 0x0a, 0x04, 0x6c, 0x69, 0x6e, 0x6b, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x4c, 0x69, 0x6e, 0x6b, 0x52, 0x04, 0x6c, 0x69, 0x6e, 0x6b, 0x22, 0x40, 0x0a,
-	0x08, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22,
-	0x31, 0x0a, 0x03, 0x50, 0x69, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
-	0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70,
-	0x69, 0x6e, 0x22, 0x3b, 0x0a, 0x04, 0x4c, 0x69, 0x6e, 0x6b, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x69, 0x6e, 0x6b, 0x5f, 0x75, 0x72, 0x6c,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x69, 0x6e, 0x6b, 0x55, 0x72, 0x6c, 0x22,
-	0x9d, 0x02, 0x0a, 0x04, 0x4f, 0x49, 0x44, 0x43, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x12, 0x2a, 0x0a, 0x11, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x64, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f,
-	0x69, 0x64, 0x63, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x12, 0x24,
-	0x0a, 0x0e, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6f, 0x69, 0x64, 0x63, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x49, 0x64, 0x12, 0x2c, 0x0a, 0x12, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x63, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x10, 0x6f, 0x69, 0x64, 0x63, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72,
-	0x65, 0x74, 0x12, 0x2a, 0x0a, 0x11, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72,
-	0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f,
-	0x69, 0x64, 0x63, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x6c, 0x12, 0x1f,
-	0x0a, 0x0b, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x18, 0x06, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x0a, 0x6f, 0x69, 0x64, 0x63, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x12,
-	0x2e, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6f, 0x6b, 0x69,
-	0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6f, 0x6b, 0x69, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x22,
-	0x87, 0x02, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
-	0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78,
-	0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79,
-	0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f,
-	0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
-	0x2b, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1b, 0x0a, 0x09,
-	0x73, 0x65, 0x74, 0x75, 0x70, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x73, 0x65, 0x74, 0x75, 0x70, 0x4b, 0x65, 0x79, 0x12, 0x2e, 0x0a, 0x04, 0x61, 0x75, 0x74,
-	0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x09, 0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x22, 0x86, 0x01, 0x0a, 0x0e, 0x41, 0x75,
+	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08,
+	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08,
+	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x29, 0x0a, 0x04, 0x6f, 0x69,
+	0x64, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4f, 0x49, 0x44, 0x43, 0x48, 0x00, 0x52, 0x04, 0x6f, 0x69,
+	0x64, 0x63, 0x88, 0x01, 0x01, 0x12, 0x12, 0x0a, 0x04, 0x6c, 0x69, 0x6e, 0x6b, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x04, 0x6c, 0x69, 0x6e, 0x6b, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x6f, 0x69,
+	0x64, 0x63, 0x22, 0xd3, 0x01, 0x0a, 0x04, 0x4f, 0x49, 0x44, 0x43, 0x12, 0x2a, 0x0a, 0x11, 0x6f,
+	0x69, 0x64, 0x63, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f, 0x69, 0x64, 0x63, 0x50, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x12, 0x24, 0x0a, 0x0e, 0x6f, 0x69, 0x64, 0x63, 0x5f,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0c, 0x6f, 0x69, 0x64, 0x63, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x2c, 0x0a,
+	0x12, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x63,
+	0x72, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x6f, 0x69, 0x64, 0x63, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x2a, 0x0a, 0x11, 0x6f,
+	0x69, 0x64, 0x63, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f, 0x69, 0x64, 0x63, 0x52, 0x65, 0x64, 0x69,
+	0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x6c, 0x12, 0x1f, 0x0a, 0x0b, 0x6f, 0x69, 0x64, 0x63, 0x5f,
+	0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x6f, 0x69,
+	0x64, 0x63, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x22, 0x87, 0x02, 0x0a, 0x0c, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64,
+	0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2b, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68,
+	0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52,
+	0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x65, 0x74, 0x75, 0x70, 0x5f, 0x6b,
+	0x65, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x65, 0x74, 0x75, 0x70, 0x4b,
+	0x65, 0x79, 0x12, 0x2e, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75,
+	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75,
+	0x74, 0x68, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x03, 0x6c, 0x6f,
+	0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x03,
+	0x6c, 0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xa0, 0x03, 0x0a,
+	0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x38, 0x0a, 0x09, 0x74, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73,
+	0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x12, 0x0a,
+	0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74,
+	0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x73,
+	0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x4d, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x08, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x12,
+	0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70, 0x12, 0x25, 0x0a, 0x0e,
+	0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x18, 0x0b,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x63, 0x68, 0x61, 0x6e,
+	0x69, 0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x0c,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c,
+	0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x0d, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x22,
+	0xe5, 0x01, 0x0a, 0x13, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63,
+	0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
+	0x64, 0x12, 0x2a, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x69, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x2d, 0x0a,
+	0x04, 0x6c, 0x69, 0x6e, 0x6b, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4c, 0x69, 0x6e, 0x6b, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x04, 0x6c, 0x69, 0x6e, 0x6b, 0x42, 0x09, 0x0a, 0x07,
+	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x2d, 0x0a, 0x0f, 0x50, 0x61, 0x73, 0x73, 0x77,
+	0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61,
+	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61,
+	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x1e, 0x0a, 0x0a, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x22, 0x3f, 0x0a, 0x0b, 0x4c, 0x69, 0x6e, 0x6b, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x72,
+	0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x72,
+	0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x22, 0x30, 0x0a, 0x14, 0x41, 0x75, 0x74, 0x68, 0x65,
+	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x2a, 0x64, 0x0a, 0x16, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54,
+	0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59,
+	0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x00, 0x12, 0x18, 0x0a, 0x14,
+	0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x4f, 0x44, 0x49,
+	0x46, 0x49, 0x45, 0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45,
+	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56, 0x45, 0x44, 0x10, 0x02, 0x32,
+	0x98, 0x02, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x12, 0x5f, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30,
+	0x01, 0x12, 0x54, 0x0a, 0x0d, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c,
+	0x6f, 0x67, 0x12, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65,
+	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
 	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e,
-	0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x27, 0x0a, 0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65,
-	0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0xa0, 0x03, 0x0a, 0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
-	0x67, 0x12, 0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c,
-	0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67,
-	0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49,
-	0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64,
-	0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x68, 0x6f, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64,
-	0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74,
-	0x68, 0x6f, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
-	0x64, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f,
-	0x64, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x5f, 0x69, 0x70, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x49, 0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68,
-	0x61, 0x6e, 0x69, 0x73, 0x6d, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74,
-	0x68, 0x4d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65,
-	0x72, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53,
-	0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x2a, 0x64, 0x0a, 0x16, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
-	0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x00, 0x12, 0x18, 0x0a, 0x14, 0x55, 0x50, 0x44,
-	0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x4f, 0x44, 0x49, 0x46, 0x49, 0x45,
-	0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56, 0x45, 0x44, 0x10, 0x02, 0x32, 0xc5, 0x01, 0x0a,
-	0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5f, 0x0a,
-	0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47,
-	0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x54,
-	0x0a, 0x0d, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12,
-	0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e,
-	0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53,
-	0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1044,41 +1183,45 @@ func file_proxy_service_proto_rawDescGZIP() []byte {
 }
 
 var file_proxy_service_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_proxy_service_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_proxy_service_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
 var file_proxy_service_proto_goTypes = []interface{}{
 	(ProxyMappingUpdateType)(0),      // 0: management.ProxyMappingUpdateType
 	(*GetMappingUpdateRequest)(nil),  // 1: management.GetMappingUpdateRequest
 	(*GetMappingUpdateResponse)(nil), // 2: management.GetMappingUpdateResponse
 	(*PathMapping)(nil),              // 3: management.PathMapping
 	(*Authentication)(nil),           // 4: management.Authentication
-	(*Password)(nil),                 // 5: management.Password
-	(*Pin)(nil),                      // 6: management.Pin
-	(*Link)(nil),                     // 7: management.Link
-	(*OIDC)(nil),                     // 8: management.OIDC
-	(*ProxyMapping)(nil),             // 9: management.ProxyMapping
-	(*SendAccessLogRequest)(nil),     // 10: management.SendAccessLogRequest
-	(*SendAccessLogResponse)(nil),    // 11: management.SendAccessLogResponse
-	(*AccessLog)(nil),                // 12: management.AccessLog
-	(*timestamppb.Timestamp)(nil),    // 13: google.protobuf.Timestamp
+	(*OIDC)(nil),                     // 5: management.OIDC
+	(*ProxyMapping)(nil),             // 6: management.ProxyMapping
+	(*SendAccessLogRequest)(nil),     // 7: management.SendAccessLogRequest
+	(*SendAccessLogResponse)(nil),    // 8: management.SendAccessLogResponse
+	(*AccessLog)(nil),                // 9: management.AccessLog
+	(*AuthenticateRequest)(nil),      // 10: management.AuthenticateRequest
+	(*PasswordRequest)(nil),          // 11: management.PasswordRequest
+	(*PinRequest)(nil),               // 12: management.PinRequest
+	(*LinkRequest)(nil),              // 13: management.LinkRequest
+	(*AuthenticateResponse)(nil),     // 14: management.AuthenticateResponse
+	(*timestamppb.Timestamp)(nil),    // 15: google.protobuf.Timestamp
 }
 var file_proxy_service_proto_depIdxs = []int32{
-	13, // 0: management.GetMappingUpdateRequest.started_at:type_name -> google.protobuf.Timestamp
-	9,  // 1: management.GetMappingUpdateResponse.mapping:type_name -> management.ProxyMapping
-	5,  // 2: management.Authentication.password:type_name -> management.Password
-	6,  // 3: management.Authentication.pin:type_name -> management.Pin
-	8,  // 4: management.Authentication.oidc:type_name -> management.OIDC
-	7,  // 5: management.Authentication.link:type_name -> management.Link
-	0,  // 6: management.ProxyMapping.type:type_name -> management.ProxyMappingUpdateType
-	3,  // 7: management.ProxyMapping.path:type_name -> management.PathMapping
-	4,  // 8: management.ProxyMapping.auth:type_name -> management.Authentication
-	12, // 9: management.SendAccessLogRequest.log:type_name -> management.AccessLog
-	13, // 10: management.AccessLog.timestamp:type_name -> google.protobuf.Timestamp
+	15, // 0: management.GetMappingUpdateRequest.started_at:type_name -> google.protobuf.Timestamp
+	6,  // 1: management.GetMappingUpdateResponse.mapping:type_name -> management.ProxyMapping
+	5,  // 2: management.Authentication.oidc:type_name -> management.OIDC
+	0,  // 3: management.ProxyMapping.type:type_name -> management.ProxyMappingUpdateType
+	3,  // 4: management.ProxyMapping.path:type_name -> management.PathMapping
+	4,  // 5: management.ProxyMapping.auth:type_name -> management.Authentication
+	9,  // 6: management.SendAccessLogRequest.log:type_name -> management.AccessLog
+	15, // 7: management.AccessLog.timestamp:type_name -> google.protobuf.Timestamp
+	11, // 8: management.AuthenticateRequest.password:type_name -> management.PasswordRequest
+	12, // 9: management.AuthenticateRequest.pin:type_name -> management.PinRequest
+	13, // 10: management.AuthenticateRequest.link:type_name -> management.LinkRequest
 	1,  // 11: management.ProxyService.GetMappingUpdate:input_type -> management.GetMappingUpdateRequest
-	10, // 12: management.ProxyService.SendAccessLog:input_type -> management.SendAccessLogRequest
-	2,  // 13: management.ProxyService.GetMappingUpdate:output_type -> management.GetMappingUpdateResponse
-	11, // 14: management.ProxyService.SendAccessLog:output_type -> management.SendAccessLogResponse
-	13, // [13:15] is the sub-list for method output_type
-	11, // [11:13] is the sub-list for method input_type
+	7,  // 12: management.ProxyService.SendAccessLog:input_type -> management.SendAccessLogRequest
+	10, // 13: management.ProxyService.Authenticate:input_type -> management.AuthenticateRequest
+	2,  // 14: management.ProxyService.GetMappingUpdate:output_type -> management.GetMappingUpdateResponse
+	8,  // 15: management.ProxyService.SendAccessLog:output_type -> management.SendAccessLogResponse
+	14, // 16: management.ProxyService.Authenticate:output_type -> management.AuthenticateResponse
+	14, // [14:17] is the sub-list for method output_type
+	11, // [11:14] is the sub-list for method input_type
 	11, // [11:11] is the sub-list for extension type_name
 	11, // [11:11] is the sub-list for extension extendee
 	0,  // [0:11] is the sub-list for field type_name
@@ -1139,42 +1282,6 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Password); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proxy_service_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Pin); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proxy_service_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Link); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proxy_service_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*OIDC); i {
 			case 0:
 				return &v.state
@@ -1186,7 +1293,7 @@ func file_proxy_service_proto_init() {
 				return nil
 			}
 		}
-		file_proxy_service_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+		file_proxy_service_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ProxyMapping); i {
 			case 0:
 				return &v.state
@@ -1198,7 +1305,7 @@ func file_proxy_service_proto_init() {
 				return nil
 			}
 		}
-		file_proxy_service_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+		file_proxy_service_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SendAccessLogRequest); i {
 			case 0:
 				return &v.state
@@ -1210,7 +1317,7 @@ func file_proxy_service_proto_init() {
 				return nil
 			}
 		}
-		file_proxy_service_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+		file_proxy_service_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SendAccessLogResponse); i {
 			case 0:
 				return &v.state
@@ -1222,7 +1329,7 @@ func file_proxy_service_proto_init() {
 				return nil
 			}
 		}
-		file_proxy_service_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+		file_proxy_service_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*AccessLog); i {
 			case 0:
 				return &v.state
@@ -1234,6 +1341,72 @@ func file_proxy_service_proto_init() {
 				return nil
 			}
 		}
+		file_proxy_service_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthenticateRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_service_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PasswordRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_service_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PinRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_service_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LinkRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_service_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthenticateResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_proxy_service_proto_msgTypes[3].OneofWrappers = []interface{}{}
+	file_proxy_service_proto_msgTypes[9].OneofWrappers = []interface{}{
+		(*AuthenticateRequest_Password)(nil),
+		(*AuthenticateRequest_Pin)(nil),
+		(*AuthenticateRequest_Link)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -1241,7 +1414,7 @@ func file_proxy_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_proxy_service_proto_rawDesc,
 			NumEnums:      1,
-			NumMessages:   12,
+			NumMessages:   14,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/shared/management/proto/proxy_service.proto b/shared/management/proto/proxy_service.proto
index f92a7cb8a..d76d4d549 100644
--- a/shared/management/proto/proxy_service.proto
+++ b/shared/management/proto/proxy_service.proto
@@ -12,6 +12,8 @@ service ProxyService {
   rpc GetMappingUpdate(GetMappingUpdateRequest) returns (stream GetMappingUpdateResponse);
 
   rpc SendAccessLog(SendAccessLogRequest) returns (SendAccessLogResponse);
+
+  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse);
 }
 
 // GetMappingUpdateRequest is sent to initialise a mapping stream.
@@ -40,35 +42,18 @@ message PathMapping {
 }
 
 message Authentication {
-  Password password = 1;
-  Pin pin = 2;
-  OIDC oidc = 3;
-  Link link = 4;
-}
-
-message Password {
-  bool enabled = 1;
-  string password = 2;
-}
-
-message Pin {
-  bool enabled = 1;
-  string pin = 2;
-}
-
-message Link {
-  bool enabled = 1;
-  string link_url = 2;
+  bool password = 1;
+  bool pin = 2;
+  optional OIDC oidc = 3;
+  bool link = 4;
 }
 
 message OIDC {
-  bool enabled = 1;
-  string oidc_provider_url = 2;
-  string oidc_client_id = 3;
-  string oidc_client_secret = 4;
-  string oidc_redirect_url = 5;
-  repeated string oidc_scopes = 6;
-  string session_cookie_name = 7;
+  string oidc_provider_url = 1;
+  string oidc_client_id = 2;
+  string oidc_client_secret = 3;
+  string oidc_redirect_url = 4;
+  repeated string oidc_scopes = 5;
 }
 
 message ProxyMapping {
@@ -104,3 +89,30 @@ message AccessLog {
   string user_id = 12;
   bool auth_success = 13;
 }
+
+message AuthenticateRequest {
+  string id = 1;
+  string account_id = 2;
+  oneof request {
+    PasswordRequest password = 3;
+    PinRequest pin = 4;
+    LinkRequest link = 5;
+  }
+}
+
+message PasswordRequest {
+  string password = 1;
+}
+
+message PinRequest {
+  string pin = 1;
+}
+
+message LinkRequest {
+  string email = 1;
+  string redirect = 2;
+}
+
+message AuthenticateResponse {
+  bool success = 1;
+}
diff --git a/shared/management/proto/proxy_service_grpc.pb.go b/shared/management/proto/proxy_service_grpc.pb.go
index 3b4565783..872569123 100644
--- a/shared/management/proto/proxy_service_grpc.pb.go
+++ b/shared/management/proto/proxy_service_grpc.pb.go
@@ -20,6 +20,7 @@ const _ = grpc.SupportPackageIsVersion7
 type ProxyServiceClient interface {
 	GetMappingUpdate(ctx context.Context, in *GetMappingUpdateRequest, opts ...grpc.CallOption) (ProxyService_GetMappingUpdateClient, error)
 	SendAccessLog(ctx context.Context, in *SendAccessLogRequest, opts ...grpc.CallOption) (*SendAccessLogResponse, error)
+	Authenticate(ctx context.Context, in *AuthenticateRequest, opts ...grpc.CallOption) (*AuthenticateResponse, error)
 }
 
 type proxyServiceClient struct {
@@ -71,12 +72,22 @@ func (c *proxyServiceClient) SendAccessLog(ctx context.Context, in *SendAccessLo
 	return out, nil
 }
 
+func (c *proxyServiceClient) Authenticate(ctx context.Context, in *AuthenticateRequest, opts ...grpc.CallOption) (*AuthenticateResponse, error) {
+	out := new(AuthenticateResponse)
+	err := c.cc.Invoke(ctx, "/management.ProxyService/Authenticate", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // ProxyServiceServer is the server API for ProxyService service.
 // All implementations must embed UnimplementedProxyServiceServer
 // for forward compatibility
 type ProxyServiceServer interface {
 	GetMappingUpdate(*GetMappingUpdateRequest, ProxyService_GetMappingUpdateServer) error
 	SendAccessLog(context.Context, *SendAccessLogRequest) (*SendAccessLogResponse, error)
+	Authenticate(context.Context, *AuthenticateRequest) (*AuthenticateResponse, error)
 	mustEmbedUnimplementedProxyServiceServer()
 }
 
@@ -90,6 +101,9 @@ func (UnimplementedProxyServiceServer) GetMappingUpdate(*GetMappingUpdateRequest
 func (UnimplementedProxyServiceServer) SendAccessLog(context.Context, *SendAccessLogRequest) (*SendAccessLogResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method SendAccessLog not implemented")
 }
+func (UnimplementedProxyServiceServer) Authenticate(context.Context, *AuthenticateRequest) (*AuthenticateResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Authenticate not implemented")
+}
 func (UnimplementedProxyServiceServer) mustEmbedUnimplementedProxyServiceServer() {}
 
 // UnsafeProxyServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -142,6 +156,24 @@ func _ProxyService_SendAccessLog_Handler(srv interface{}, ctx context.Context, d
 	return interceptor(ctx, in, info, handler)
 }
 
+func _ProxyService_Authenticate_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AuthenticateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProxyServiceServer).Authenticate(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/management.ProxyService/Authenticate",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProxyServiceServer).Authenticate(ctx, req.(*AuthenticateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // ProxyService_ServiceDesc is the grpc.ServiceDesc for ProxyService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -153,6 +185,10 @@ var ProxyService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "SendAccessLog",
 			Handler:    _ProxyService_SendAccessLog_Handler,
 		},
+		{
+			MethodName: "Authenticate",
+			Handler:    _ProxyService_Authenticate_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{