Microservice Authorization Using Access Patterns and App IDs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing authentication and authorization across microservices in computing systems is challenging, especially when new services are added or existing ones are modified, as it is difficult to control changes to the authentication and authorization processes.
Innovation Solution
Implement a central microservice authorization and authentication computing system (microservice AUTH computing system) that manages authentication metadata and authorization policy metadata for each microservice, allowing for easier management of permissions and access control, even when new or modified microservices are introduced.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a microservice exposes an API to be called by other microservices, then the service can perform various tasks through inter-service calls, but it becomes difficult to control changes to authentication and authorization processes when new services are added or existing ones are modified
Solution Approach 1:
The patent introduces an authorization server as an intermediary component that mediates between microservices and handles authentication and authorization centrally. The authorization server receives authorization requests from microservices, validates them against stored authorization data, and returns authorization decisions. This intermediary approach allows microservices to be added or modified without changing their authentication and authorization logic, as the authorization server centrally manages these processes for all services in the system.
2Ease of operation
If authentication and authorization are managed individually in each microservice, then each service can operate independently, but the overall system complexity increases when managing access control across multiple services
Solution Approach 1:
The patent extracts the authentication and authorization management functionality from individual microservices and consolidates it into a separate authorization server. Each microservice continues to operate independently and can make authorization requests to the authorization server as needed. This extraction approach maintains the operational independence of microservices while reducing the overall system complexity for managing access control, as the authorization logic is centralized in a dedicated component rather than distributed across all services.
3Reliability
If a central authorization system is implemented to manage authentication across microservices, then control over authorization processes is improved, but the system requires additional centralized components
Solution Approach 1:
The authorization server is designed as a universal component that handles multiple functions: storing authorization data for multiple microservices, receiving and processing authorization requests from any microservice, making authorization decisions based on stored data, and returning decisions to requesting services. This multi-functional design allows a single centralized component to provide comprehensive authorization control across the entire microservice system, improving reliability without requiring multiple specialized centralized components.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
An authorization policy defines permissions that are exposed by a microservice. When a call is made to the microservice, it includes an access token. An application identifier uniquely identifying the calling application is extracted from the token. An access pattern, used by the calling application to obtain the access token and make the call to the microservice, is identified. Permissions that may be granted to the calling application are identified in the authorization policy based upon the application identifier and the access pattern that is identified. An authorization decision is made as to whether to authorize the call, based upon the granted permissions.