I am designing a system composed of several services. Some can be hit only from inside our network and a few can be hit externally. One of these services is a "login" or "authentication" service.
My thought is that a user will log in with a username/password to be sent to the authentication service. That service will return some kind of auth token that grants access to the other services bound by the privileges given to that user.
What are the best practices for securely designing such an infrastructure? Any resources you recommend for more in depth reading?