How to use OpenID Connect for authentication and JWT for everything else

1
votes

I want to use the "microservice architecture" https://www.jhipster.tech/api-gateway/ using:

  • my company OpenID connect provider to authenticate users from the frontend SPA
  • JWT for authorization (that is, JWT from the moment the user is authenticated)

I'm not sure how that's supposed to be configured, or even if it's possible at all...

1
jwtjhipsteropenid-connect

1 Answers

0
votes

There are many architectural decisions you have to take on designing full system. But if you are going to use OpenID Conenct then there are few common aspects.

First, as you have figured out you must have a OpenID Connect provider (IDP). You have several options. You may use your own IDP for this purpose. Or else your micro-services may be controlled by an API gateway (Looking at Hipster architecture it does have one) which have a built in IDP for this. Regardless, from your application endpoint, you must use id token to authenticate the end user.

Now going into micro-service consumption, I see two options you can use. If your api gateway builds security for all micro services, then gateway must do the authorization part based on access tokens. But if you are consuming micro-services directly (without interaction with a gateway) then each micro-service handle authorization individually. Both have pros and cons but it's up to you to investigate and decide.

To sum up, your SPA consume id token for end user authentication. Once authenticated, you consume micro-services using the access token (preferably a JWT as you say). Once a micro-service receive a request, it will authorise the request based on access token JWT. For this one must validate JWT claims, signature of it as well as can use token introspection against IDP which issued the token.