I am struggling to find a good solution for authorization of users after they were properly authenticated through an oidc flow. Let's assume the following setup:
- An angular SPA is interacting with several microservices.
- It's important to note that those microservices support multi tenancy, depending on the url being called from outside (customer1.myapp.com), the request is done in a specific tenant (let's say tenantId=42). This is applied as a filter to all database requests. Besides this, the tenant id is opaque to the microservices. After this determination, a request being handled cannot break out of it's tenant.
- one service is responsible for maintaining some form of organisation structure, like employees belonging to groups. Lets call it the master data service.
- others might authorize access to resources based on the membership to a group
- authentication is done by Keycloak (with social identity providers in place). Keycloak is not tenant aware, you are the same identity, no matter with what tenant you interoperate. Keycloak cannot be used to model the group membership, because you can be member of different groups depending on the tenant you are interacting with
My first approach was:
- The angular SPA gets an access token from keycloak using the oidc code or implicit flow
- then, the anular SPA is calling the master data service to exchange the keycloak access token (only providing the global identity) for a tenant related access token also containing the group memberships
- the exchanged token is used from now on
However, this feels fishy. While it worked for angular, I was unable to make it work with swagger for example. Other clients (we have a command line interface for imports and stuff) will also have to implement this strange additional step on top of using an oidc-lib off the shelve.
Am I on the right track? Or should I ask the master data service every time whether the request's identity belongs to some group? Right now, the services are not calling each other but just communicating through an message bus.