There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the other app.
App1 and App2 both call each other to share some of their functions so although a user can not log in to the other system, they should have access so the call can be made to a specific function from the other app.
User A can access the green functions and User B can access the red functions.
There is actually a third user that is an admin and should be allowed to log into both apps and access an enhanced level of functions.
Ideally the login/authentication system should be standalone and the app's can call it to check a users access to functions.
Is there a standard way of achieving this, like with Oauth2 or JWT?
Is it unrealistic to think that each time a function is called the users level is checked by the external auth service?