So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards.

Overview (TL;DR)

Our company is building a new product (Product P) and we want to unify authentication for its API with a recently re-written product (Product A) that uses a legacy database. Product A was re-written to use oAuth 2 for authentication and right now this works great but I'm having a difficult time visualizing how to bridge these two systems because of the requirements the legacy database imposes on what an "authenticated entity" can be in Product A.

Product A

  • An Authenticated Entity is a User and authenticates using username/password.
  • A User belongs to a Company.
  • A Company can authenticate using an api key but internally the key is just associated with a dummy User that belongs to that Company with a certain set of permissions.
  • Authentication is done with Resource Owner Credential Grants, either password grant (user/pass) or apikey grant.
  • User and Company tables are stored in one database alongside the rest of Product A's data (IE not separate databases, can't easily refactor app to change this)

Product B

  • Authenticated Entity has not been decided on yet
  • Usage is not exclusive to users of Product A (IE it's an independent product) but,
  • Companys from Product A will rely heavily on Product B's API for some core functionality
  • The functionality is contextual based on the entity authenticating from Product A

Basically these two products are offered independent of each other to customers BUT will depend on each other's APIs for some core functionality -- and the functionality is contextual based on who is authenticating.

So the main questions I've been wrestling with:

  • How do I unify these two systems under one Authenticated Entity?
    • This is more a question of "what should an AE look like?" rather than "how do I handle permissions?" because I know I can do that with scopes.
  • Given that I have only one identifier (name from oauth_client) that I can determine from an access token, what should the identifying information be on the Authenticated Entity so I can determine whether it's a User from Product A, a Company from Product A, or an AE from Product B?
  • Is there a way to architect Authenticated Entity on Product B that will make bridging Product A easier?
  • Will users have access to the actual API or to interfaces/views in their respective product that will make use of the alternate API to provide functionality? – Joel Etherton Sep 23 '15 at 14:21
  • Users of both products will have access to both actual APIs. As for Product B's APIs that Product A uses -- I would like to treat Product A's requests as if they were an independent user (IE they get no special treatment just because we use them internally) – Matt Foxx Duncan Sep 23 '15 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.