Relying party server with microservice?

[Sovannak22]

I'm building webauth with microservice I want to know which one is best practice since I have 5 service one for registration process and other four for verification. Should I implement relying party for one service and use internal request with payload to that service or should I implement relying party for every service?

[emlun]

Hi! I'm afraid I can't give you a simple answer since that would depend entirely on the application. The library is intended to support both architectures: it has no internal mutable state (except in builders, which should be short-lived), so it's easy to replicate the same setup on multiple service instances if you need to. Assuming you have a way to synchronize your other application state, it should be easy to also use that for the (external) ceremony state needed for the RelyingParty.finish* methods. The library doesn't care if you keep the state inside a single JVM instance or replicate it via REST APIs or similar.

[Sovannak22]

Thank @emlun I planning to implement relying party to all service too. And pass only the require data for the process. I want to check if any concern if I implement like this.