Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

12
  • 2
    There are many ways to skin this particular cat but a good place to start would be reading up on claims-based authorization. Commented Jan 17, 2019 at 14:35
  • 3
    Maybe offtopic, but if you have to call 3 services to fulfill a use-case, you are probably doing microservices wrong. You may be using "microservices" as plain database tables. Commented Jan 17, 2019 at 14:43
  • @Robert Bräutigam, are you suggesting that I should have only one microservice for the use-case (ie for the UI and use-case management) ? For example a "RegistrationEmployee" service ? Why not, but in all case this registrationEmployee service should know about employee data, company data,... So should define any authorization attribute on this data services ? Commented Jan 17, 2019 at 14:50
  • @Dypso I'm reluctant to give generic advice about your application that I obviously don't know. What I do know is, that microservices are supposed to implement specific, independent business-functions or business use-cases. They are not CRUD data services, i.e. tables over http. The difficulty is to create microservices that are independent (i.e. don't need others to work, especially not data), but still implement business functionality. Commented Jan 17, 2019 at 15:43
  • We use JWT (jwt.io) and include the roles in the token. That keeps all the information we need in the token itself so we don't need to make further microservice to microservice calls to ensure they have permissions to do things. Commented Jan 17, 2019 at 18:10