Inter-service Communication

Details on Feign, OAuth2, and Kafka event flows between Arya Banking services.

Communication Strategies

Arya Banking utilizes three primary communication patterns to ensure scalability, security, and loose coupling.


1. Synchronous Feign (REST)

Internal service-to-service calls are handled by OpenFeign. To secure these calls, we use the OAuth2 Client Credentials grant.

Machine-to-Machine (M2M) Flow

  1. Source Service (e.g., Auth Service) triggers a Feign call.
  2. OAuth2 Interceptor requests a machine-to-machine JWT from Keycloak using its own client-id and client-secret.
  3. Keycloak returns a JWT with ROLE_INTERNAL_SERVICE.
  4. Source Service injects Authorization: Bearer <JWT> into the outgoing request.
  5. Target Service (e.g., User Service) validates the JWT and verifies the role.

Implementation Pattern

Java code-highlight
// OAuth2FeignConfig (Common Library pattern)
@Bean
public RequestInterceptor oauth2RequestInterceptor() {
    return requestTemplate -> {
        OAuth2AuthorizeRequest request = OAuth2AuthorizeRequest
            .withClientRegistrationId(clientRegistrationId).build();
        OAuth2AuthorizedClient client = authorizedClientManager.authorize(request);
        requestTemplate.header("Authorization", "Bearer " + client.getAccessToken().getTokenValue());
    };
}

2. API Flow Deep-Dive

User Registration Sync

When a user registers, the flow spans two services:

Account Locking (Login Failures)

When login fails multiple times, the Auth Service signals the User Service:


3. Asynchronous Events (Kafka)

State changes are propagated asynchronously using Apache Kafka and Avro Schemas.

Primary Topic: user.create.event

Published by: user-service.

Event PhaseStatus Payload
Step 1 CompleteBASIC_DETAILS_ADDITION_COMPLETED
Step 2 CompleteADDRESS_ADDED
Step 3 CompleteSECURITY_CREDENTIALS_ADDED
Account LockedBLOCKED

Producer Logic (UserCreateProducer)

The UserCreateProducer in the User Service uses a typed KafkaTemplate to send Avro-encoded records. These records ensure schema compatibility across the platform.

Java code-highlight
// Example usage in UserServiceImpl
userCreateProducer.sendUserCreateEvent(
    UserCreateEvent.newBuilder()
        .setUserId(user.getUserId())
        .setStatus(RegistrationConstants.BASIC_DETAILS_ADDED.getSubStatus())
        .build()
);

4. Port & Path Mapping Reference

SourceDestinationPathPurpose
User ServiceAuth Service/internal/api/auth/register/usersSync registration to Keycloak
Auth ServiceUser Service/internal/api/security-details/{id}Track login failures
Admin ServiceKeycloak/admin/realms/{realm}/rolesProvision RBAC roles
Admin ServiceVault/v1/auth/approle/roleProvision service secrets
Internal endpoints (marked with /internal/) are protected by ROLE_INTERNAL_SERVICE and are not accessible through the API Gateway by default.