Stand alone OAUTH2 server communication with resource API servers

Question

Given that I would create an OAUTH2 authentication server. Given that I would to have separate resource servers, exposing REST APIs.

What are the best communication practies between the authentication server and the API servers?

To explain OAUTH2 server would be a proxy authenticating the user and forwarding requests to different API servers, that are not third party, but under the hood of the OAUTH2 proxy, relying on it to know the agent (user) requesting for the given command\\query.

The simplest would be that the authentication server will forward the user id (that is stored with ACL rules also on each API server) under a secure connection, and that access would be restricted to request forwarded from authetication server to resource API servers. The auth server would in this case forward the user id, but this seems suceptible to mand in the middle attack (altought firewall on API servers would be configured to accept requests only from the authentication server). Another problem would be compromission of the OAUTH proxy, giving automaticly grant to any request coming from it.

Are there ready solution and patterns to deal with this scenario? Thanks!

Answer 1

Check the User Account and Authentication Service (UAA) from CloudFoundry. Maybe will help you. It is also available as a stand-alone OAuth2 server. API Documentation , GitHub