Should user and service-to-service authentications be separate?

Question

Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth)

A user U passes the access token in a request, and the call first reaches the gateway before it enters the services behind, say A, and then A calls B in order to complete the request.

Now, for inter-service authentication between A and B, there are two options :-

Option 1:

• Pass the user's access token from A -> Band let the service B authenticate call using the same access token.

Option 2:

• Perform user Auth just at gateway, and the services should have their own credentials to authenticate against each other (maybe mTLS).

So all in all, is it ideal to services to authenticate against each other using a separate set of credentials or it's ok to reuse the user's token for auth?

Answer 1

There is no "ideal" here - it all depends on what you need.

While focused on more modern technology, the core of your question is no different from ASP.Net's classic impersionation feature as opposed to using a service account. The same considerations that applied then also apply here now.

If the data accessed in B is sensitive to who's asking (i.e. which user, not which chained service), then it makes sense to use passthrough authentication so B is able to decide who gets to see B's data.

Similarly, if B wants to track user activity (e.g. audit fields), having a user token is a great way to ensure that this works.

If A is allowed to decide who gets to see B's data, and B genuinely doesn't care about the actual user, then A can just log in to B itself.

This is a matter of how you design your ecosystem. Is A considered a trustworthy proxy? Or would you rather have each microservice manage its own trust?

The good thing here is that you don't need to pick just one option. If both the user and A are both known in the identity provider, then A can selectively choose to either impersonate the user or use its own identity.
This is very useful in cases where both approaches can bring something to the table. For example, in an old project of mine, direct requests (i.e. targeting a specific resource) were done based on the user's credentials, but the fetching of an event feed was done under a service account since this hosted service was not triggered by an actual user's request.