3 ms·
I'm also interested in this, but specifically something that covers authentication between services and in particular situations where a user authenticates agai
by nevon 3y ago
I'm also interested in this, but specifically something that covers authentication between services and in particular situations where a user authenticates against service a and now service a needs to ask service b to do something on behalf of the user. Not just a handwavy "use OAuth" but more concrete and thorough.
- louis-lau 3y agoTo be honest, my first instinct was to give a hand wavy "use OAuth". But to elaborate a but further, oauth is made for this and is the industry standard for this kind of thing. There's lots out there on oauth that tells you more than "just use it", it's just a couple searches away. So I don't think I really understand the question.
- cpach 3y agoFor an overview, you might like these two articles: https://www.lvh.io/posts/a-childs-garden-of-inter-service-authentication-schemes/ https://www.lvh.io/posts/a-childs-garden-of-inter-service-au... https://fly.io/blog/api-tokens-a-tedious-survey/ https://fly.io/blog/api-tokens-a-tedious-survey/
- mooreds 3y agoDisclosure: I work for FusionAuth. Have you looked at the specific RFC for token exchange? https://datatracker.ietf.org/doc/html/rfc8693 https://datatracker.ietf.org/doc/html/rfc8693 The concepts are solid, even if not every vendor supports it. FusionAuth doesn't, though we have an open issue for it: https://github.com/FusionAuth/fusionauth-issues/issues/1471 https://github.com/FusionAuth/fusionauth-issues/issues/1471
- paulddraper 3y agoUse OAuth?