I have the following setup for my application:

  1. A User logs in and is granted a Session Token.
  2. When making API requests to Service A the User provides the Session Token.
  3. All requests go through an API Gateway which internally re-directs the request to an Authorization Service which authenticates the Session Token and generates a JWT with appropriate authorization information for all services.
  4. The API Gateway redirects the request back to Service A with the newly generated JWT.
  5. Service A validates and then uses the JWT for authorization (i.e. this user has permission to perform this action given the information in this JWT).
  6. Service A can pass that same JWT to any downstream services it needs to make requests to. Those services treat authorization/authentication in the same way without having to go back to the Authorization Service.

This works well for requests generated by a user.

The trouble I'm having is extending this general setup to "asynchronous" requests, where Service A may need to make a request to Service B sometime in the future, or completely separate from a User request. The problem being, how does Service A itself generate a JWT to pass to Service B? Obviously the service cannot "log-in" the same way a User can to get a Session Token to provide to the Authorization Service to generate a JWT for it, similar to the way it worked for a User request.

What I don't want to do is share the same secret between all services so that they can generate their own valid JWT. I would like that centralized to some authority which the services can register themselves against.

One objection would be, why does Service A need to be authorized to make the request to Service B? They are all in the same intra-network so they can be trusted via other means. The answer is that I don't want to set up a separate API for intra-network requests versus public facing APIs, for every micro-service, for every endpoint. So if both Users and Services are to use the same endpoints, they both will need to provide a valid JWT to be authorized. Now, the JWT body doesn't have to look the same for both users and services, but it does have to be passed and be validated by whatever service is receiving it.

I'm not necessarily looking for a solution, any resources or standard patterns for achieving this type of authorization would be immensely helpful.

  • just get the service to login the same as the user does. give it a username and password in its config to use for that purpose – Ewan Apr 24 '19 at 19:42
  • A service could generate a JWT and sign it with a symmetric key that is shared across all services. Another service can then easily validate this token. Too risky or safe? Depends on many factors in the threat model. – identigral Apr 29 '19 at 1:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.