title: OAuth2 flow from resource server to another
body: <p><strong>Implementation agnostic discussion.</strong></p>
  
  <p>Assume the following diagram.
  <a href="https://i.stack.imgur.com/YpOXj.png" rel="noreferrer"><img src="https://i.stack.imgur.com/YpOXj.png" alt="enter image description here"></a></p>
  
  <ul>
  <li>Black lines show which services are protected by the auth server.</li>
  <li>Green lines show interaction between services(Customer, and Orders services need to go through the Data service which will access the database. StandAlone service doesn't like other services)</li>
  <li>Red line show a specific request flow</li>
  <li>Data service is not exposed directly to the outside and can be accessed only by other services that are allowed to do so.</li>
  </ul>
  
  <p>I make the assumption that the client has obtained an access token when the user authenticated with the auth server. Which flow was picked(implicit, authorization code, password) is irrelevant. I would like to start the discussion from the point where the client has already obtained the access token.</p>
  
  <p>From that point on, it is clear to me what happens when the client needs to access a single resource server. </p>
  
  <ol>
  <li>Make request to resource server and pass acquired token</li>
  <li>Resource server validates the token (irrelevant how)</li>
  <li>If valid, serve request.</li>
  </ol>
  
  <p>So in that diagram if the client was to access the "StandAlone Service"(which does not talk to any other resource server) the flow is clear to me.</p>
  
  <p>I am having trouble when the client follows the red line in the diagram. So i need to access a service(resource server) which in order to reply needs to access another service(also resource server). How does the flow go in that case?</p>
  
  <p><strong>Scenario 1.</strong> </p>
  
  <ol>
  <li>The "Orders service" is setup both as a resource server and as a client. </li>
  <li>Client makes request with the access token but the "Orders service" will acquire another token with its own client credentials in order to talk to the "Data service".</li>
  </ol>
  
  <p>The problem here as i see it is that i loose the user permissions. I will execute the request to the "Data service" with the "Order's service" permissions and not the user's permissions.</p>
  
  <p><strong>Scenario 2.</strong></p>
  
  <ol>
  <li>The "Orders service" is setup only as a resource server. </li>
  <li>Client makes request with the user token and the "Orders service" will forward the same token down to the "Data service"</li>
  </ol>
  
  <p>Here i execute with the user's permissions but now i see that my "Data service" is exposed and open to any other service. (Actually i don't know if oauth2 provides such limitation. Restrict a client only to specific resource servers)</p>
  
  <p><strong>Scenario 3.</strong></p>
  
  <p>Here i see a combination of the above scenarios where the "Orders service" will provide both tokens to the data service. The user access token so that request is executed with the right permissions and the "Order's service" client access token so that i know that the service is allowed to talk to the "Data service".</p>
  
  <p><strong>Implementation</strong></p>
  
  <p>I am using spring boot and spring security in order to setup my oauth2 components seen above. I already have an auth server, a resource server and a client. The client at the moment talks to a resource server without the request being delegated to another resource server.</p>
  
  <p>Depending on the best approach how would i go on the implementation side? What changes do i need to make to my resource servers so that they can talk securely to each other?</p>
  
  <p>Thank you for your time</p>