title: Single Sign-On in Microservice Architecture
body: <p>I'm trying to design a green-field project that will have several services (serving data) and web-applications (serving HTML). I've read about microservices and they look like good fit.</p>
  
  <p>The problem I still have is how to implement SSO. I want the user to authenticate once and have access to all the different services and applications.</p>
  
  <p>I can think of several approaches:</p>
  
  <ol>
  <li><p>Add Identity service and application. Any service that has protected resources will talk to the Identity service to make sure the credentials it has are valid. If they are not it will redirect the user for authentication.</p></li>
  <li><p>Use a web-standard such as OpenID and have each service handle it own identities. This means the user will have to authorize individually each service/application but after that it will be SSO.</p></li>
  </ol>
  
  <p>I'll be happy to hear other ideas. If a specific PaaS (such as Heroku) has a proprietary solution that would also be acceptable.</p>