title: OpenID architectural pattern advice
body: <p>I open this thread because I need both theoretical and practical support (I must say that I am quite ignorant) about authentication and authorization processes for web applications.</p>
  
  <p>I developed a simple web application using Angular6 for the frontend and Java for creating the REST services that interact with the frontend.
  In detail the frontend is exposed through Apache2 Web Server and the webapp is deployed in Tomcat8 (exposed with the reverse proxy).
  Having said that I would like to insert into architecture:
  a token-based authentication and authorization process
  an API Manager system for managing the Rest APIs and related tokens</p>
  
  <p>Searching on Google I understood that OpenID is the right protocol and the basic architecture that I should set is the one described here (<a href="https://cloud.google.com/blog/products/api-management/identity-propagation-in-an-api-gateway-architecture" rel="nofollow noreferrer">https://cloud.google.com/blog/products/api-management/identity-propagation-in-an-api-gateway-architecture</a>).</p>
  
  <p>Studying all the available open-source technologies, I identified WSO2 providing both an API Manager and an Identity Server.
  I would like to have support from the community both to understand what the correct architectural and communication pattern is and if there is a guide to do this with Apache2 + WSO2 products + Tomcat.
  Thanks in advance to everyone.</p>