Search code examples
spring-securityjwtspring-cloudnetflix-zuul

Central JWT management system for my micro-service based architecture

We are building our applications in micro-services based architecture to implement our applications. As true with micro-services, we now see a lot of cross service interactions happening between services.

In order to safeguard the endpoints we plan to implement JWT based authentication between such secure exchanges.

There are 2 approaches we see helping us achieve it:

  1. Embed an JWT engine in each application to generate the token (@consumer side) and evaluate (@provider side). With an initial exchange of keys, the token exchange shall work smooth for any future comms.
  2. Have an external (to application) JWT engine, that sits in between all micro-service communications for the distributed application, and takes care of all token life cycle, including its encryption-decryption and validation.

There are lot of options to do it as per option #1 as listed on https://jwt.io but considering the over-head token generation and management adds to a micro-service, we prefer to go with 2nd option by having de-centralised gateway.

After quite some research and looking at various API gateways we have not yet come across a light weight solution/tool that can serve to our need and help us get centralised engine for one applications comprised of many micro-services.

Do anyone know about one such tool/solution?

If you have any other inputs on this approach, please let me know.

Solution

  • I prefer also option 2, but why are you looking for a framework?

    The central application should only be responsible of managing the private key and issuing the tokens. Including a framework for solve one service could be excessive

    You can also think to implement a validation service, but since applications are yours, I suggest to use an assymetric key and verify the token locally instead of executing remote validation requests to central application. You can provide a simple library to your microservices to download the key and perform the validation. Embed any of the libraries of JWT.io or build It from scratch. Validating a JWT is really simple

    If you would need to reject a token before expiration time, for example using a blacklist, then It would be needed a central service. But I do not recommend this scheme because breaks JWT statelessness