We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service.
We have a customer(a company), their users using their service via their mobile app. In short, they are a B2C business. This company would like to have their users be able to also access our service in addition to what their mobile app is serving. Their users need to login to the mobile app with registered credentials in their backend system.
I am seeking for a best solution for this business case following OAuth2+OIDC standard.
From my team's perspective, we would like to know who is accessing our API & issuing tokens for every access to our APIs. In other words, we'd like to identify every of their user who is accessing our API. But their users don't have credentials in our system but only in that company's backend system.
At the moment I have two rough directions:
- Their mobile app don't directly access our API but via their backend.
- Their mobile app can directly access our API.
I am not sure which option is better(secure & reliable & performant) & how the flow should look like. Could someone please suggest me the best authentication and authorization flow for this business requirement that needs to access our APIs?