2 ms·
Curious if you looked at using oAuth with client credentials grant for each service? Also didn't see any mention of prior art like https://cloud.google.com/bey
by matdehaast 7y ago
Curious if you looked at using oAuth with client credentials grant for each service?
Also didn't see any mention of prior art like https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/.
Thanks for the great writeup!
- p10jkle 7y agoThis is probably our next project, although we might solve this problem with mutual tls instead of JWTs
- matdehaast 7y agooAuth generally won't give you JWT's. Its recommended it gives you an opaque token which you introspect. Whats nice is you delegate the Auth part to your AS. And then your resource servers (micro-services) can make the determinations based on the client_id/claims from introspection.