Answer.

To implement an authorization and authentication layer in a distributed architecture, centralized identity management systems such as OAuth 2.0, OpenID Connect, or corporate Identity Providers (IdP) are usually applied. Authentication (establishing identity) is handled through an external provider, after which the result (usually a token) is used for authorization (granting permissions) across all services.

Typically, the scheme works like this:

1. The user authenticates through the IdP.
2. Receives an access token (for example, JWT).
3. When accessing each service, the user presents the token in the request header.
4. The service validates the token and extracts access rights from claims.

Example code for verifying a JWT token in Python using the PyJWT library:

import jwt
from jwt.exceptions import InvalidTokenError

def verify_jwt(token, public_key):
    try:
        payload = jwt.decode(token, public_key, algorithms=["RS256"])
        return payload
    except InvalidTokenError:
        return None

# example usage
user_info = verify_jwt(received_token, public_key)
if user_info:
    # access granted
    pass
else:
    # access denied
    pass

Key features:

• Centralized access control is encoded from a single source of truth (IdP, for example, Keycloak or Auth0)
• Security is achieved through tokenization and signature validation (for example, JWT)
• Support for SSO and multi-factor authentication

Trick questions.

Question: Is it mandatory to store all user rights information directly inside the JWT token?

Not necessarily. To minimize the token size, only the user id and a minimal set of rights/roles are usually included. Detailed permissions can be retrieved on demand from the server through additional requests or loaded profile claims.

Question: Are refresh tokens a mandatory element of all distributed architectures?

No, refresh tokens are only required if a long-term session is needed without re-authentication. In stateless APIs, only short-lived access tokens usually operate, while refresh logic is implemented only for web or mobile clients.

Question: Can the payload section in a JWT be encrypted?

According to the JWT standard (RFC 7519), the payload is only signed, not encrypted. Another standard — JWE (JSON Web Encryption) — is used for encryption. Otherwise, anyone with the token can read the payload (for example, through jwt.io):

import jwt
jwt.decode(token, options={"verify_signature": False})