1

Background:

We're a smaller shop that puts out a number of products that require authentication and authorization. We're currently using a 3rd party service to "spin up new auth APIs" for each application. However, I would like to investigate potential designs for doing this ourselves in-house due to additional security requirements that may be needed in the future. I've included information below and would appreciate any design or support as I'm relatively fresh with designs of this scale.

Summary of goals:

An interface that allows a developer to create and manage authentication APIs for multiple applications via a webpage. This includes the mostly automated process of spinning up new auth APIs, and ideally the ability to do some form of RBAC / ABAC changes via this page.

Acceptable 'Limitations':

  1. All APIs can expose the same common-auth endpoints, so they're basically just "Images" of one another. (I.e. Login / Register / etc.)

  2. While this would ideally be entirely automated, some parts I've thought of being manual are: * Domain configuration (pointing subdomains to new endpoints) * Spinning up additional VMs (needed?) * Spinning up additional DBs or tables? * Minor configuration changes * others I haven't thought of?

User Stories:

  • As a Developer, I want to login to a web portal so that I can manage auth APIs.
  • As a Developer, I want to create a new API in the web UI, so that I can then integrate it to new applications.
  • As a Developer, I want to manage users in the web UI, so I can oversee access to our applications.
  • As a Developer, I want to **...

Future Considerations:

Each new API for the applications should likely have the user stores (table containing user information) segregated into different databases stored on separate hardware to minimize attack vectors and improve security/scaling. For now, I'm thinking of different subdomains or maybe request parameters to separate the APIs?

Thoughts:

I feel like there may be some solution that involves building a template/image of an Auth API on Azure and just duplicating the VM or image, but I'm not too sure of this route either. Obviously management, maintenance, updates, etc. to these would be more hands-on, but feel free to provide feedback on this as well.

Thanks in advance!

1 Answer 1

1

It seems you packed quite a lot into a short question, or I may be reading too much into it...

Authentication: I suggest research what is available and actively supported in the open source community, and consider building on that as needed. https://en.wikipedia.org/wiki/Keycloak open source comes to mind as one to look at. I would look into several and try a few before making a decision.

Infrastructure: Dynamic configuration and deployment of infrastructure sounds more like Terraform would be a good place to start. I'd also look at HashiCorp Consul+Vault because it sounds like you may be taking on secrets management based on those user stories. Keep configuration separate from code, and put secrets in a secret store like Vault.

Scaling: I don't have enough context on the use cases for "spinning up additional DBs" but maybe Kubernetes and containers would help if you're trying to scale out your services?

Since you're in the business of providing service based API's, if you aren't already you might want to look at OpenAPI 3.x. This can be helpful in a number of areas including writing some automated security tests for your services.

Edit: I understand that you stated wanting to roll your own solution, which is the answer I provided. Given the quality of services you get from a commercial cloud vendor (Google, AWS, Microsoft, etc.) I would consider whether your requirements would justify the time and cost of maintaining what you need yourself. If you have concerns I would contact one of the vendors and discuss them to see if they can support what you require or if it's on their development horizon.

For those new to the topic coming upon this thread, here is a 5 minute video introducing API Authentication with Google Cloud - https://www.youtube.com/watch?v=pBVAyU4pZOU and written instructions https://support.google.com/cloud/answer/6158849#zippy=%2Cweb-applications

1
  • Thanks for this information, Greg! I'll be looking into this in the coming days, but I'll accept this as the answer now since it's enough in the scope of my question and post here. Aug 10, 2020 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.