Authentication strategy in micro-service system

Software security itself is a very complex problem, because every service in a microservices system has to deal with security issues, so it is more complex in a microservices scenario. David Borsos a speech on the topic at the recent London MicroServices Conference and evaluated four authentication schemes for micro-service systems.

In a traditional monolithic architecture, a single service saves all user data, verifies the user, and creates an HTTP session after the authentication succeeds. In a microservices architecture, a user interacts with a collection of services, and each service may need to know who the user is requesting. A simple solution is to apply the same pattern in a microservices system to a single system, but the problem is how to get all the services to access the user's data. There are two ways to solve this problem: if you use a shared user database, updating the database tables becomes a challenge because all services must be upgraded at the same time to be able to interface with the modified table structure, and if a user is already authenticated when the same data is distributed to all services, how to make each service aware of the state is a problem.

Borsos points out that a single sign-on (SSO) scenario may seem like a good idea, but this means that each user-facing service must interact with the authentication service, which generates a lot of very trivial network traffic, and the solution is quite complex to implement. In other respects, the choice of SSO scheme security is good, and the user logon state is opaque, which prevents an attacker from inferring any useful information from the state.

Distributed session scheme, the principle is to store information about user authentication in the shared storage, and usually by the user session as a key to implement a simple distributed hash map. When a user accesses a microservices, the user data can be obtained from the shared storage. Another advantage of the solution is that the user logon state is opaque. When using a distributed database, it is also a highly available and scalable solution. The disadvantage of this scenario is that shared storage requires a certain protection mechanism and therefore needs to be accessed through secure links, where the implementation of the solution is often quite complex.

The client token scheme, which is generated by the client, signed by the authentication service, and must contain enough information so that the user identity can be established in all microservices. Tokens are attached to each request, providing user authentication for the microservices. The security of this solution is relatively good, but authentication logoff is a big problem, and the way to mitigate this is to use short-term tokens and frequent check authentication services. For the encoding scheme of the client token, Borsos prefers to use the JSON Web Tokens (JWT), which is simple enough and the library supports it better.

The client token is combined with the API gateway, which means that all requests pass through the gateway, effectively hiding the microservices. When requested, the gateway converts the original user token to an internal session ID token. In this case, logoff is not an issue, because the gateway can revoke the user's token at logoff. Although the library is well supported, it can be complex to implement.

Borsos recommends using a combination of client tokens (using JWT) and API gateways, because this scenario is usually easier to use and performs well. While the SSO scenario satisfies the requirements, he believes that it should be avoided. This scheme is also interesting if the relevant technology required by the distributed session scheme has been applied to your scene. He also stressed the importance of write-offs when choosing a solution.

Next year's London MicroServices conference is scheduled to take place on November 6, 2017-7th.

View English Original: Authentication strategies in MicroServices Systems

Thank rate for the review of this article.

Http://www.infoq.com/cn/news/2016/12/microservices-authentication

Authentication strategy in micro-service system