Take a look at the Microprofile JWT specifications. It provides a standard set of jwt claims: <a href="https://www.eclipse.org/community/eclipse_newsletter/2017/september/article2.php" rel="nofollow">https://www.eclipse.org/community/eclipse_newsletter/2017/se...</a>
A central server which maintain all authorization information. The client can request token to access a particular service. The service verifies the token by calling the central server and gets in response the permissions available for that token. Also, a TTLed cache on the servers.
I used to work for a company that has a solution for this exact problem: <a href="http://www.tribestream.io" rel="nofollow">http://www.tribestream.io</a> Great product and the people couldn't be a more diverse and all around good group of people.
Client certs for service to service communication.<p>Auth tokens validated by a central entity (a bunch of servers really) for user (mobile apps, etc) to service communication.