-2

I want to implement an authentication system. The purpose of the system is to centralize account management and handle the complexity of account security. Internally, I don't want to implement the actual login by myself. Instead, I want to use Azure AD B2C for user login, forgetting passwords, etc. Our team has other web services. All other services will rely on this system for authentication.
Currently, I wrap Azure AD B2C so that other services won't directly depend on Azure AD B2C. When a user goes to a service, and he is not logged in, the service will redirect the user to the authentication system, and the authentication system will redirect the user to Azure AD B2C again while handling the logic of appending client ID, generating nonce, etc. After the user finishes the login, he is redirected to the authentication system. The authentication checks the ID token and issues another access token (JWT) using a private key it maintains, sets the access token in Set-Cookie header, and redirects the user back to the initial service.
I found it good that other services don't directly rely on Azure. It's completely abstracted by the authentication system. But it also adds a lot of complexity to the implementation.
When using an authentication-as-a-service like Azure AD B2C or Auth0, is it suggested to issue our own access token after the user is authenticated? Or is it suggested to directly use the access token issued by Azure AD B2C and pass it around all other services?

1 Answer 1

0

I don't see why you would. The point of standards is that you don't care what provider is issuing your tokens/claims. If you want to change authentication provider then you just migrate any accounts. Your interfaces or claims need not change. Wrapping just means extra work as far as you describe it.

2
  • If the provider is changed, all the other services need to change the settings for validating access token(e.g. issuer, jwks URL). The account ID may also change. Do you think that could be a problem?
    – someone
    Oct 8, 2021 at 14:25
  • Maybe I misunderstand but you're talking about a reconfiguration to a new service provider? Well, yes, I guess but that's just config. Account ID I expect you could migrate the existing ones to your new provider. Oct 8, 2021 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.