Part 4 of my microservices auth series is out. Part 3 gave us permissions for users and services. But org admins define user permissions—so who defines service permissions, and how do we keep them current? Part 4: service access declarations + manifests blog.lordsarcastic.dev/artic…

Part 3 of my series on authentication and authorisation in microservices is out: By the end of Part 2, our services could verify who was calling and which organisation they were operating in. But that still left the more important question: What is this user actually allowed to do here? Part 3 gets into how we designed permissions for both users and services, and the tradeoffs that shaped the system we ended up with. blog.lordsarcastic.dev/artic…

Part 2 of my 8-part series on authentication and authorisation in microservices is out: Verifying tokens without calling Accounts every time At some point, a seemingly simple question becomes important: If Accounts issued the token, does every other service need to call Accounts before it can trust it? That question gets more interesting when the same user belongs to multiple organisations, and their access depends on which organisation they are currently operating in. In this chapter, we follow one user across two organisations and use that journey to work through the problem. I’ve also made a few updates to Part 1 based on some of the questions and feedback I received after publishing it, so it may be worth revisiting before jumping into this one. As with the first chapter, the goal isn’t just to show where we ended up, but the problems that pushed us there and the tradeoffs we accepted along the way. blog.lordsarcastic.dev/artic…