I'm comfortable with a lot of OpenID Connect and OAuth2 concepts in the context of HTTP-based communication between microservices. I'm currently leveraging Azure AD.
In the HTTP-based scenario I would typically use the on-behalf-of flow for communication between microservices where I need to maintain the user identity in the access token.
My question is what is a good approach for handling this when using queues (e.g., service bus) and the service processing the message from the queue needs to call another microservice to collect information. In my case the microservice being called can do fairly complex authorization based on the context of the request and the user.
I'm aware that I could essentially do service-to-service calls and let the microservice processing the queued message enforce authorization, but I don't want to duplicate that logic in the calling service as well.
If I tried to include the access token in the message or some similar approach, then I would be at risk of it being expired by the time the message was processed.