We are trying to move from a monolith application to a microservice architecture faced by a spa application. One of the reason, is that we want to expose some services of our business to partners and another reason is to build a better user experience via an spa application.
In the old application I had a webapplication where I could register an employee (name, surname, empno, adress...), choose his company from a dropdown list and in the same time create an account for this employee in a backend erp : think of this application as a backoffice one. All data was on a single form, when the user submit the form : the backend server save the employee record, and if successful create an account in the erp system.
In order to manage the authorization for this application : the url to register an employee in the webapplication was accessible only if the loggued user have a role that able to handle the "RegisterEmployee function".
Now in my spa application, I need to call :
- a microservice for verify if the employee is not already registered ,
- a microservice to have the list of the known companies
- a microservice to create the employee account in our erp
I was first trying to define the roles allowed in each microservice, but it seems weird because : - all my microservices could be reused in different scenarios - and they don't necessary share the same list of roles...
In fact I am in the same situation as in this other question : SOA/Microservices: How to handle authorization in inter-services communications? but as the author of the question I have not found any solution yet.
I had read about api gateway lately, and perhaps it is the way to go, but I am not sure how ? Does this mean that my microservices do not have to be aware of any authorization management ?