A presentation about securing a microservice system delivered at FullStack Toronto 2017 conference.

1. 2015 Programming Layer
Authentication in Microservice
Systems
Dejan Glozic, Senior Technical Staff Member
IBM Watson Data Platform

2. About Me
IBM Canada Toronto Lab
Senior Technical Staff Member
IBM Watson Data Platform
@dglozic
http://dejanglozic.com

3. Part 1
Setting the stage

4. Broccoli of topics
You know it is good for you, but you would rather eat
(React) ice cream.

5. Securing a single-page app
1. Secure UI endpoints
2. That’s it

6. Securing a microservice system
1. Secure each micro frontend
2. Secure each REST API micro service
3. Secure async messaging flows
4. Don’t affect performance
5. Don’t leak micro service architecture to the user

7. Microservice grid
UI domain
API domain
Legacy
systems
Proxy
Events
UIAPI
Message
Broker Backend
Frontend

8. Disclaimer
I do not intend to teach you OAuth2 or JWT or JWK.
You can Google without my help.

9. Part 2
Building up the vocabulary

10. OAuth2 (RFC 6749)
• Industry-standard protocol for authorization
• Supersedes the work done on the original
OAuth protocol created in 2006
• Multiple flows (‘grants’)
• Clients are issued ID and Secret

11. Bearer Tokens (RFC 6750)
• Sent to downstream REST APIs via Authorization header
• Can be opaque or JWT
• Provides for session-less APIs

12. JWT (RFC 7519)
• JSON Web Token
• Encoded, digitally signed, self-describing
• Can be validated programmatically

13. JWK (RF 7517)
• JSON Web Keys
• Provides for asymmetric signing of JWT
• Thou shalt never useth symmetric signing (promise!)

14. Part 3
Authentication in micro frontends

15. Identity provider
• Assists with OAuth2 authorization_code grant
• Challenges with user and password
• Optionally provides 2-factor auth
• Optionally federates with other systems using SAML
• Mints bearer tokens from authorization codes

16. #1 article at dejanglozic.com

17. UI authentication flow
Load balancer
OAuth2
(Passport)
Session
Cache
(Redis)
Identity
Provider
Session cookie
Bearer token
UI
API

18. Leader/follower patternTM
OAuth2
(Passport)
Session
Cache
(Redis)
Identity
Provider
Load balancer Load balancer Load balancer Load balancer
Leader Follower Follower Follower
login

19. Synchronizing leaders
OAuth2
(Passport)
Session
Cache
(Redis)
Identity
Provider
Load balancer
Leader
Load balancer
Leader
Session
Cache
(Redis)
Login Sync Cookie

20. UI endpoint middleware
router.use(“/mypath", authHandler.checkAuth, mypathController);
• Redirects to login if not authenticated
• Synchronizes with other leaders
• Refreshes bearer token if expired

21. XHR endpoint middleware
router.use(“/api/myXHRpath”,
authHandler.checkXHR, myXHRpathController);
• Refreshes bearer token if expired
• If not logged in, returns 511
• Client code needs to catch 511 and reload

22. Part 4
Authentication in REST API micro services

23. Bearer token validation
Load balancer
DB
Bearer token
JWKS

24. Worth repeating
Thou shalt never useth symmetric JWT signage

25. Part 5
Authentication with asynchronous messages

26. Message broker path
Message
Broker
Queue
Load balancer
DB
Bearer token
No token!!

27. Help Jared calm down
• client_credentials grant
• Personal access tokens
• Service API keys + whitelists

28. Web Socket path
Message
Broker
Queue
Load balancer
NoSQL
DB
UI
Web Sockets
No token!!

29. Help Heath… well, something
• All the same stuff as with Message
Brokers, plus…
• Use the same session ID as Express
• express-socket.io-session

30. Conclusion
Do you have any ice cream?

31. Securing a microservice system
1. Secure each micro frontend
2. Secure each REST API micro service
3. Secure async messaging flows (MQ and web sockets)
4. Don’t affect performance
5. Don’t leak micro service architecture to the user

32. Q/A

33. Thank you!
Follow me on Twitter: @dglozic
Read my blog: dejanglozic.com
IBM Watson Data Platform