Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth)
A user U passes the access token in a request, and the call first reaches the gateway before it enters the services behind, say A, and then A calls B in order to complete the request.
Now, for inter-service authentication between A and B, there are two options :-
- Pass the user's access token from A -> Band let the service B authenticate call using the same access token.
- Perform user Auth just at gateway, and the services should have their own credentials to authenticate against each other (maybe mTLS).
So all in all, is it ideal to services to authenticate against each other using a separate set of credentials or it's ok to reuse the user's token for auth?