I have the following simple scenario:
- Multiple web applications share SSO functionality
- An Authorization Server is used as the central identity service for the web applications
- Users are authenticated via the web application server and authentication server using oAuth Authorization Code grant.
- There is a set of independent API services for data access.
Not all web applications are allowed to access all API services so it needs to be established if the application is allowed to use the service.
My question: I see two ways to authenticate the web applications to the API Service:
- The web application passes the access token from the user authorization code grant (e.g. a JWT token) to the API service with its application key. The API service then validates the token and the application key against the authorization server and responds with a pass/fail.
- The web application creates another oAuth flow (e.g. Client Credentials) with the API service and receives its own access token from the authorization server.
I would like to find out which is the more common scenario and makes sense to implement?