Laravel passport, Oauth and microservices

Question

I am having a difficulty in terms of architecture and wondering if someone has some insights.

The plan

• I will have multiple microservices (different laravel projects, catalog.microservice.com, billing.microservice.com) each providing an API.
• On top of these will be an angular fronted consuming those APIs.
• I will have another micro service (passport.microservice.com) for auth now thanks to laravel 5.3 passport this is even easier.

The flow:

• User goes to catalog.microservice.com
• user need to authenticate and provides a user and password
• request is made by angular (aka client) to passport.microservice.com through password grand type to get an authorization token
• now that I have a token I am authorized to call a resource from catalog.microservice.com
• catalog.microservice.com needs to know if the token is valid and makes a request (some kind of middleware?) to passport.microservice.com
• passport.microservice.com returns the user, scope etc.

Questions:

• Is this a good approach?
• The token validation in catalog.microservice.com can be a middleware?

Answer 1

The common approach in microservices architecture is to use a single authentication 'gateway', and usually it's a part of an API gateway.

So besides your passport.ms.com, you have somewhat of a proxy that will check access token from the header and if it's invalid - give an error. If the token is valid - proxy the request to corresponding microservice.

This way you don't have to repeat yourself - you don't have to implement authentication N times for each microservice.

Then, if you need more granular control - what exactly a user can access (usually called authorisation), then you traditionally implement it at each specific microservice.

In short, your microservices shouldn't care if the incoming request is authenticated - it's already been pre-filtered for them. Microservices only decide whether the user X can do action Y.

PS. You can combine API gateway with Passport/Oauth facility or you may run them separately - that's up to you. AWS already offers API gateway as a service (proving how trendy microservices are becoming) but I couldn't find any good open source analogues.