I'm working on a service where I want to protect endpoints from unauthorized access, but I don't want to deal with user management. This is how I found the OpenID Connect which I would like to use only as an identity layer. I'm a bit lost however with the authorization. For the authorization I want to have an application specific role based logic which would run on my server. I saw some examples for the authorization code flow, but in those examples the authentication and the authorization is done by the same server, which has authentication and authorization endpoint. Which also made me wondering, that how typical my use-case is. Maybe I shouldn't even do it.
It's not really clear to me, that what steps should I do when the authentication is done by the identity provider (i.e google), but the authorization should be done by another service. As I imagine in this case the flow would look something like this
- Not authenticated user tries to reach a protected resource
- The user redirected to the id provider's login page and it gets back the id token and an authorization code
- Then the client should call the authorization endpoint with the authorization code to get access token.
In step 3 then I think I should have a connection to the identity provider in order to be able to validate the authorization code, right? What if there are multiple identity layers, how can the authorization logic decide then, that to which identity provider should it go?