Search code examples
node.jsgoogle-cloud-platformmicroservicesgoogle-cloud-api-gateway

Need design suggestions about role-based authorization

Below is the architecture of a project that I am working on. And I have some questions about how to implement role-based authorization.

enter image description here

What do I want to do here?

I want to make a shared system to authorize each request to the post and profile services.

Why do I want it to be shared?

  • I want a central place to specify the what permission are granted to a certain type (admin, student, teacher) of user.
  • If the number of services grow in the future I don't want to write the same auth logic in each of them.

What have I thought of doing?

To share a SECRET key in both the auth service and API gateway. Auth Service encrypts data using the key, and the API gateway uses it to decrypt on each subsequent request. The token will have a roles: [] to inform other micro-services about the permission.

  • The benefit: I am assuming that this will eliminate a verify token call to the auth service, reducing the load on it.
  • The drawback: I might have to implement my own API gateway rather than using GCP's API Gateway cause I can't find good resources on how to do this.

What I ask?

  • Is this idea good?
  • How to do develop this in a fast and secure way?
  • Is there any better approach to do this?

Note: I am building something with a micro-service architecture for the first time, so any type of guidance related to the project will be great.

Solution

  • I would say that it is almost good. Instead of a secret key, use a pair of public/private key. The authentication service signs the JWT with the private key. The authentication service is the only one to know the private key. All microservices know the public key and use it to verify the JWT.

    First benefit : the API gateway does not need to know the secret key because it does not verify the token, so you can use a default API gateway.

    Second benefit : with this method, you will have in-depth security, because every microservice verify the roles. If a microservice invokes another microservice, it will forward the JWT, and the second microservice will check the JWT again. That is more secure than if they trust blindly what have been verified by an API Gateway.

    Have you considered using Keycloak as the authentication service ?