Authentication in microservice systems - fsto 2017
0 likes89 views
This document discusses authentication in microservice systems. It begins by setting the stage and introducing relevant topics. It then builds vocabulary around OAuth2, bearer tokens, JWT, and JWK. It describes authenticating micro frontends using an identity provider, leader/follower pattern, and endpoint middleware. It covers authenticating REST API microservices using bearer token validation. Finally, it addresses authenticating asynchronous messages using client credentials grants and session IDs across message brokers and web sockets. The conclusion summarizes that securing a microservice system involves securing each micro frontend, REST API, and asynchronous flow while maintaining performance and architecture abstraction.
Authentication in microservice systems - fsto 2017
- 1. 2015 Programming Layer Authentication in Microservice Systems Dejan Glozic, Senior Technical StaïŹ Member IBM Watson Data Platform
- 2. About Me IBM Canada Toronto Lab Senior Technical Staff Member IBM Watson Data Platform @dglozic http://dejanglozic.com
- 3. Part 1 Setting the stage
- 4. Broccoli of topics You know it is good for you, but you would rather eat (React) ice cream.
- 5. Securing a single-page app 1. Secure UI endpoints 2. Thatâs it
- 6. Securing a microservice system 1. Secure each micro frontend 2. Secure each REST API micro service 3. Secure async messaging ïŹows 4. Donât affect performance 5. Donât leak micro service architecture to the user
- 7. Microservice grid UI domain API domain Legacy systems Proxy Events UIAPI Messageâš Broker Backend Frontend
- 8. Disclaimer I do not intend to teach you OAuth2 or JWT or JWK. You can Google without my help.
- 9. Part 2 Building up the vocabulary
- 10. OAuth2 (RFC 6749) âą Industry-standard protocol for authorization âą Supersedes the work done on the original OAuth protocol created in 2006 âą Multiple ïŹows (âgrantsâ) âą Clients are issued ID and Secret
- 11. Bearer Tokens (RFC 6750) âą Sent to downstream REST APIs via Authorization header âą Can be opaque or JWT âą Provides for session-less APIs
- 12. JWT (RFC 7519) âą JSON Web Token âą Encoded, digitally signed, self-describing âą Can be validated programmatically
- 13. JWK (RF 7517) âą JSON Web Keys âą Provides for asymmetric signing of JWT âą Thou shalt never useth symmetric signing (promise!)
- 14. Part 3 Authentication in micro frontends
- 15. Identity provider âą Assists with OAuth2 authorization_code grant âą Challenges with user and password âą Optionally provides 2-factor auth âą Optionally federates with other systems using SAML âą Mints bearer tokens from authorization codes
- 16. #1 article at dejanglozic.com
- 17. UI authentication ïŹow Load balancer OAuth2âš (Passport) Session Cache (Redis) Identity Provider Session cookie Bearer token UI API
- 18. Leader/follower patternTM OAuth2âš (Passport) Session Cache (Redis) Identity Provider Load balancer Load balancer Load balancer Load balancer Leader Follower Follower Follower login
- 19. Synchronizing leaders OAuth2âš (Passport) Session Cache (Redis) Identity Provider Load balancer Leader Load balancer Leader Session Cache (Redis) Login Sync Cookie
- 20. UI endpoint middleware router.use(â/mypath", authHandler.checkAuth, mypathController); âą Redirects to login if not authenticated âą Synchronizes with other leaders âą Refreshes bearer token if expired
- 21. XHR endpoint middleware router.use(â/api/myXHRpathâ,âš authHandler.checkXHR, myXHRpathController); âą Refreshes bearer token if expired âą If not logged in, returns 511 âą Client code needs to catch 511 and reload
- 22. Part 4 Authentication in REST API micro services
- 23. Bearer token validation Load balancer DB Bearer token JWKS
- 24. Worth repeating Thou shalt never useth symmetric JWT signage
- 25. Part 5 Authentication with asynchronous messages
- 26. Message broker path Messageâš Broker Queue Load balancer DB Bearer token No token!!
- 27. Help Jared calm down âą client_credentials grant âą Personal access tokens âą Service API keys + whitelists
- 28. Web Socket path Message Broker Queue Load balancer NoSQL DB UI Web Sockets No token!!
- 29. Help Heath⊠well, something ⹠All the same stuff as with Message Brokers, plus⊠⹠Use the same session ID as Express ⹠express-socket.io-session
- 30. Conclusion Do you have any ice cream?
- 31. Securing a microservice system 1. Secure each micro frontend 2. Secure each REST API micro service 3. Secure async messaging ïŹows (MQ and web sockets) 4. Donât affect performance 5. Donât leak micro service architecture to the user
- 32. Q/A
- 33. Thank you! Follow me on Twitter: @dglozic Read my blog: dejanglozic.com IBM Watson Data Platform