We're a smaller shop that puts out a number of products that require authentication and authorization. We're currently using a 3rd party service to "spin up new auth APIs" for each application. However, I would like to investigate potential designs for doing this ourselves in-house due to additional security requirements that may be needed in the future. I've included information below and would appreciate any design or support as I'm relatively fresh with designs of this scale.
Summary of goals:
An interface that allows a developer to create and manage authentication APIs for multiple applications via a webpage. This includes the mostly automated process of spinning up new auth APIs, and ideally the ability to do some form of RBAC / ABAC changes via this page.
All APIs can expose the same common-auth endpoints, so they're basically just "Images" of one another. (I.e. Login / Register / etc.)
While this would ideally be entirely automated, some parts I've thought of being manual are: * Domain configuration (pointing subdomains to new endpoints) * Spinning up additional VMs (needed?) * Spinning up additional DBs or tables? * Minor configuration changes * others I haven't thought of?
- As a Developer, I want to login to a web portal so that I can manage auth APIs.
- As a Developer, I want to create a new API in the web UI, so that I can then integrate it to new applications.
- As a Developer, I want to manage users in the web UI, so I can oversee access to our applications.
- As a Developer, I want to **...
Each new API for the applications should likely have the user stores (table containing user information) segregated into different databases stored on separate hardware to minimize attack vectors and improve security/scaling. For now, I'm thinking of different subdomains or maybe request parameters to separate the APIs?
I feel like there may be some solution that involves building a template/image of an Auth API on Azure and just duplicating the VM or image, but I'm not too sure of this route either. Obviously management, maintenance, updates, etc. to these would be more hands-on, but feel free to provide feedback on this as well.
Thanks in advance!