title: Permission validation by external API
body: <p>Given an ASP.NET Core 3.1 webapi project, that hosts an IdentityServer that generates tokens;
  We also have a backend microservices cluster, with a gateway in front (Ocelot).
  The gateway validates the token. This is purely authentication, not authorization.</p>
  
  <p>Since we're a multi-tenant app, where each tenant can have multiple departments, and assign users to departments, with certain roles/permissions etc, it can get pretty complex. 
  We first took the attempt to store all permissions/roles for a user in claims. But this requires us to list ALL permissions for an assigned role in the claims, which causes the claims to be too big.</p>
  
  <p>Hence we are thinking, to do the validation of the requested permission externally, where our gateway/microservice calls the endpoint on our identityserver, and validates if given user has the required permission. 
  There are two (or more) approaches to this;
  - First, we are thinking of providing an endpoint that exposes ALL roles + permissions + tenants + departments this user has access to. If a tenant has its own roles with permissions, it will also be returned. This will be cached in Redis on the calling side (gateway) to not too frequently call this external service (well, redis is also external..) too much. We can then, using our existing authorizationpolicyproviders easily validate the access the user has
  - Second, we can just write a middleware/new auth handler, that for a given permission, user, dept and tenant, calls the identity server API which basically returns an ok or not OK. This could be cached as well.</p>
  
  <p>The only thing I'm a bit afraid of is the added delay on each HTTP request, because suddenly you're calling an external service... And then, if this would be best put in the middleware, a custom auth handler, ...</p>
  
  <p>Thanks!</p>