Here at work we have a portal with like 6 systems lying under, each one has its own backend API, built with .NET Core, the frontend is React by the way.

The situation :

Today we have a single API that is used for both Authentication and Authorization (i will call it LoginAndProfileAPI) and its is used globally for all of the systems, here's my attempt to describe how it works :

As Is

we have this global,

The Issue :

Now we have a necessity to have local user management inside each system so that the local admins for that system can manage the access level/permission/profiles only of the profiles related to that application, we also need to turn our Auth process a little bit more standard, separating Authorization and Authentication a little bit more.

What would you guys do in this situation, what i came across until now was :

The idea i had, but stil needs some shape

but it kinda looks like a mess tho.

Does anyone have a clue of how can i be more standard with this

Edit :

Would that be best scenario ?

Looks pretty much like a more minimalistic/lightweight approach !!!

@WandererAboveTheSea suggestion about it (did i get it right ?)

Here is a cleaner image :

JWT Auth Example

What looked kinda odd to me was that it seems like JWT is beeing used for both Authentication and Authorization

CodePudding user response：

JWT is meant to be stateless and lite weight. Your using JWT for authorization is the correct approach.

You can improve on the following part.

After getting the username you are making database calls to get the user profile which you can avoid by adding those details to JWT itself. So that part can be simplified.

Information Exchange: JSON Web Tokens are a good way of securely transmitting information between parties.

Apart from this rest of the design looks good.