A single sign on authentication in golang
<p>I am trying to build a multi-tenant architecture in <code>golang</code> where there will be different services like <code>Service-A</code> and <code>Service-B</code> each service will run on a different server and I want the user to have a <code>single sign-in</code>  solution and get authenticated in all the services offered. </p>

<p>Just like what <code>Amazon AWS or Google</code> does like it has many different services like <code>Amazon Cloud Front</code>, <code>Amazon EC2</code>, <code>Amazon S3</code> and all services are authenticated through a single login and logout from one service result in<code>log out from all connected services</code>.</p>

<p>I am trying to implement this in <code>golang</code>, so far I found out <code>Open-id Connect</code> <a href="https://github.com/coreos/dex" rel="nofollow">coreos/dex</a> 
but it lacks docs explaining its API and Architecture.</p>

<p><strong>What would be the best architecture to design such authentication system?</strong></p>

<p>I think using <code>JWT token</code> I can achieve it. <code>Is this architecture will be secure or there any better solution for this</code>?</p>

<blockquote>
  <p>My Approach</p>
</blockquote>

<pre><code>                          -----------------        
                          |               |    shared
                          |               |   env file
                          |SERVICES A     |---------------|       
           AUTH HEADER    |               |               |
           JWT TOKEN      |               |               |
        |---------------&gt; -----------------               |                     
    ---------            ------------------   shared      |
    |       |            |    SERVICE B   |  env file     |                    
    |Login  | -----------|                |-----------    |               
    |Browser|            |                |          |    |  
    ---------            ------------------          |    |
        | |                                          |    |   
   Login| |"JWT_TOKEN RESPONSE"                      |    |   
        | |                                          |    |   
    --------------   enviroment file                ------------   
    |            |----------------------------------|          |
    | Main Server|                                  |          |
    |            |                                  |JWT_SECRET|    
    --------------                                  |="secret" |          
                                                    ------------
</code></pre>