So we are a group of students making an online platform for our University. We are modelling our platform as a set of services.
For example, a service "A" might store only personal information of users and expose a REST API on top of it. Another service "B" might only be sending emails.
Now we want to use OAuth for Authentication and Authorization (I know OAuth is an Authorization framework but we want to do roughly what google does).
A typical scenario could be something like:
- User requests webpage of service "A".
- Service "A" sees that user is not authenticated, so it will send a redirect to Auth Server.
- User enters its credentials, and an access token is granted to service "A".
Now, service "A" may need to call another service "B". Note that this is an internal server to server request. Various other services might be calling service "B".
I want to make sure that when service "B" is called, only allowed services can call it. For example, "A" has the right to call "B", but "C" doesn't. In other words, I want to ensure only whitelisted callers for a particular service can call it.
So my question is, is it possible to secure internal service-to-service calls using OAuth?
Can it be done in a simpler yet secure way?
I don't want token delegation: that is, I don't want the first token issued to service A being used somewhere else. It is assumed that if "A" is calling "B", then "A" has the right to do so, even if there is no user logged in.
My attempt: (might be wrong, please correct me) * The Auth server can issue clientIds and client secrets to each service. * A service which wants to call another service identifies itself to Auth server using key and secret. * If the service is allowed to call the target service, Auth server issues a token, else returns forbidden.
But even in this case, the Auth server is doing too much.
Can't each service itself control what other services can call it?