So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards.
Our company is building a new product (Product P) and we want to unify authentication for its API with a recently re-written product (Product A) that uses a legacy database. Product A was re-written to use oAuth 2 for authentication and right now this works great but I'm having a difficult time visualizing how to bridge these two systems because of the requirements the legacy database imposes on what an "authenticated entity" can be in Product A.
- An Authenticated Entity is a User and authenticates using username/password.
- A User belongs to a Company.
- A Company can authenticate using an api key but internally the key is just associated with a dummy User that belongs to that Company with a certain set of permissions.
- Authentication is done with Resource Owner Credential Grants, either password grant (user/pass) or apikey grant.
- User and Company tables are stored in one database alongside the rest of Product A's data (IE not separate databases, can't easily refactor app to change this)
- Authenticated Entity has not been decided on yet
- Usage is not exclusive to users of Product A (IE it's an independent product) but,
- Companys from Product A will rely heavily on Product B's API for some core functionality
- The functionality is contextual based on the entity authenticating from Product A
Basically these two products are offered independent of each other to customers BUT will depend on each other's APIs for some core functionality -- and the functionality is contextual based on who is authenticating.
So the main questions I've been wrestling with:
- How do I unify these two systems under one Authenticated Entity?
- This is more a question of "what should an AE look like?" rather than "how do I handle permissions?" because I know I can do that with scopes.
- Given that I have only one identifier (name from oauth_client) that I can determine from an access token, what should the identifying information be on the Authenticated Entity so I can determine whether it's a User from Product A, a Company from Product A, or an AE from Product B?
- Is there a way to architect Authenticated Entity on Product B that will make bridging Product A easier?