I am currently learning microservices architecture. I got to know that you can use JWT, Oauth and bunch of other mechanisms to secure microservices but one thing that confuses me is that how do they communicate with each other and how can user access other service when he is authenticated by other service?
For example I have an Inventory Service (a), an accounts service (b) and login service (c).
-
User logins using service C. He is provided with a token now when he tries to access inventory service how it will validates the token? Jwt is signed with a private key. Do microservice C and A have same private key?
-
Inventory Service is communicating with accounts service using any message broker or through a webclient (direct communication no msg broker), will that send jwt token to accounts service?
-
Login service is communicating with User Service for fetching user details. How it will communicate with User Service? Since the user is trying to login, he does not have any jwt token yet.