Two-way secure channels between multiple services across service groups

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory;
• the at least one processing device being configured to implement the following steps:
• providing, by a first service in a first service group, a first handshake communication with a first token to a second service in a second service group, wherein the first service obtains the first token by authenticating with an identity and access management service having a first certificate signed by a certificate authority associated with the first service group, wherein the first handshake communication between the first service and the second service succeeds in response to the second service having a second certificate signed by the certificate authority, and wherein the second service obtains a second token by authenticating with the identity and access management service having the first certificate;
• receiving, by the first service, a second handshake communication from the second service with the second token;
• and
• enabling communications between the first service and the second service over a two-way authenticated channel in response to the first service having a third certificate signed by the certificate authority.

A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:

• providing, by a first service in a first service group, a first handshake communication with a first token to a second service in a second service group, wherein the first service obtains the first token by authenticating with an identity and access management service having a first certificate signed by a certificate authority associated with the first service group, wherein the first handshake communication between the first service and the second service succeeds in response to the second service having a second certificate signed by the certificate authority, and wherein the second service obtains a second token by authenticating with the identity and access management service having the first certificate;
• receiving, by the first service, a second handshake communication from the second service with the second token;
• and
• enabling communications between the first service and the second service over a two-way authenticated channel in response to the first service having a third certificate signed by the certificate authority.