Should I create access control as a microservice or keep the access control logic as part of the specific microservice?

Question

I was wondering if I have a microservice called, for example, Weather, and only certain people can update certain properties around the weather such as Temperature, Precipitation, and Wind.

These certain users are mapped to the weather event, e.g.:

User1 => Temperature
User2 => Wind
User3 => Temperature
User3 => Precipitation

Should the weather microservice look after this access control list in its own domain, or is it better to have a central access control microservice that returns what user can change what weather event?

For example:

1. Access Control inside the Weather microservice:
API(Weather): /Weather/Wind/Monitors => Return all Users mapped to Wind with all their data in one call

2. Access Control as a separate microservice:
API(Weather): /Weather/Wind/Monitors =>
Call the Access Control microservice to return all UserIds mapped to Wind
Call the weather database with UserIds returned from access control to get the user data.

Pros of option 1:

• Less latency as it does not need to call another microservice.
• Queries are more efficient, and it is easier to sort and paginate data if it is not spread across multiple domains.

Cons of option 1:

• Access control is coupled to its specific microservice.

Pros of option 2:

• Easier to update access control logic.
• Access control is decoupled from its specific microservice.
• You can change the ACL permissions without needing to touch the weather microservice.

Cons of option 2:

• Queries can be inefficient, for example, ids returned from the Access Control microservice need to use a possible 'contains' to receive all the relevant data, and it could be slow for a large set of ids.
• You need to pass state to the Access Control microservice, e.g., if you want to query all wind monitors by first name, you will need to store the first name in the Access Control microservice database so you can order the id's by first name.
• All microservices need to store mapping tables in this one ACL microservice datalayer, e.g., WeatherACLMap, SeaACLMap, PlanetACLMap.
• This is just a simple example in place of a more complex system complex access control.

What would you recommend as the best practice around this? Can you think of other advantages and disadvantages of both systems?

Answer 1

I would encourage you to look at it from a completely different angle.

Micro-services are meant to be as independent from each other as ;possible. In particular if service A fails, then service B should not also fail completely as a result. Instead service B should be designed to, in the worst case, give a degraded service.

To map it to your example, the Weather service should still provide as much functionality as possible when the Access Control service is unavailable. This can be achieved the easiest if the Weather service can make the authorization decision completely based on the information that a (previously authenticated) user presents, for example in the form of a token.