Authorization server, Oauth2 and auth0

You can follow Auth0 Angular Quickstarts to implement your scenario. It exactly shows step by step implementation. https://auth0.com/docs/quickstart/spa/angular2/01-login

From architecture level, you are doing following:

1. Frontend application (angular) uses auth0-spa-js to implement Authorization Code flow + PKCE to implement login flow. It simply performs user authentication and obtain a token which request API scope as well. To request API permission, add the audience parameter when initiating the login flow.
2. Once you obtain the token, access token can be used to call your backend API.
3. In the backend server , you should implement API authorization (It validates the access token and check token have necessary scopes/ permission). https://auth0.com/docs/quickstart/backend/nodejs/01-authorization

Above API authoriazatio quickstart uses express middleware. This blog post explains how to do the same in koa . https://auth0.com/blog/building-and-securing-a-koa-and-angular2-app-with-jwt/

you have a very broad architectural implementation question for your specific organization case.

I would recommend you follow the below user management model which takes care of Simple API for Authentication, Registration and User Management using NodeJS + Koa + Passport combination.

You can deploy the API to Heroku and test the API using Postman.

You can use the NodeJS Global Error Handler Middleware and you do not have to implement any reduntant local error handler.

As a best practice, use the node JWT middleware that checks the JWT token received in the http request from the client is valid before allowing access to the API, if the token is invalid a "401 Unauthorized" response is sent to the client. This JWT API authorization can be done at your gateway level itself before your microservices.

Finally the Koa + Passport user service contains the core business logic for user authentication and uses Koa-Redis for session management in the node api, it encapsulates all interaction with the mongoose user model and exposes a simple set of methods which are used by the users controller.

Moroever Koa + Passport supports Single sign-on with OpenID and OAuth which answers your other question related to SSO.

Here too you can find that KOA is best suited for microservices as you have already chosen the same. Overlaying authentication + user management using the same infrastructure will prove to be very versatile and extensible.

https://mherman.org/blog/user-authentication-with-passport-and-koa/

In order to connect to an external SSO provider, you could use the nodejs oauth2 client api as follows which allows you to connect your node backend to connect to an external SSO server.

https://www.npmjs.com/package/client-oauth2

For SSO using Google/Gmail, it is best to use SAML based SSO provided by google.

Security Assertion Markup Language (SAML) is an XML-based framework for authentication and authorization between two entities: a Service Provider and an Identity Provider. The Service Provider agrees to trust the Identity Provider to authenticate users. In return, the Identity provider generates an authentication assertion, which indicates that a user has been authenticated.

SAML is a standard single sign-on (SSO) format. Authentication information is exchanged through digitally signed XML documents. It's a complex single sign-on (SSO) implementation that enables seamless authentication, mostly between businesses and enterprises.

below link provides details of how to setup a SAML/SSO service into google from your application.

https://support.google.com/a/answer/6087519?hl=en