So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards.Overview (TL;DR)Our company is building a new product (Product P) and we want to unify authentication for its API with a recently re-written product (Product A) that uses a legacy database. Product A was re-written to use oAuth 2 for authentication and right now this works great but I'm having a difficult time visualizing how to bridge these two systems because of the requirements the legacy database imposes on what an authenticated entity can be in Product A.Product AAn Authenticated Entity is a User and authenticates using username/password.A User belongs to a Company.A Company can authenticate using an api key but internally the key is just associated with a dummy User that belongs to that Company with a certain set of permissions.Authentication is done with Resource Owner Credential Grants, either password grant (user/pass) or apikey grant.User and Company tables are stored in one database alongside the rest of Product A's data (IE not separate databases, can't easily refactor app to change this)Product BAuthenticated Entity has not been decided on yetUsage is not exclusive to users of Product A (IE it's an independent product) but,Companys from Product A will rely heavily on Product B's API for some core functionalityThe functionality is contextual based on the entity authenticating from Product ABasically these two products are offered independent of each other to customers BUT will depend on each other's APIs for some core functionality -- and the functionality is contextual based on who is authenticating. So the main questions I've been wrestling with:How do I unify these two systems under one Authenticated Entity?This is more a question of what should an AE look like? rather than how do I handle permissions? because I know I can do that with scopes.Given that I have only one identifier (name from oauth_client) that I can determine from an access token, what should the identifying information be on the Authenticated Entity so I can determine whether it's a User from Product A, a Company from Product A, or an AE from Product B?Is there a way to architect Authenticated Entity on Product B that will make bridging Product A easier?
Architecting an account system for oauth that bridges a new and legacy system
authentication;legacy;oauth2