Our System Series: JWT Tokens. Identity, Context, and Permissions
Previous: Event Processing Every request in a microservice system needs context. A service needs to know who is making the request, which project the request belongs to, which account is being used, and what the caller is allowed to do. In our system, this context is carried by JWT access tokens. A token is created after a successful login and then passed to the services involved in the request.…
Our system utilizes JSON Web Tokens (JWT) for identity, context, and permissions in microservice-based applications. Upon successful login, a user receives an access token containing their identity and relevant context data. This token is passed to various services involved in the request, allowing them to identify the caller and evaluate their access permissions.
The authentication process involves verifying a user's login credentials, checking for password restoration or change requirements, and determining the user's relationships within the system. These relationships include projects, accounts, organizations, groups, and permissions. The access token is a signed JWT with a sub object representing the user's security context and additional fields such as user_id, profile_id, project_id, account_id, permissions, groups, and organizations.
Upon login, the User Profiles Service resolves the user's relationships by verifying project-user and account-user links, as well as project-account links. This determines the organizations to which the user belongs within the project and account. The service then constructs the context by retrieving the relevant organizations and permissions for the user. Permissions are obtained from the Permissions Service and added to the JWT under the corresponding service name, while groups provide additional authorization context.
The token payload may include selected user and profile details, such as user information, account flags, abbreviated profile data, and the Bearer token itself. Upon subsequent service calls, the token is used to identify the caller and evaluate access permissions. The API response also returns the selected user and profile information along with the token.
The token's project and account information is not directly copied from request headers but is resolved by the User Profiles Service before being placed into the token. The service verifies the user's connection to the current project and account through project-user and account-user links, and retrieves the applicable organizations. The graph-like model of connections between users, projects, accounts, and organizations is used to construct the authorization context in which the user can act.
The JWT uses RS256, an RSA signature algorithm based on SHA-256. The private key signs the tokens, while services use the corresponding public key to verify them. The token contains time-based claims, iat (issued at) and exp (expiration time), which record when the token was created and when it stops being accepted. FastAPI's OAuth2PasswordBearer dependency extracts the Bearer token from the request, verifies it with the public key, and loads the current user record from the registry.
Invalid, expired, malformed, or userless tokens result in application-specific authorization errors.
The token lifetime can vary depending on the flow. By default, access tokens have a five-minute duration for focused actions like password restoration. For longer-lifetime tokens, a scope-based mode can be used, allowing for infinite lifetimes. The resulting token contains only the permissions already assigned to the user, ensuring that the authorized user's capabilities are accurately represented.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
