[adobrawy]

I will add that in the case of authentication before each service, it is important that it does not happen in the application itself, but before reaching it, which usually means either network centralization (e.g. Teleport) or authentication proxy (Traefik + forward auth + proxy, GCP identity-proxy, AWS Verified Access). It is also important to centralize the identity provider, of course, which in the times of SAML / OAuth is easily achievable even for small organizations.