Golang中的单点登录身份验证

Question

I am trying to build a multi-tenant architecture in golang where there will be different services like Service-A and Service-B each service will run on a different server and I want the user to have a single sign-in solution and get authenticated in all the services offered.

Just like what Amazon AWS or Google does like it has many different services like Amazon Cloud Front, Amazon EC2, Amazon S3 and all services are authenticated through a single login and logout from one service result inlog out from all connected services.

I am trying to implement this in golang, so far I found out Open-id Connect coreos/dex but it lacks docs explaining its API and Architecture.

What would be the best architecture to design such authentication system?

I think using JWT token I can achieve it. Is this architecture will be secure or there any better solution for this?

My Approach

                          -----------------        
                          |               |    shared
                          |               |   env file
                          |SERVICES A     |---------------|       
           AUTH HEADER    |               |               |
           JWT TOKEN      |               |               |
        |---------------> -----------------               |                     
    ---------            ------------------   shared      |
    |       |            |    SERVICE B   |  env file     |                    
    |Login  | -----------|                |-----------    |               
    |Browser|            |                |          |    |  
    ---------            ------------------          |    |
        | |                                          |    |   
   Login| |"JWT_TOKEN RESPONSE"                      |    |   
        | |                                          |    |   
    --------------   enviroment file                ------------   
    |            |----------------------------------|          |
    | Main Server|                                  |          |
    |            |                                  |JWT_SECRET|    
    --------------                                  |="secret" |          
                                                    ------------

Answer 1

While your solution will certainly work. It could make writing the browser/mobile/general frontend part of your application more complex. And possibly slower.

For example you might end up effectively JOINing data in the frontend. You make one request to service A, then use the information returned there to make additional requests to service B. This is a bad experience for the user.

Once new concept that companies like Netflix and Soundcloud are pioneering is the backend for frontend pattern. Which is a server side adaptor for each type of frontend device that can handle authentication and aggregate the connections to the down stream services.