At deployment time, I register my microservices in the following way:
- They register themselves in Keycloak to have an identity as a confidential client;
- Then they call an endpoint on a dedicated internal microservice "AUTH-SRV" that grants them the appropriate permissions/roles;
- They also register themselves with the permissions that they are granted in this "AUTH-SRV" as a client for the other internal microservice that they need to talk to.
All my microservices are deployed on premises (without Docker support).
It's working but I find it's not very secure to let a service register itself and its permissions to call others services.
On the other hand, I do not know how to find a better way to do it. For example, if an admin user needs to register a service by hand in a back-office UI, it's not manageable, because we have more than 30 microservices. It will require a lot of work and my application could easily break at runtime because of a missing permission granted between two internal services.
If I opt for another solution, like authorizing all internal calls between services, I may not have a secure in-depth solution.
The question is, is there a more secure way to register and manage internal service to service permissions?