We are trying to move from a monolith application to a microservice architecture faced by a spa application. One of the reason, is that we want to expose some services of our business to partners and another reason is to build a better user experience via an spa application.

In the old application I had a webapplication where I could register an employee (name, surname, empno, adress...), choose his company from a dropdown list and in the same time create an account for this employee in a backend erp : think of this application as a backoffice one. All data was on a single form, when the user submit the form : the backend server save the employee record, and if successful create an account in the erp system.

In order to manage the authorization for this application : the url to register an employee in the webapplication was accessible only if the loggued user have a role that able to handle the "RegisterEmployee function".

Now in my spa application, I need to call :

  • a microservice for verify if the employee is not already registered ,
  • a microservice to have the list of the known companies
  • a microservice to create the employee account in our erp

I was first trying to define the roles allowed in each microservice, but it seems weird because : - all my microservices could be reused in different scenarios - and they don't necessary share the same list of roles...

In fact I am in the same situation as in this other question : SOA/Microservices: How to handle authorization in inter-services communications? but as the author of the question I have not found any solution yet.

I had read about api gateway lately, and perhaps it is the way to go, but I am not sure how ? Does this mean that my microservices do not have to be aware of any authorization management ?

  • 2
    There are many ways to skin this particular cat but a good place to start would be reading up on claims-based authorization.
    – Ant P
    Jan 17, 2019 at 14:35
  • 3
    Maybe offtopic, but if you have to call 3 services to fulfill a use-case, you are probably doing microservices wrong. You may be using "microservices" as plain database tables. Jan 17, 2019 at 14:43
  • @Robert Bräutigam, are you suggesting that I should have only one microservice for the use-case (ie for the UI and use-case management) ? For example a "RegistrationEmployee" service ? Why not, but in all case this registrationEmployee service should know about employee data, company data,... So should define any authorization attribute on this data services ?
    – Dypso
    Jan 17, 2019 at 14:50
  • @AntP, thank you! Any good links?
    – Dypso
    Jan 17, 2019 at 14:54
  • @Dypso I'm reluctant to give generic advice about your application that I obviously don't know. What I do know is, that microservices are supposed to implement specific, independent business-functions or business use-cases. They are not CRUD data services, i.e. tables over http. The difficulty is to create microservices that are independent (i.e. don't need others to work, especially not data), but still implement business functionality. Jan 17, 2019 at 15:43


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.