Implementing Authentication and Authorization
1. Implementing JWT Authentication
| Part | Detail |
|---|---|
| Header | {"alg":"RS256","typ":"JWT","kid":"k1"} |
| Payload | iss, sub, aud, exp, iat, jti, custom claims |
| Signature | RS256/ES256 (asymmetric, recommended) |
| Validation | Verify sig (JWKS), exp, aud, iss |
| Pitfall | Don't use HS256 with shared secrets across services |
2. Using OAuth 2.0 Flows
| Flow | Use Case |
|---|---|
| Authorization Code + PKCE | SPAs, mobile, web apps (default) |
| Client Credentials | Service-to-service |
| Device Authorization | TVs, CLIs |
| Refresh Token | Long-lived sessions |
| Implicit DEPRECATED | Replaced by Auth Code + PKCE |
| Password Grant DEPRECATED | Discouraged in OAuth 2.1 |
3. Implementing API Key Authentication
| Aspect | Detail |
|---|---|
| Transmission | X-API-Key header (not query string) |
| Storage | Hashed (bcrypt/argon2) in DB |
| Scope | Per-key permissions, rate limits |
| Rotation | Allow N active keys; expire on schedule |
| Use case | Server-to-server, partner APIs |
4. Using mTLS Authentication
| Aspect | Detail |
|---|---|
| Identity | Client cert SAN/CN; SPIFFE in mesh |
| CA | Internal PKI (cert-manager + Vault) |
| Rotation | Short-lived (24h) auto-rotated |
| Use | Service-to-service in zero-trust networks |
5. Implementing Token Refresh
| Aspect | Detail |
|---|---|
| Access token TTL | 5–15 min |
| Refresh token TTL | Hours–days; rotated on use |
| Refresh rotation | Issue new RT each use; detect reuse → revoke chain |
| Storage (browser) | HttpOnly Secure cookie |
6. Managing Token Expiration
| Claim | Detail |
|---|---|
| exp | Hard expiration; mandatory |
| nbf | Not-before |
| iat | Issued at |
| Clock skew | Allow ±60s tolerance |
| Sliding session | Refresh extends validity |
7. Implementing Role-Based Access Control
| Concept | Detail |
|---|---|
| Role | Bundle of permissions |
| Assignment | User ↔ role(s) ↔ permission(s) |
| Where checked | Gateway, service, method |
| Limitation | Coarse-grained; role explosion |
8. Implementing Attribute-Based Access Control
| Element | Detail |
|---|---|
| Attributes | Subject, action, resource, environment |
| Policy | Logical rules over attributes |
| Engine | OPA / Rego, Cedar, Casbin |
| Pros | Fine-grained; data-driven |
Example: Rego policy
package authz
default allow = false
allow {
input.method == "GET"
input.path == ["orders", id]
input.user.id == data.orders[id].customer_id
}9. Using Claims-Based Authorization
| Claim | Use |
|---|---|
| scope | OAuth permission set |
| roles | RBAC roles list |
| tenant | Multi-tenant isolation |
| permissions | Fine-grained list |
| Custom | Avoid PII in JWT (visible to client) |
10. Implementing Service-to-Service Auth
| Mechanism | Detail |
|---|---|
| mTLS (SPIFFE) | Network identity |
| OAuth client credentials | JWT per service |
| Token exchange (RFC 8693) | Propagate user identity downstream |
| HMAC signed requests | Lightweight (e.g. webhooks) |
11. Handling Token Revocation
| Approach | Detail |
|---|---|
| Short-lived tokens | Self-expire quickly (5–15 min) |
| Revocation list | JTI blacklist in Redis |
| Refresh token revocation | Revoke chain on suspicious activity |
| Introspection (RFC 7662) | Active/inactive check at AS |
12. Implementing Single Sign-On
| Protocol | Use |
|---|---|
| OIDC | Modern SSO over OAuth 2.0 |
| SAML 2.0 | Enterprise SSO |
| CAS | Older, university-style |
| IdP | Keycloak, Auth0, Okta, Entra ID, Cognito |