Spring Cloud Gateway for Stateless Microservice Authorization

Improving and maintaining tech agility, time to market, and application modernization is challenging as the number of microservices we own and manage grows. How do you track who uses your applications? How can you establish and enforce common policies or flows to authenticate and authorize permissible use? How can you ensure effective governance?

In this talk, we'll share the approach at TD Ameritrade to solve these cross-cutting functions in an efficient and effective way. We'll discuss why and how we decided on API Gateway using Spring Cloud Gateway; the different use cases we're solving; our implementation for authentication and authorization leveraging IDP, OAuth2, and JSON web tokens; and how we brought the whole solution together for microservices running on Pivotal Platform.
Architects and developers attending this talk will see how the API Gateway pattern can help to successfully modernize web platforms with greater tech agility and faster time to market.

Speakers: Saravanan Paramasivam; Software Engineer, TD Ameritrade; Chris Jackson; Senior Developer, TD Ameritrade; Taher Saif; Sr. Manager, TD Ameritrade

Filmed at SpringOne Platform 2019

[ChinmayaDas]

Could you please share a sample code implementation of the example of external IDP and token exchange?

[qwarlockz]

Def great vid. Thanks for the clear and clean explanations.

[khajalieubarrie]

Just those of us watching this now. Monolithic Architecture is not old school. It’s in fact should be the de-facto standard to start writing your application using a “Modular”approach until you find the need to migrate to “Microservices”.

[qinlingzhou]

JWT is one of the best choices for Microservice AuthZ per my dev experience so far.

[ogyct]

I'd like to get more information, on how access token between FE and gateway acts. What if IDP doesn't support that?

[guillermopereira]

Where can I find some example of your gateway api? Did you use and authorization code for the first token and client credentials for the second?

[cookiestechies]

How does each microservice verify the JWT token it receives is the valid one. Even if it verifies that it is valid by calculating decoding and decrypting how it identify this user request is authorized one.

[thanhlongtruong]

Hi! Why do we need to forward JWT token to microservices? Is it used to provide user information?

[kellyfj]

FWIW JWT tokens standard says Encryption is optional

[princegovind]

Can some one post Github link for this

[adityabansal]

How will microservices verify that jwt is valid or not?

[kellyfj]

Also 29:01 FYI Signing is not the same as encryption

[pradhyumnakandamuru]

It could have been great if there was a practical example of the implementation. That could have really helped

[noimah]

Aggregating Data on the Gateway can be problematic, would not recommend that. Don't put business logic on the gateway.

[kenmagg]

Why offload something as important as identity to a third party?
That seems like a security issue...