web services - Separate User Authentication Module -

at organization, we're moving towards modular software architecture.. we're still in beginning phases, , working on user authentication (ua) module.

i'm looking information on best practices in terms of user authentication module.

my current notion following:

• client queries ua module login details
• ua module checks login details. if valid, ua module creates & stores access token, associating token validated user's unique id.
• the token sent client. client stores token.
• whenever client requires authentication, queries ua module token. ua module returns user's unique id if token valid, or returns error code if token invalid.

i appreciate criticism on methods.

i'm interested in knowing how deal accumulation of tokens. if user chooses log out, token removed.

my notion tokens should have expiry dates associated them, , worker process should clean these tokens @ regular interval. right way go things?

please comment! reference documents appreciated.

you can store token in db field along issue timestamp, one-to-one mapping client id. when have reissue token, overwrite old one. , when user logs out, null out token.

when user sends request token, see if token past expiry date (i.e. current time > issue time + expiry time period). save running worker clean old tokens.