I'm trying to design a system that has the following elements:

  1. the main backend REST API (currently one, probably multiple in the future)
  2. front-channel client(s) -- JS-based single-page app(s)
  3. back-channel client(s) as libraries, CLI apps etc
  4. a central RBAC API defining roles, groups and permissions
  5. a separate identity and authentication service that supports OIDC and SAML

All of the elements described above, except for the last one, are developed and deployed by my team, and all of them including the last one belong to the same company. Any external users we might have in the future will still be identified through the identity service.

I would appreciate any pointers to how to implement the authentication of the users of 2 and (especially) 3, as well as authorisation of users according to the RBAC constraints. My thought was to use OAuth2 and transfer the permissions using the Access Token, but I'm not sure if that is the right approach and, even if it is, how to specifically implement it.

I know this question is a bit vague, and I'm mainly looking for an advice on best practices and any previous experience, to avoid reinventing the wheel. Thank you!

  • You should not be implementing either 4 or 5. There are many open source and commercial frameworks that do that extremely well. Implementing security from scratch is looking for trouble. Look at the open ID community for references to products or frameworks. WSO2, forge rock, ping identity, axiomatics, okta are all frameworks or vendors that have products in that space – David Brossard Jun 13 '19 at 1:54
  • 1
    I know; 4 will be implemented using a framework like you mentioned, while 5 is implemented company-wide and (as mentioned) is outside our control. I'm not concerned about the implementation of any of the above; the main problem here is the exact details of implementing the communication of auth information (identity and permissions) between the systems. – Berislav Lopac Jun 13 '19 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.