I used to work for a company that has a solution for this exact problem: http://www.tribestream.io Great product and the people couldn't be a more diverse and all around good group of people.
Your www link doesn't work for me.
Ask HN: How do you handle authentication and authorization between microservices
11–17 of 17 posts
Re: Ask HN: How do you handle authentication and authorization between microservices
#12A central server which maintain all authorization information. The client can request token to access a particular service. The service verifies the token by calling the central server and gets in response the permissions available for that token. Also, a TTLed cache on the servers.
Re: Ask HN: How do you handle authentication and authorization between microservices
#13A central server which maintain all authorization information. The client can request token to access a particular service. The service verifies the token by calling the central server and gets in response the permissions available for that token. Also, a TTLed cache on the servers.
I assume the "central server" is actually an HA cluster of servers with consistency checking of the token data. Otherwise it sounds like a pretty bad SPOF. Any lessons you learned along the way with setting this up?
Re: Ask HN: How do you handle authentication and authorization between microservices
#14A central server which maintain all authorization information. The client can request token to access a particular service. The service verifies the token by calling the central server and gets in response the permissions available for that token. Also, a TTLed cache on the servers.
I assume the "central server" is actually an HA cluster of servers with consistency checking of the token data. Otherwise it sounds like a pretty bad SPOF. Any lessons you learned along the way with setting this up?
You are correct, single would be disaster. One of the lesson learnt, every network call is going add at least 10ms.
Re: Ask HN: How do you handle authentication and authorization between microservices
#15keycloak
Re: Ask HN: How do you handle authentication and authorization between microservices
#16Docker secrets.
Re: Ask HN: How do you handle authentication and authorization between microservices
#17Client certs for service to service communication.
Auth tokens validated by a central entity (a bunch of servers really) for user (mobile apps, etc) to service communication.