Building authentication with Microservices Architecture -

i'm developing app microservices , don't know how distribute microservices allow auth.

i've read each microservice should have own database avoid coupling.

the problem authentication (via jwt) , users microservices must have access same database , table (users). suppose problem has been solved before due similar applications having deal same issue.

how can solve this?

jws (the signed version of jwt) perfect example thought similar scnearios:

• you have authentication app: every login goes through (signin.domain.com), , once verify credentials of user issue token, generated through private keys
• each service (service1.domain.com, service2.domain.com) can implement middleware instead authorization: services receive public key , able verify authenticity of token through key. don't need db since need verify token valid, not user exists etc etc.

to clarify last statement: should issue short-lived tokens. @ point, that:

• user x logs in
• his token valid ten minutes
• user x deletes account still has valid token
• he hits service.domain.com

on service.domain.com still consider him logged in until you, example, need interact api hits db (ie. add new user address). @ point service responsible writing db throw exception saying user doesnt exist , can trap , log user out. of can tweaked / fine-tuned rough idea of how work.

getting jwts , usage, don't know if familiar php pretty straightforward example.

if want fancy use nginx middleware , have auth module doing authorization you.

last not least, we've covered authentication here: authorization either want to, in each service, either read user's roles token (assuming saved them there once user logs in -- bit flawed if user loses role token still list it) or call signin.domain.com/users/me each service retrieve up-to-date list of user roles, , check he's allowed perform operations on specific service.

oh, , remember should never put sensitive data in jwt / jws can decoded. yes, can add user roles jwt but, example, never save passwords or other plaintext tokens there.

hope helps!