I am using JWT for authentication in a micro service architecture. There is 1 UI web app and multiple REST API exposed services in the backend. I am considering a IAM service which will give a JWT to UI with permission information. The UI can use this to contact another Micro service X. But in this case should X contact IAM to validate or since it is self contained, should X go ahead with the request ?
Note that users can logout their sessions in IAM.