Here are the slides for the talk, "Securing MicroService".

1. SECURINGMICRO-SERVICES

2. Majid Fatemian
R E D V E N T U R E S
@majidfn

3. TECHNOLOGY-DRIVEN
CUSTOMER ACQUISITION
SALES & MARKETING

4. TRACKING
ANALYTICS
BILLING
ORDERING
CHAT
FINE-GRAINED
TECHNOLOGY / PROTOCOL AGNOSTIC
ELASTIC, RESILIENT

5. TRACKING GEO
ROUTING
DATA
SCIENCE
RULES
ENGINE
INTERACTIVE
VOICE
RESPONSE
ORDER
BILLING
SERVICE
ABILITY
CHAT
COMPLIANCE
ANALYTICS
PHONE
NUMBER
ASSIGNMENT

6. 01011
REDVENTURES
✔ ✔
✘✔ ✘
✘

7. VS.
AUTHORIZATION
AUTHENTICATION

8. AUTHORIZATION
VERIFYING THE IDENTITY OF A USER / PROCESS
PERMITTING ACCESS / ACTION TO RESOURCES
AUTHENTICATION

9. AUTHENTICATION

10. REUSE VS. BUILD

11. AUTHENTICATION
1 ACTIVE DIRECTORY

12. ACTIVE DIRECTORY Application

13. Application
External
Internal

14. AUTHENTICATION
OKTA
1
2
ACTIVE DIRECTORY

15. ACTIVE DIRECTORY
SAM
L
Application
External
Internal

16. SAML - SECURITY ASSERTION MARKUP LANGUAGE
SERVICE PROVIDER USER IDENTITY PROVIDER
Request resource
Redirects to SSO
Identify User
SAML
Respond with requested Resource
SAML

17. <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="pfx41d8ef22-
e612-8c50-9960-1b16f15741b3" Version="2.0" ProviderName="SP test" IssueInstant="2014-07-16T23:52:45Z" Destination="http://idp.example.com/
SSOService.php" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://sp.example.com/demo1/
index.php?acs">
<saml:Issuer>http://sp.example.com/demo1/metadata.php</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#pfx41d8ef22-e612-8c50-9960-1b16f15741b3">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>yJN6cXUwQxTmMEsPesBP2NkqYFI=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>g5eM9yPnKsmmE/Kh2qS7nfK8HoF…3socPqAi2Qf97E=</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIICajCCAdOgAwIBAgIBADANBgkqhkiG9w0BAQQ…….BpspRYT+kAGiFomHop1nErV6Q==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="true"/>
<samlp:RequestedAuthnContext Comparison="exact">
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
</samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

18. ACTIVE DIRECTORY
SAM
L
SERVICE
1
SERVICE
2
SERVICE
3
SAML

19. AUTHENTICATION
OKTA
1
2
3 JWT (JSON WEB TOKEN)
ACTIVE DIRECTORY

20. ACTIVE DIRECTORY
SAM
L
+
JWT
JWT
SERVICE
1
SERVICE
2
SERVICE
3

21. JWT
Identity
Provider
SERVICE
PublicPrivate
+
JWT

22. JWT
eyJXAiiJKV1Qi.eyJ1c2VySWQi4ZjItOGZhYi1jZWYzOTAjYwYQ.-xHVTCMdoHrcZxH
Header
Payload
Signature

23. JWT - PAYLOAD
{
"email": "mfatemian@redventures.com",
"userName": "mfatemian",
"firstName": "Majid",
"lastName": "Fatemian",
"employeeID": "11520",
"jti": "7bc4561ab-b6c8e2-76b1-31a3-a9bb90fb67c",
"iat": 1487910598,
"exp": 1487953798
}

24. AUTHORIZATION

25. Read

26. AUTHORIZATION
CAN USER READ FROM ATT&T IN ANALYTICS?
CAN USER READ FROM VERIZON IN ANALYTICS?
✔
✘

27. THE PROBLEM
AD GROUPS CUSTOM
AD GROUPS
CUSTOM

28. ▸Scattered
▸Inconsistent
▸No Monitoring
▸No Centralized control

29. DESIRED SOLUTION
▸ Centralized
▸ Simple
▸ Scalable
▸ Monitoring
▸ Easily Manageable

30. EXISTING AUTHZ SOLUTIONS
SERVICE
1
SERVICE
2
SERVICE
3
SERVICE
4
SERVICE
5
SERVICE
6
AUTHORIZATION

31. +
JWT
SERVICE
1
SERVICE
2
SERVICE
3
SERVICE
4
SERVICE
5
SERVICE
6
AUTHORIZATION
1 ROUND TRIP / ACTION
EXISTING AUTHZ SOLUTIONS

32. ▸ Round-trips
▸ Roles, Groups, etc
▸ Complex

33. ▸ Round-trips
▸ Roles, Groups, etc
▸ Complex

34. SIMPLIFIED
AUTHORIZATION

35. Read

36. AREA 1
AREA 2
AREA 3
Action

37. AREASERVICE ACTION
analytics verizon write

38. SERVICE ACTIONGLOBAL
analytics writeglobal

39. Action
GLOBAL

40. AREA 1
AREA 2
AREA 3
Action
GLOBAL

41. {
"analytics": {
"write": ["verizon", "att"],
"read": ["global"]
},
"data_science": {
"report": ["att"]
}
}

42. JWT - PAYLOAD
{
"email": "mfatemian@redventures.com",
"userName": "mfatemian",
"firstName": "Majid",
"lastName": "Fatemian",
"employeeID": "11520",
"permissions":{"analytics": {"write":
["verizon","att"],"read": ["global"]},"data_science":
{"report": ["att"]}},
"jti": "7bc4561ab-b6c8e2-76b1-31a3-a9bb90fb67c",
"iat": 1487910598,
"exp": 1487953798
}

43. JWT - PAYLOAD
{
"email": "mfatemian@redventures.com",
"userName": "mfatemian",
"firstName": "Majid",
"lastName": "Fatemian",
"employeeID": "11520",
"permissions":{"analytics": {"write":
["verizon","att"],"read": ["global"]},"data_science":
{"report": ["att"]}},
"jti": "7bc4561ab-b6c8e2-76b1-31a3-a9bb90fb67c",
"iat": 1487910598,
"exp": 1487953798
}

45. HTTP 413 - REQUEST ENTITY TOO LARGE
Default
Header
8K

46. gzip | base64

47. JWT - PAYLOAD
{
"email": "mfatemian@redventures.com",
"userName": "mfatemian",
"firstName": "Majid",
"lastName": "Fatemian",
"employeeID": "11520",
"permissions": "H4sIAAmrs1gAAx3L…qAIBRF0XnLeGN",
"jti": "7bc4561ab-b6c8e2-76b1-31a3-a9bb90fb67c",
"iat": 1487910598,
"exp": 1487953798
}

48. JWT - PAYLOAD
{
"email": "mfatemian@redventures.com",
"userName": "mfatemian",
"firstName": "Majid",
"lastName": "Fatemian",
"employeeID": "11520",
"permissions": "H4sIAAmrs1gAAx3L…qAIBRF0XnLeGN",
"jti": "7bc4561ab-b6c8e2-76b1-31a3-a9bb90fb67c",
"iat": 1487910598,
"exp": 1487953798
}

49. SAML
JWT
SERVICE
1
SERVICE
2
SERVICE
3
+
JWT

50. SAML
+
JWT
+
PERMISSIONS
JWT
SERVICE
1
SERVICE
2
SERVICE
3
AUTHORIZATION
PERMISSIONS

51. + JWT
DATASCIENCE
ATT&T
READ
Y / N
{

52. ▸ Centralized
▸ Simple
▸ Scalable
▸ Monitoring
▸ Easily Manageable

53. SAML
+
JWT
+
PERMISSIONS
JWT
SERVICE
1
SERVICE
2
SERVICE
3
AUTHORIZATION
PERMISSIONS

54. SAML
+
JWT
+
PERMISSIONS
JWT
SERVICE
1
SERVICE
2
SERVICE
3
AUTHORIZATION
PERMISSIONS
MANAGEMENT

55. AUTHORIZATION SERVICE, AUTHORIZES ITSELF
+ JWT
AUTHORIZATION
DATA SCIENCE
ADD USER
Y / N
{

56. INTEGRATION

57. THE PROBLEM
AD GROUPS CUSTOM
AD GROUPS
CUSTOM

58. CLIENT LIBS
}golang
C#
JavaScript
PHP

59. IsAuthorized(JWT, "data_science", "verizon", "read")
True | False

60. TRACKING
ANALYSIS
BILLING
ORDERING SERVICE
ABILITY
GEO
CHAT
01011
R E D V E N T U R E S
DATA
SCIENCE

61. TRACKING
ANALYSIS
BILLING
ORDERING SERVICE
ABILITY
GEO
CHAT
01011
R E D V E N T U R E S
DATA
SCIENCE

62. MONITORING & ALERTING
TRACKING
ANALYSIS
BILLING
ORDERING SERVICE
ABILITY
MONITORING ALERTING
DATA
SCIENCE
LOGGING

63. ▸ Centralized
▸ Simple
▸ Scalable
▸ Monitoring
▸ Easily Manageable

64. ▸ Open source
▸ Okta dependency
FUTURE WORK

65. REUSE BUILD1
2 TOKEN BASED AUTH
3 SIMPLE ≠ INSECURE
>

66. THANK YOU!
QUESTIONS?