Both approaches are viable, and under different circumstances could be considered the best approach.

If for example, you use a domain account for the login, the user login and pw are stored in a central location (domain controller) and on each user database, you store a tokin that maps to the central database.

The opposite approach could also be the best, depending on your needs, and the business expectations.

Both have pros and cons. Both are viable.