Preface

Modern applications implement a microservice architecture: they are a collection of microservices, i.e. independent services, which each have a small well-defined responsibility and a well-defined API exposed via. a standard communication protocol (e.g. HTTP, AMQP, TCP). The application is typically deployed as a (Kubernetes) cluster of (Docker) containers each containing a microservice. While such applications are highly testable and maintainable as a consequence of being highly modular, one question arises: how is authorization implemented in a microservice architecture? In particular, how are microservice-to-microservice requests authorized? Since the application is now decentralized, there is no longer any ambient authority that receives all requests and enforces an access control policy on them.

The goal of this lecture is to introduce you to protocols and tools for implementing access control in a microservice architecture, and to suggest a maintainable design which prevents access control checks from permeating the whole architecture.

Preparation

Access Control in the Decentralized Cloud [B] by Kevin Leffew (4 pages of text)

  • note: focus on the problems with authorization in the cloud (macaroons are "a" solution, not "the" solution).

DAC (use case: a user lets a service access a cloud-resource on their behalf)

MAC (use case: a company controls which user can do which op on which cloud-resource)

  • OAuth is DAC. What do you do for MAC? [L], by Johan Peeters (3 pages)

    • "OAuth was designed for the social media world. In that world, there are resources that are (perceived to) belong to end-users. The idea was "It’s that user that should control who has access to that", i.e. "Which (partially trusted) client can do what to my resource". This is DAC. This is very different from what businesses usually want. What businesses want, is MAC. Where we have a central entity, enforcing a centralized policy, controlling who can do what. Yet, increasingly, businesses are using a protocol that was designed to do DAC." - Johan Peeters (paraphrase), OAuth Security Workshop, 2018. (see Further Reading).

  • Protecting Microservices and APIs with ABAC, OAuth & OIDC [A] [A], by Axiomatics (6 pages)

  • Open Policy Agent (OPA)

Lecture

  • Slides [L], Video (OAuth 2.0 and OIDC, talk by Nate Barbettini at OctaDev)

  • Slides [L], Video (Open Policy Agent, talk by Torin Sandall at Styra)

Exercise

Further Reading