title: Microservices - User registration and login using OAuth2 and Spring Boot
body: <p>I'm using Java with Spring Boot to implement a microservices ecossystem.</p>
  
  <p>At the registration flow, I've had some thoughts on where should the User's personal information (gender, address, contact mediums, etc..) be saved.
  I mean, should it go on a Resource Server or in the Authorization Server?</p>
  
  <p>Imagine a situation where I have the microservice A that's a Authorization Server. On the other hand, I have the microservice B, that's a Resource Server.</p>
  
  <p>Now, imagine that I decided to create the user personal informations at the B microservice (Resource Server).</p>
  
  <p>Microservice A - Authorization Server exposes the following endpoints:</p>
  
  <ul>
  <li><code>POST /oauth/token</code></li>
  <li><code>POST /oauth/check_token</code></li>
  </ul>
  
  <p>Microservice B - Resource Server exposes the following endpoints:</p>
  
  <ul>
  <li><code>GET /users</code></li>
  <li><code>GET /users/{id}</code></li>
  </ul>
  
  <p>Now, I sent a <code>POST</code> request with end-user information to the <strong>Microservice A</strong> and receive a token to use on the Resource Server transactions.</p>
  
  <p>Ok, I got a token, now, I need to use it to get user's personal information n the <strong>Microservice B</strong>. To do so, I need to request send a request to <code>/users/1</code> (1 is the logged user id).</p>
  
  <p>The logged user can see only his personal informations and should not see other's personal informations. To do this protection, my token has a <code>userId</code> atribute. Having that information on the token, it's simple for the Resource Server to validate.</p>
  
  <p>In spring, would be something like this:</p>
  
  <pre><code>@GetMapping("/users/{id}")
  @PreAuthorize("#id == authentication.userId")
  public ResponseEntity&lt;Object&gt; handleGetUsersInformations(@PathVariable("id") Long id) {
      // logic and return
  }
  </code></pre>
  
  <p>Authorization Server database have the following informations:</p>
  
  <ul>
  <li>Username, roles, password;</li>
  </ul>
  
  <p>Resource Server database have the following informations:</p>
  
  <ul>
  <li>FirstName, LastName, Address, ContactMediums, Gender, etc..</li>
  </ul>
  
  <p>If I decide to follow this track, the main problem is:
  Since my Resource Server need to protect some resources based on the logged user (user id on the token) and the requested resource, the ids need to be synchronized. How do I get them synchronized in both databases? (Authorization and Resource)</p>
  
  <p>Is this the correct way? (Resource Server serving user's personal information and Authorization Server serving only user's 'login' informations)</p>