On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform without having to authenticate the user again?
Assume a user attempts to sign up for a service on the platform (call this service Microservice A), then as part of the Authorization Grant Flow the user (resource owner) must be authenticated. Assuming this is done successfully, eventually an access token is issued and the user is allowed to proceed. Now assume that the user must be redirected to another microservice (call this service Microservice B) on the same platform to complete a different business journey. The access token (signed JWT) is currently only accessible by Microservice A. The access token is not stored by the authorization server (it can be, if needed, and if that is secure thing to do). In order for the user to access Microservice B, what should be the process to follow to grant authorization to the client to allow the user to proceed with accessing Microservice B user journeys without having to re-authenticate the user?
One idea would be to delegate all redirect requests to any microservice on the same platform to the authorization server. The delegated request would have the signed JWT and so the authorization server can query the authenticity of the JWT and therefore know which user is authenticated. If ok, then the authorization server can issue a new authorization grant code and then redirect to the destination microservice as per the redirect flow in the OAuth authorization grant flow. The destination microservice can then ask for an access token and so complete the authorization step. With this solution the user is assumed to be authenticated as a valid JWT was provided.