feature: Session tracking for multiple concurrent sessions

Feature Description

Current architecture of using Envoy+Ext-proc for intercepting inbound/outbound traffic has the limitation of only be able to work with a single user at a time. When the agent is working on behalf of multiple concurrent users, our current mechanism will get confused, e.g., should we token exchange on behalf of user A or user B?

The inherit limitation here is that inbound connections and outbound connections are separate TCP connections, and there is no easy way to correlate these. Even Istio currently does not have a solution here.

Proposed Solution

There are several possible solutions:

• Restrict to only a single session, e.g., queue additional requests in Envoy until the current active session has finished
• Assume W3C Trace Context is being used, which requires cooperation from agent code.
• Assume tokens from inbound path are always propagated to outbound requests (as part of SDK or manually done by developer), and we can use fields of the token, e.g., sid to track sessions.
• Explore if eBPF could be used to correlate inbound and outbound sessions/threads

Want to contribute?

• I would like to work on this issue.

Additional Context

No response