Sure, it works... you can do it. But wow on the headaches you're going to get down the line and the volume of HTTP chatter.
You generally end up adding the ability for servers to impersonate other users, so that a server process speaks to an OAuth authority to determine whether it is allowed to generate a user token and perform some task in their name.
All kinds of hell lies that way.
Maybe there's someone from the BBC here? They have a nice system using server certificates. Every application runs in it's own user process and identity, and every user is authenticated by certificates. The different servers have knowledge of who is allowed to do what, and users (applications) that try things they're not allowed get refused and reported.
I don't know the nitty gritty of their system, but the gist is "certificates everywhere", it's proven and it works.
Sure, it works... you can do it. But wow on the headaches you're going to get down the line and the volume of HTTP chatter.
You generally end up adding the ability for servers to impersonate other users, so that a server process speaks to an OAuth authority to determine whether it is allowed to generate a user token and perform some task in their name.
All kinds of hell lies that way.
Maybe there's someone from the BBC here? They have a nice system using server certificates. Every application runs in it's own user process and identity, and every user is authenticated by certificates. The different servers have knowledge of who is allowed to do what, and users (applications) that try things they're not allowed get refused and reported.
I don't know the nitty gritty of their system, but the gist is "certificates everywhere", it's proven and it works.