Authentication and Authorization in Micro Services
summary
Covers concrete patterns: use mutual TLS (mTLS) for service-to-service inside a service mesh and Open Policy Agent (OPA) as a sidecar for authorization. Recommends OIDC identity providers (Keycloak, Okta) and JSON Web Token (JWT)s validated via JWKS cached locally so backends avoid round trips. OPA receives the JWT, validates it, fetches policies and data (from object storage, HTTP endpoints or Kafka streams) and returns allow/deny or JSON attributes. Rego policies run outside application code.
AI-written summary · about
chapters (7)
- 0:00Authentication intro
- 1:07User vs service auth
- 2:58Identity providers & auth methods
- 8:23Authorization in microservices
- 13:03Open Policy Agent for auth
- 20:12Service discovery & auth
- 22:29Authorization policy examples
related talks
19mOAuth and OpenID Connect for Microservices
45mSecurity in a Microservices Architecture?
10mService Mesh Security in a Nutshell
31mAuthentication and Security in gRPC Microservices
01h 06mMicroservice Authentication and Authorization
41mSecurity Patterns for Microservice Architectures
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew
23mMicroservice Security at the API Level