Spellpoint - Securing Access for Microservices
0 likes246 views
The document discusses challenges in identity and access management (IAM) within modern microservices architectures, emphasizing the need for efficient access control and security. It highlights the difference between traditional software ecosystems and agile API-based environments while addressing concerns about data confidentiality and integrity. The presentation also recommends using lightweight protocols such as OpenID Connect and OAuth for effective authentication and authorization.
Spellpoint - Securing Access for Microservices
- 1. SPELLPOINT N O R D I C I A M C O N F E R E N C E 2 0 1 8
- 2. Microservice has no finger to type with Securing Access for the non-interactive 24.5.2018 Tero Pasanen, Senior IAM Architect
- 3. Identity and Access Management (IAM)… …is needed because all data cannot be available to everyone. So how to grant and enforce right accesses efficiently …and how to ensure security.
- 4. …this holds true for the more traditional software ecosystem, but what about the modern, agile, API based architectures?
- 5. Well. Does it really matter? I mean, what matters to the end-user?
- 6. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC Monolith dusty mainframe servers Latest buzzword friendly microservices backed by blockchain audit ledgers? 21a0d5 Service 1 Service 2
- 7. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC What matters to the end-user… Correct data and trust …and probably usability too.
- 8. So are we lost in digital transformation? It’s API, it’s all open to everyone Someone will take care of it, we’ll have an API for that Where do you get the data for the access control API? Someone will take care of it, we’ll have an API for that
- 9. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC All-out API environment? Probably not. Consider consistent user rights across different types of sw ecosystems Avoid platform lock-in
- 10. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC Microservices ecosystem – Remember SOA? SOA People Process Practice Platform Existing investments? ESB API Gateway SAML OpenID Connect, Oauth, JWT SOA – Agile?
- 11. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC Microservices ecosystem puts agility in the dead center Agility & DevOps Quick to develop Easy to deploy Possibly short- lived Easily scalable
- 12. However…
- 13. There are more attack surfaces in the microservices world
- 14. So we need to authenticate and authorize Authenticate source and target API’s To ensure data confidentiality and integrity Authorize end-user actions .. in the way-way back-end systems
- 15. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC Ways to do it API Key “Do you know who I am?” OAuth (possibly with JWT) as bearer token “I’ve got a ticket to ride” MSSL (Mutual Authentication) “..and I can prove it”
- 16. Performance matters Amazon: 100ms of latency cost 1% in sales Google: extra 0.5 seconds in search page generation time dropped traffic by 20%
- 17. Looks a lot like traditional IAM
- 18. Take away With microservices we still have an end-point - service URL - to protect. Lo-and- behold - that is just what customer IAM SSO services do. Be efficient utilizing light weight protocols like OpenID Connect for authentication and OAuth for authorization. And provide access to legacy applications using the already established controls.
- 19. Copyright © Spellpoint Oy, 2000 – 2018 CONFIDENTIAL SECURING THE DIGITAL EVOLUTION