OAuth and OpenID Connect for Microservices
summary
Argues that microservices should offload auth to OAuth and OpenID Connect and exchange identity as JWTs as self-contained identity tokens; uses opaque reference tokens at the edge and a token-translation proxy that looks up the reference token, receives a JWT from the authorization server, and injects it into internal calls. Claims each service only needs a small JWT validation library, avoids shared session stores, and scales by treating identity as a signed object passed between services.
AI-written summary · about
chapters (9)
- 0:00Traditional monoliths
- 1:55Microservices concept
- 3:01Security challenges
- 4:43Understanding OAuth
- 5:39OAuth flow mechanics
- 8:09OpenID Connect
- 11:07JSON Web Tokens
- 12:55Token types
- 16:10Securing microservices
related talks
01h 06mMicroservice Authentication and Authorization
23mAuthentication and Authorization in Micro Services
38mAuthentication as a Microservice: Portable Customer Identity Management
23mMicroservice Security at the API Level
45mSecurity in a Microservices Architecture?
20mPass On Access: User to User Data Sharing With OAuth
39mMicroservice Security via MicroProfile JWT
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew