We've built a number of APIs that sit behind a load balancer.

request -> lb -> app1
              -> app2
              -> app3

The load balancer routes requests based on the path to the specific backends.

For example:

api.mycompany.com/app1 -> app1 backend
api.mycompany.com/app2 -> app2 backend
api.mycompany.com/app3 -> app3 backend

The above deployment has been successful so far, however, now we want to require client applications to authenticate before calling one of the backend services because we're wanting to make the application multi tenanted. Only client 1 can read data for client 1. Up until now data has been non-specific to a particular client.

Client applications are backend services ("machines") making the requests on behalf of their users, and can also be periodic autonomous systems.

I vaguely understand OIDC and how this system requires using an Oauth


  • I'd like to avoid having to implement auth for every single service and instead do auth at the LB layer (in our case AWS ALB)
  • I'd like to use an IDaaS provider such as auth0
  • I don't want to send the client directly to an auth0 url to get the access token. Ideally they'd make a specific request to the load balancer with like a username/password and get given the access token
  • Ideally I can just give them an access token once and let them use it as much as they want. Sort of how AWS has access tokens that just last forever without needing to refresh them, etc

Possible future requirement:

  • I can imagine we want to authenticate a client's app's access on behalf of the client's users. E.g. an end user "logs in", and can then access data the client is allowed to access straight from the browser without having to go via their backend with the client's access token. (I have no idea what this is called or if its even possible). It would be, for example, allowing a customer to read data from an aws bucket without having to go via a backend server with the aws access credentials.

Could you please provide me with some guidance about how to best go about this, if its even possible?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.