Microservices: Centralized Authorization vs Authorization in each service
<p>Let's say I have a Microservices system built with an API Gateway.  </p>

<p>Every request after coming through the Gateway have to be pre-authenticated by an Authentication Service (The Firewall pattern)  </p>

<p><a href="https://i.stack.imgur.com/DySBr.png" rel="noreferrer"><img src="https://i.stack.imgur.com/DySBr.png" alt="Firewall Pattern"></a>  </p>

<p>But how about Authorization? For instance, I have 3 models and 3 services according to them in a <em>Hotel Management</em> system:  </p>

<p><strong>User</strong>  </p>

<ul>
<li>each user can have many hotels  </li>
</ul>

<p><strong>Hotel</strong>  </p>

<ul>
<li>a hotel is owned by a single user (owner)  </li>
<li>each hotel can have many employees (also a user)  </li>
<li>a hotel can have many rooms</li>
<li>for the sake of simplicity let's pretend that an employee have the same rights as the owner over a hotel  </li>
</ul>

<p><strong>Room</strong>  </p>

<ul>
<li>a room can only belong to a single hotel</li>
<li>owner and employees can only edit rooms in hotels that they owned/employed at</li>
</ul>

<p>An example request to edit a room <strong>Y</strong>, after being authenticated it will have a verified claim that state something like <strong>'I am user X'</strong>.  </p>

<p>To know whether <strong>X</strong> has the right to edit over <strong>Y</strong> I have to make requests to Hotel Service asking "Does <strong>Y</strong>'s Hotel associated with (owned by/employing) <strong>X</strong>?".  </p>

<p>The question is: <strong>Where do I make these requests?</strong><br>
Have the Gateway ask the <em>Hotel Service</em> before forwarding client request to <em>Room Service</em>, or let the <em>Room Service</em> ask the <em>Hotel Service</em> by itself. When to choose one over another ? What's the benefit ?</p>

<hr>

<p>Also, this modeling seems kinda wrong to me. All these relations laying around Microservices just make my system really complicated. As it grows it becomes harder for me to visualize the workflow between services. Is there a solution to this problem? A centralized relationship service that utilizes graph database like Neo4j perhaps?</p>