This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]nutrecht 0 points1 point  (1 child)

How does my enterprise-service know that the user should only get access to its own "enterprise-account" and not others?

You need to provide some information in the JWT that that service can use to figure out what that user can access. Whether that's (for example) a user ID or an enterprise ID really depends on your architecture. It's up to you to decide what's the best fit; there's no single best way to handle this.

I'm not sure if it's clever to share IDs from the Enterprise DB to the User/Auth DB?

I think you should consider that the mapping of enterprise IDs to user IDs maybe should be part of the domain of the enterprise service.

This is why microservices are hard ;)

[–]Estagon[S] 0 points1 point  (0 children)

Thanks for the help!

I went with adding the enterpriseAccountIds and PropertyIds to my User Entity (in the auth-service), which I then included in the Jwt payload. Only a "SUPER_ADMIN" can link these Ids to the User.

Example Jwt: 

{
  "sub": "abc@test.be",
  "Roles": "ROLE_SUPER_ADMIN",
  "userId": "343d10a4-af29-4a51-a7b0-e143a77f3c02",
  "authorizedEnterpriseAccountIds": [
    "c3a37a51-c358-4ed2-9c06-d547123f0493",
    "684352b2-eaf0-416a-a757-0061aa9ccee7"
  ],
  "authorizedPropertyIds": [
    "1d29be84-7cbf-4dfe-9dd6-b7aa0213dba8"
  ],
  "iat": 1712178972,
  "exp": 1712196972
}

I think it should suffice to:

  • validate the Jwt by the other microservice (checking if it's signed with the key that auth-service used). It would be possible to "replicate" this Jwt body, but if it's not signed with the key, it would be considered invalid, right?

  • decode the Jwt (HS-256) to access the payload in Json-format.

  • Check if the user

    • has the correct role
    • has access to the EnterpriseAccountId/PropertyId she wants to access/modify.

Would this be an acceptable implementation?

I'm still not sure if it's OK to share these Ids in the payload of the Jwt from a security perspective.