In our enterprise windows network, we have a JS single page application that accesses multiple webservices in different windows subdomains to provide summarized results for the end user. Previously, we used kerberos with domain trusts which was a bit cumbersome. However, the first service switched to OAuth and, after some initial challenges, it worked well. Only one of these services is developed by our team, while the others are from different parts of the company and are not specifically created for our use.
Now, the second service is planning to make the switch to OAuth with its own clientID and different grants. We are unsure how to manage obtaining multiple tokens without having to redirect to our ADFS for each service.
Since the client is running in a location where all services are accessible, we cannot call the other services from our backend via an "On-Behalf-Of" flow.
As far as I know, for Single Page Applications, it is recommended to use the authorization grant workflow with PKCE, which may limit our options.
Dealing with this kind of situation may be common with microservices, but I have not come across clear best practices for it. Should we set up an API gateway in our client subnet with an OBO flow to avoid multiple redirects, or can the client handle this in a more user-friendly manner?