OAuth and OpenID Connect for Microservices

Jacob Ideskog - Curity - 22/10/2014
Microservices present a new way of scaling API deployments, where each component is an island, performing a small but well defined task. These systems are quicker to develop and allow for a more agile way of working. As in most designs, security is not part of the original blueprint, which can lead to expensive and hard to manage security solutions. In this talk, Jacob Ideskog will illustrate how OAuth and OpenID Connect can be leveraged to created a unified distributed framework for Microservices. He will show how this can be used to deliver Microservices’ promise of agility and scalability while also ensuring security.

The presentation was recorded at the 2014 Platform Summit in Stockholm, Nordic APIs second annual conference.

----------

[donduke]

Good presentation. Thanks for the information

[ramireddyyerreddula]

Thanks Jacob for providing the relevant information on Authentication Protocols, It would be much helpful for me to understand the background process of Oauth authentication method and i will subscribe and willing to follow your tutorials regularly.

[-andymel]

00:00 Introduction

00:48 Traditional monolith systems and their drawbacks

01:54 The microservice way

03:00 Securing a traditional system

03:54 One way for microservices would be that every service does authentication

04:41 OAuth - Delegegation of authentication

05:39 4 actors of OAuth
- Resource Owner (user)
- Authorization Server (AS)
- Client (the app or website backend)
- Resource Server (RS)

06:03 The authentication flow

08:34 OpenID Connect

09:54 The ID-Token

12:48 Two types of tokens
- "by Value" inside of your network
- "by Reference" outside of your firewall

16:14 Now use it to secure Microservices

[kinjalbhoiwala]

quite informative. thanks for sharing it.

[jayantmishra]

thanks, good thought on token translation point

[mhsardar]

HI Jacob it was nice video anything on API?

[AjayMahajan]

How long the JWTs live, if they are cached, will they get stale when the resource permissions change.

[tamilselvansellappan]

Nice Jacob!!. I am new to microservices and API. We would like to apply the same authorization api service for other api services and Web app. In web app we are going to call the microservices. Is that possible?

[navinkaus]

Thanks for sharing the nice video, few queries: 1. In case of micro-services environment (not really for delegation), does it makes sense to create audience for each service or a single audience as all micro-services belong to one product? 2. What if it's value token, it's signed but no encrypted, what kind of threat is there especially when it's being used from native app on desktop machine.

[antonalekseyev]

Jacob Ideskog, How can the Reverse Proxy be Stateless 17:41 if it has to translate SESSION_ID to JWT?

[tehedx]

Sounds like a good idea to do, is there a project that does this? Right now I've created a simple reverse proxy myself. It accepts by-reference tokens from users, converts it to by-value tokens and passes that to the (internal) proxied service. Added a simple cache to speed up the process a bit. It works ... but I'd rather trust some well known and maintained piece of software, designed by people that know security better.

[mehrdadk.]

What happens if someone "Bad Guy" get access to access token?

[saveliybaranov]

Is there a way to do this in a stateless way, and still be relatively secure? Perhaps using the JWT as the token, but with minimal info, like a user id only? Or with encrypted info?

[abudawood_phd]

at arround 8.30 there is a mistake, the resource server could validate the access token without requesting the auth sever and for that we call jwt a stateless auth as it has same characteristics of the approach of the Passport and airport traveling scenarios. the police could verify your identity via Passport without needing to back to the Passport issuer

[bibekdas]

Hi Jacob,
I have a doubt here.How the Auth server can validate the credentails entered by RO( the user) bcoz Auth server has no idea abt the user credentails but only the RS has right?
i am in big confusion now after watching this video!!!

[hamedhatami]

In JWT by value, we have a bad experience with performance because it consumes a lot of CPUs and when you have to have microservices with more than 6000 RPS so it is time to see this pressure and bad working

[jigarsutaria]

I delegate means I authorize. Delegation can be revoked and so does the authorization.

[thorsteinssonh]

it's a little confusing, especially talking about "sessions" --- can't you do without sessions?

[jillsanluis]

Curious, if the value based jwt is inside the network to scale passing around the identity why bother encoding them in jwt? Why can't the values be passed in as plain json? Aren't you paying tax for encoding/decoding the value for no gain?

[owenzmortgage]

Why don’t you just show us the recorded screen? Only we see is people face. We want to see PPD not the face.