I'm trying to build a web application broken down into a bunch of micro services and each micro service is a resource server. I also have a separate authentication server.
I'm wondering which of the approaches below is better or if you think you have better idea or believe OAUTH is not the right tool for this.
Here are the ways I've tried:
- User (resource owner) goes to my app home page http://example.com
- This landing page has username and password field so once the user enters these fields I make an ajax call to the authentication server which eventually will give me an access token after the TWO-LEGGED OAUTH FLOW.
- Now I take the oauth access token and go to the resource server to access the resource.
- The resource server will now make another http call to the authentication server programmatically to verify the access token once the authentication server says yes then the resource server will serve request towards the completion (This way the resource server is totally isolated with the authentication process)
The other way would be to let the resource server verify the access token by talking to shared database.
Which one of these is the more common in the industry? Any other ideas on how to verify the access tokens?