Securing the application

In a microservice setup with a client-specific backend, multiple authentication strategies can be used to secure web applications. ASP.NET Core provides the required OWIN middleware components to support most of these scenarios.

Depending on the gateway and downstream services architecture, authentication/authorization can be implemented on the gateway and the user identity can be carried over to the backend services:

Figure 9.13 – Gateway Identity

Another approach would be where each service can utilize the same identity provider in a federated setup. In this setup, a dedicated Security Token Service (STS) would be used by client applications, and a trust relationship would need to be established between the STS and the app services:

Figure 9.14 – Microservice Identity

While choosing the authentication and authorization strategy, it is important to keep in mind that the identity consumer in...