Working with Authentication in Microservices
1. Understanding Distributed Authentication
| Challenge | Detail |
|---|---|
| No shared session | Stateless tokens preferred |
| Token validation cost | Verify locally with JWKS, not call IdP per request |
| Service identity | SPIFFE/SPIRE, workload identity |
| Trust boundary | Edge auth vs internal |
2. Implementing API Gateway Authentication
| Pattern | Detail |
|---|---|
| Token verification | Gateway verifies JWT, forwards claims |
| Token exchange | Edge token → internal short-lived token |
| Header injection | X-User-Id, X-Scopes (signed) |
| Tools | Kong, Envoy, Apigee, AWS API Gateway |
3. Using Service-to-Service Authentication
| Mechanism | Detail |
|---|---|
| mTLS | Via service mesh (Istio) |
| JWT-SVID | SPIFFE workload identity |
| Client credentials | OAuth 2.0 M2M |
| HMAC | Pre-shared key signing |
4. Implementing JWT Propagation
Example: Forward auth header
// Service A calling Service B - propagate user context
HttpHeaders headers = new HttpHeaders();
headers.set("Authorization", currentRequest.getHeader("Authorization"));
restTemplate.exchange(b_url, GET, new HttpEntity<>(headers), Response.class);5. Using Service Mesh
| Feature | Detail |
|---|---|
| mTLS | Automatic between pods (Istio Citadel) |
| AuthorizationPolicy | L7 RBAC at sidecar |
| RequestAuthentication | JWT validation in Envoy |
| Identity | SPIFFE ID per pod |
6. Implementing Token Validation in Services
| Approach | Detail |
|---|---|
| Local JWKS | Cache keys; verify in-process |
| Introspection | RFC 7662 — call IdP (slower; opaque tokens) |
| Trust chain | Validate iss, aud, exp, signature |
| Library | nimbus-jose-jwt, jose, python-jose |
7. Using Shared Authentication Service
| Type | Detail |
|---|---|
| Centralized IdP | Keycloak, Auth0, Okta, Cognito |
| Self-hosted | Ory Kratos/Hydra, ZITADEL, Authentik |
| Benefit | One place for users, MFA, sessions |
8. Implementing mTLS Between Services
| Approach | Detail |
|---|---|
| Manual | Issue certs from internal CA |
| SPIRE | Workload attestation + auto cert rotation |
| Cert-manager | K8s CRDs for cert lifecycle |
| Mesh | Auto with Istio/Linkerd |
9. Handling Authentication Context Propagation
| Concern | Detail |
|---|---|
| Headers | Authorization, X-Request-Id, traceparent (W3C) |
| Context object | Per-request, ThreadLocal/AsyncLocalStorage |
| Async | Pass explicitly through Promises/Reactor |
10. Implementing Distributed Sessions
| Store | Detail |
|---|---|
| Redis | Cluster mode, AOF, replication |
| DynamoDB | TTL attribute auto-expires |
| JWT | No store, but revocation harder |