I'm trying to design a system that has the following elements:
- the main backend REST API (currently one, probably multiple in the future)
- front-channel client(s) -- JS-based single-page app(s)
- back-channel client(s) as libraries, CLI apps etc
- a central RBAC API defining roles, groups and permissions
- a separate identity and authentication service that supports OIDC and SAML
All of the elements described above, except for the last one, are developed and deployed by my team, and all of them including the last one belong to the same company. Any external users we might have in the future will still be identified through the identity service.
I would appreciate any pointers to how to implement the authentication of the users of 2 and (especially) 3, as well as authorisation of users according to the RBAC constraints. My thought was to use OAuth2 and transfer the permissions using the Access Token, but I'm not sure if that is the right approach and, even if it is, how to specifically implement it.
I know this question is a bit vague, and I'm mainly looking for an advice on best practices and any previous experience, to avoid reinventing the wheel. Thank you!