Hacker News Reader

Curious if you looked at using oAuth with client credentials grant for each service?

Also didn't see any mention of prior art like https://cloud.google.com/beyondcorp/.

Thanks for the great writeup!

This is probably our next project, although we might solve this problem with mutual tls instead of JWTs

oAuth generally won't give you JWT's. Its recommended it gives you an opaque token which you introspect. Whats nice is you delegate the Auth part to your AS. And then your resource servers (micro-services) can make the determinations based on the client_id/claims from introspection.

Reply on news.ycombinator.com