title: How an authorization service implements ownership checks in a role-based microservice architecture
body: <p>Let's say I have three types of users on a blogging app</p>
  
  <ol>
  <li><strong>Author</strong> (is able to modify their own posts but not others)</li>
  <li><strong>Administrator</strong> (is able to modify all posts)</li>
  <li><strong>Reader</strong> (can not modify any posts)</li>
  </ol>
  
  <p>To manage this system I want to have three main services: </p>
  
  <ul>
  <li>An <strong>API Gateway</strong> that exposes all the APIs clients will consume, composing services as needed. </li>
  <li>A <strong>Post Management Service</strong> which provides the CRUD operations for blog posts (including the data of who owns what posts)</li>
  <li>An <strong>Authorization Service</strong> which stores roles and permissions, exposing an API which takes in an array of roles (the roles a requesting user has) and an array of permissions (the permissions needed to access an API) and determines if those inputted roles cover all the permissions inputted. </li>
  </ul>
  
  <p>Now what I am struggling with is ownership of a resource (and where ownership should be checked).</p>
  
  <p>Without communicating with other services how would an authorization service determine if a user should be able to access something they own without knowing how to determine if a user owns a given resource. </p>
  
  <p>I've come up with a few different solutions to this problem, although I'm not quite happy with any of them. </p>
  
  <ol>
  <li>The API Gateway would query a different service that manages the posts to determine if a requesting user owns the post they are trying to access, this would mean there is authorization logic that happens outside of the authorization service.</li>
  <li>The service managing blog posts would handle authorization based on ownership, this would also mean authorization logic is happening outside the authorization service as well as the fact that unauthorized requests are being marked as authorized initially (since they will still pass through the authorization service)</li>
  <li>The Authorization service could be given the knowledge of how to check ownership, the API would have to be able to be told whether or not it should check for ownership along with the permissions. This would add complexity to the authorization service and increase the cross-service communication which I'd like to relegate as much as possible to the API gateway since it should be the primary service composer. </li>
  </ol>
  
  <p>Looking for ideas on alternative methods or insight into what the best solution to this problem might be.</p>