Blog | G5 Cyber Security

Microservice Authentication & Authorization

G5 Cyber Security

TL;DR

Secure your microservices using a central authentication server (like Keycloak or Auth0) and API gateways to handle authorization. Use JWTs for communication between services, and implement proper validation at each service boundary.

1. Choose an Authentication Server

A dedicated authentication server handles user logins, password management, and issuing security tokens. This keeps your microservices focused on their core business logic.

For this guide, we’ll assume you’ve chosen Keycloak.

2. Implement Authentication with the Server

  1. Configure a Client in Keycloak: Create a new client representing your application. Note the Client ID and Client Secret.
  2. Login Flow: When a user tries to log in, redirect them to the Keycloak login page.
  3. Token Exchange: After successful authentication, Keycloak redirects back to your application with an authorization code. Your application exchanges this code for access tokens (JWTs).

Example using a simplified Python request:

import requests

# Replace with your Keycloak details
keycloak_url = "http://localhost:8080/auth/realms/your-realm"
token_endpoint = f"{keycloak_url}/token"
client_id = "your-client-id"
client_secret = "your-client-secret"

data = {
    'grant_type': 'password',
    'username': 'user.name',
    'password': 'user.password'
}

response = requests.post(token_endpoint, data=data, verify=False)

token_json = response.json()
access_token = token_json['access_token']

3. API Gateway for Authorization

An API gateway acts as a single entry point for all requests to your microservices. It’s responsible for validating tokens and enforcing authorization policies.

Example Kong configuration snippet (declarative config):

routes:
- paths: [/my-api/*]
  methods: [GET, POST, PUT, DELETE]
  plugins:
    - name: jwt
      config:
        key_id: "your-jwt-public-key"
        claims: ['sub', 'email'] # Required claims in the JWT

4. Service-to-Service Communication

  1. Pass Tokens: When one microservice needs to call another, pass the access token (JWT) in the Authorization header of the request.
  2. Token Validation within Services: Each microservice should independently validate the JWT before processing any requests. This adds an extra layer of security.

Example using Node.js and a JWT library (e.g., jsonwebtoken):

const jwt = require('jsonwebtoken');

function verifyToken(req, res, next) {
  const token = req.headers['authorization'];

  if (!token) {
    return res.status(401).send('No token provided.');
  }

  jwt.verify(token, 'your-secret-key', (err, decoded) => {
    if (err) {
      return res.status(403).send('Invalid token.');
    }
    req.user = decoded; // Store user information from the JWT
    next();
  });
}

5. Best Practices

Exit mobile version