We are currently working on a micro-service based system. The idea behind it is to split our monolithic system to small domains (micro-service per domain).
All services will be used by our internal applications, but we have plans to expose it to public.
One of the services would be identity management service, which would be responsible for issuing and validating tokens.
For shared references, we are using SharedKernel. One of libraries in shared kernel is a custom
AuthorizationAttribute, which will be used by all micro-services. Basically what the attribute does, is forwarding Bearer token to authorization service, and authorization service responds with information such as token validity, user information and a set off allowed endpoints/resources for the given token.
If the current endpoint is not listed, 401 HTTP response is returned.
Now, I have 2 concerns:
- Are we on the right track and is this a valid approach? If not, what can be done to improve it?
- We are still having problems with UserTypes/Roles concept. We will probably have 3 types of users. Admins, Agents and End-Users and yet again, if some 3rd party company decides to use our API, roles which were created for our needs, might not be suitable for their needs.
The problem is that not all agents will have set of same permissions. For an example we might have an agent who is responsible for accounting and he would have access only to accounting related micro-services, but we might also have an agent who is responsible only for booking. Should this require us to set a UserType for each agent type, fe. AccountingAgent, BookingAgent etc, and assign multiple
UserTypesto user, or there is a simpler approach to solve this?