We have a PHP based web application with a lot of project data. All of our customers have a dedicated instance of this application.

Now we want to allow a very limited access to some third party users to access some data (read only). We want to create a new dedicated app for these read only users and allow each our customers - with the main app - to select what to share. The communication is REST based.

So we need to create a user entity in each systems. For example John Doe can login in the read only app and our customer want to set what John Doe can see in the base app. Facebook, Google logins are not allowed.

My question is what is the best way to link / connect these 2 users?


To be more precise. The readonly user can log in only into the new and limited application and he/she never allowed to login to the main app. So the readonly user has a real user entity in the readonly app only.

However we need some representation of the readonly user in the main app as well to allow the main app admin to share data.

Every time a readonly user logs in to the readonly app we always ask for the shared data in the main app with a REST call.

  • 1
    I would say that you don't link these 2 users, the customer add somewhere the right for John Doe to see that document, and John Doe see what he has the right to see, independantly of whoever gave him the right. – Walfrat Oct 25 '17 at 14:47
  • Whether you use Facebook, et al or not, OAuth2 is designed for this use case. You can use JWT directly with a signed token to validate the user if you control both applications, simplifying the solution a bit. You don't want to pass username and password around. An authenticated bearer token is the best tool--whether you use JWT directly or go full OAuth2. – Berin Loritsch Oct 25 '17 at 14:50
  • I have updated my question to refine the situation. – Vmxes Oct 26 '17 at 9:46

My question is what is the best way to link / connect these 2 users?

I am not sure they are linked at all. They are different users, with different permissions. One of the users (the main user) has the ability to grant permissions to objects (project data), and the other user can use permissions to access objects.

I would not get confused by the fact that there is a different app, or that these users are third party. From the perspective of the REST services that support these apps, none of that matters. They are simply different users with different permissions to a single repository.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.