I have a very interesting question that has proportionally blown up amongst my friends and I. This deals with handling user issued tokens from a series of authentication microservices.
- Each Auth Service is backed by its own data store
- Each Auth Service can issue a token that only its data store knows about
Here's a minimal example of the problem:
Using the Microservices Architecture We have a Master API Service that delegates all requests to the requested service We have two Authentication Services that sit behind the Master API Service Auth Service 'A' Auth Service 'B' If 'A' issued an authentication token the User The token will be stored in a JWT The JWT will be signed by the unique KEY to service 'A' only The User makes an authentication request using their issued token How does the Master API Service know which Auth Service it should validate the token against?
Approaches we have thought of:
- Approach A: Store some metadata in the JWT claim that contains useful information pertaining to which Auth Service issued it.
- Issue: Each Auth Service signs the JWT differently. This leads us back to the original problem.
- Approach B: Issue authentication requests to each authentication microservice and if one validates the claims then it must contain the token
- Issue: This defeats the purpose of microservices
Can anyone shed some light on this problem? Perhaps we are just overthinking the solution.