Designing authentication and authorisation micro service

Question

Background:

There are three different applications A, B and C and they all share same user details but I had to implement authentication in each of them which was duplication of effort.

After some research I decided to go micro service way and implemented an authentication service. The service stores the secret for each app and prepares a JWT token when the user tries to login to given app. This is working fine as expected.

Current:

Now, there is a need to have roles and permissions for each application and I finding a way to implement it without creating much coupling. I have few questions regarding my current situations:

Questions:

1. Should I add authorisation login in the same service or create another service with roles and permission tables in it.

2. The end result will be to send a JWT token which would contain payload defining user details and permission so for example:

   {
     uid: 1,
     name: '...',
     email: '...'
     permissions: [{
       'edit': ['post', 'user'],
       'delete': ['post'],
       'read': ['post', 'user'],
       ...
     }]
   }
   

On paper the this structure seems good to me. It will save additional network calls from the client side. But is it safe and reliable enough?

PS: I don't have enough experience in building real applications but I hope I am going in the right direction.

Answer 1

You should definitely externalise your authorisation. In fact there is even a paradigm called externalized authorization management.

In Externalized Authorization Management, you choose to decouple your authorization logic from your app's business logic. You do this for a multitude of reasons:

• maintenance
• visibility and auditability: it is easier to understand policies than it is to understand code.
• extensibility (future-proof): with EAM, you do not need to rewrite your app if your authorization requirements change.
• reuse: you can apply the same authorization logic across multiple technologies and layers (from APIs to microservices to ESBs to databases)
• ease and dev time: it is easier to write policies than it is to write code to implement authorization requirements that may sometimes be complex

Externalized authorization management comes in different forms. Some frameworks contain tools e.g. Spring Security or Microsoft Claims-based authorization. If you want a technology-neutral approach, look into ABAC (attribute-based access control) and XACML, the implementation of ABAC.

The XACML architecture defines a PEP which will integrate with / in front of your microservice and a PDP which will process authorization requests against a set of pre-established policies.

Have a look at the architecture diagram for details