-1

I have two services:

UserManagement service (U service, also an OAuth2 Authorization server)

and 

FileManagement service (F service).

I currently use password flow to secure the communications among all services. Users use their user name and password get a token from U service then use this token to get File from F service.

Now a new situation is coming:

when a new user create a new account via U service, U service will send request to F service to create a user's folder. However, during registering process, there is no token can be used to access F service.

In this case should I use multi-mixed flow?

Any suggestion would be great appreciated.

Lang
  • 943
  • 13
  • 33
  • Why not look at https://stackoverflow.com/questions/31687442/where-do-i-need-to-use-jwt – Asons Nov 09 '18 at 19:54
  • @LGSon I'm using oauth2 with JWT. but I think my qutestion is more generic. – Lang Nov 12 '18 at 09:13
  • Generic questions like _"Should I use..."_ are off topic at SO being primarily opinion-based. – Asons Nov 12 '18 at 09:17
  • @LGSon did you really read my question? – Lang Nov 12 '18 at 12:06
  • Yes, it says _"In this case should I use multi-mixed flow?"_ ... which, as I already stated, is either opinion-based or too broad, where both is off topic here at SO. You need to narrow it down. – Asons Nov 12 '18 at 13:08
  • @LGSon Thanks . – Lang Nov 12 '18 at 15:33
  • A reflection though, assuming the users doesn't go through the "U service" to access the "F service", it should be pretty simple to allow for the "U service" and its _httpclient_ to have enough rights when setting up a new user, so I can't actually see the problem here. I mean, since this goes on _server-to-server_, and IP surely is fixed, a client access from a given IP should security wise be enough to create a user folder. – Asons Nov 12 '18 at 15:48

1 Answers1

1

You can have a flag isFirstTimeLogin, if true when the user is logged in on U service for the first time you send the request to F service with the token generated (but I don't know if the creation of the folder in F service will take long or not).

Or when the user register on your U service once it's registered you call the login method to generate a token then you can send the token to F service.

I hope this will help you. :)

Max
  • 794
  • 3
  • 7
  • Thanks for the suggestion! But if in the future, we need more communication between services, it is not a good thing to add so may flags. Do have any more generic idea? – Lang Nov 09 '18 at 15:17
  • If you want your U service to generate a token once a user is registered inside your U service and like this it's use for every services existing, you need to implement the generation of the token inside the Register method, just copy the logic inside the login method into the register method. – Max Nov 12 '18 at 08:17
  • 1
    Many thanks for your suggestion. If there is no other better suggestion, I will take this as my answer. I will consider more about my question. Thanks! – Lang Nov 12 '18 at 15:32