I've been mulling the idea of SOA-on-heroku lately - I'm used to working with SOA where the web service is publicly exposed, and the services are all available only on the intranet.

This brings up bigger questions with regards to authentication - how does the 'api' service know that a request is coming from a correctly authenticated user? Since on heroku, the 'api' service would be externally exposed, I'm trying to decide if there's a good way to correctly authenticate/authorize in such a way that the 'api' service understands.

Thoughts?