4 ms·
This is probably our next project, although we might solve this problem with mutual tls instead of JWTs
by p10jkle 7y ago
This is probably our next project, although we might solve this problem with mutual tls instead of JWTs
- matdehaast 7y agooAuth generally won't give you JWT's. Its recommended it gives you an opaque token which you introspect. Whats nice is you delegate the Auth part to your AS. And then your resource servers (micro-services) can make the determinations based on the client_id/claims from introspection.