currently I develop a backend based on the microservice architecture. Unfortunately, I have a problem how to realize the authorization.
So let me explaine my system - there are the following services:
- OAuth 2.0 Service (issuing JWT)
- Group Service
- Some Ressource Services (e.g. ToDos Service)
Every user is in one or many groups. Each resource (like a ToDo list) also belongs to a group. That means if some user creates a todo list, that list gets stored in the name of the group.
Szenario:
- User A is in group A
- User B is in group A and B
- User C is in group C
- User A creats a ToDo list in group A.
- User B modifies this ToDo list (he is allowed to do this since he is also in group A)
- User C also tries to modify this ToDo list, but he shouldn't allowed to do this since he is only in group C.
Has any body a great idea how I could realize this in a microservice architecture and keep the dependencies between the services on a minimum?
Certainly, I could ask on every request the Group Service if the user is in the group to which the resource belongs to. But so I get a really hard dependency between the Resource Services and the existence of a Group Service - I like to avoid this dependency. Another option would be to store all groups, to which the user belongs to, in the access token. But with this option the client has to ask every time the OAuth Service for a new token when the user gets a member of a new group.
So is there any other option how I could realize this szenario?