Background:
There are three different applications A
, B
and C
and they all share same user details but I had to implement authentication in each of them which was duplication of effort.
After some research I decided to go micro service way and implemented an authentication service. The service stores the secret
for each app and prepares a JWT token when the user tries to login to given app. This is working fine as expected.
Current:
Now, there is a need to have roles and permissions for each application and I finding a way to implement it without creating much coupling. I have few questions regarding my current situations:
Questions:
- Should I add authorisation login in the same service or create another service with
roles
andpermission
tables in it. The end result will be to send a
JWT
token which would contain payload defining user details and permission so for example:{ uid: 1, name: '...', email: '...' permissions: [{ 'edit': ['post', 'user'], 'delete': ['post'], 'read': ['post', 'user'], ... }] }
On paper the this structure seems good to me. It will save additional network calls from the client side. But is it safe and reliable enough?
PS: I don't have enough experience in building real applications but I hope I am going in the right direction.