Authorization code grant type for service to service communication

user_6057426 0
Viewed 103

I have two services: Service A and Service B

I have a central Identity Server that issues and validates tokens.

I need some of the resources of Service B to be accessed only by Service A.

  1. How do I validate the audience, or how do I make sure that for ex. the client credentials token of Service A is valid when calling Service B, and tokens from other services are invalid.
  2. Is it a bad practice or are there any issues in using authorization code grant type for service to service authorization ?
jwt authorization service
1 Answers

  1. When you issue a token for client credentials, then the subject of that token should be Service A. It will either be in the sub claim of a JWT (if you use JWTs for access tokens), or you will be able to get that information from an introspection endpoint (if you use opaque access tokens). Service B can use that information to reject any request with tokens where subject is not Service A.

  2. Authorization code grant type assumes there is a resource owner (a user) and a browser available. It looks like in your case it will be impossible to implement authorization code flow, as you have two services talking directly to each other. Anyway client credentials should be enough for your needs.

user_17122940
Related