This document discusses security in microservices architectures. It begins by comparing monolithic and microservices approaches. It then covers edge security using API gateways and OAuth 2.0 authorization. Other topics include service-to-service security using TLS mutual authentication, JSON Web Tokens (JWTs), and SPIFFE/SPIRE for identity management. Patterns like JWTs, nested JWTs, and token exchange are presented for secure communication between services. The document also discusses access control and policy evaluation using approaches like embedded policy decision points and the Open Policy Agent (OPA) framework.

1. MICROSERVICES SECURITY LANDSCAPE
Prabath Siriwardena
prabath@wso2.com | prabath@apache.org

2. ● 11 years @ WSO2, leading the open source WSO2 Identity Server
● Blog: http://blog.facilelogin.com/ | Vlog: http://vlog.facilelogin.com
● Books
● Microservices Security in Action ~ April, 2019
ABOUT ME
2

3. MICROSERVICES

4. MONOLITHIC
4

5. MICROSERVICES
5

6. EDGE SECURITY

7. 7
API GATEWAY PATTERN

8. 8
API GATEWAY PATTERN

9. OAUTH 2.0

10. OAUTH 2.0
10

11. AUTHORIZATION CODE GRANT TYPE
11

12. 12

13. SERVICE TO SERVICE SECURITY

14. TRUST THE NETWORK
▪ TLS Mutual Authentication
▪ JWT (JSON Web Token)
14

15. CERTIFICATES

16. TLS MUTUAL AUTHENTICATION
▪ Each microservice will have its own certificate to prove its identity
▪ How do we provision certificates to each microservice?
▪ How do we deal with certificate revocations?
▪ How do we deal with trust bootstrap?
▪ How do we deal with key rotation?
16

17. SPIFFE / SPIRE
▪ Secure Production Identity Framework for Everyone.
▪ SPIFFE tries to solve the trust bootstrap problem in a platform agnostic manner.
▪ SPIFFE provides an identity to each workload in a microservices deployment,
which is known as the SPIFFE ID.
E.g.: spiffe://acme.com/billing/payments
17

18. SPIFFE / SPIRE
18

19. SPIFFE + OAUTH 2.0
19

20. JWT

21. JWT (JSON WEB TOKEN)
▪ Defines a container to transport data between interested parties.
▪ There are multiple applications of JWT - in OpenID Connect the id_token is
represented as a JWT.
▪ Propagate one’s identity between interested parties.
▪ Propagate user entitlements between interested parties.
▪ Transfer data securely between interested parties over a unsecured channel.
▪ Assert one’s identity, given that the recipient of the JWT trusts the asserting party.
21

22. JWT (JSON WEB TOKEN)
▪ A JWT does not exist itself — either it has
to be a JWS or a JWE (JSON Web
Encryption).
▪ It’s like an abstract class — the JWS and
JWE are the concrete implementations.
▪ We call a JWS or JWE, a JWT only if it
follows the compact serialization.
22

23. JWT (JSON WEB TOKEN)
23

24. JWT (JSON WEB TOKEN)
eyJhbGciOiJSUzI1NiIsImtpZCI6Ijc4YjRjZjIzNjU2ZGMzOTUzNjRmMWI2YzAyOTA3NjkxZjJjZGZmZTEifQ.eyJpc
3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwic3ViIjoiMTEwNTAyMjUxMTU4OTIwMTQ3NzMyIiwiYXpwIjoiODI1
MjQ5ODM1NjU5LXRlOHFnbDcwMWtnb25ub21ucDRzcXY3ZXJodTEyMTFzLmFwcHMuZ29vZ2xldXNlcmNvbn
RlbnQuY29tIiwiZW1haWwiOiJwcmFiYXRoQHdzbzIuY29tIiwiYXRfaGFzaCI6InpmODZ2TnVsc0xCOGdGYXFSd
2R6WWciLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiYXVkIjoiODI1MjQ5ODM1NjU5LXRlOHFnbDcwMWtnb25ub
21ucDRzcXY3ZXJodTEyMTFzLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwiaGQiOiJ3c28yLmNvbSIsImlhd
CI6MTQwMTkwODI3MSwiZXhwIjoxNDAxOTEyMTcxfQ.TVKv-pdyvk2gW8sGsCbsnkqsrS0T-H00xnY6ETkIfg
IxfotvFn5IwKm3xyBMpy0FFe0Rb5Ht8AEJV6PdWyxz8rMgX2HROWqSo_RfEfUpBb4iOsq4W28KftW5H0I
A44VmNZ6zU4YTqPSt4TPhyFC9fP2D_Hg7JQozpQRUfbWTJI
24

25. 25
SELF-CONTAINED ACCESS TOKENS

26. 26
JWT DEMO WITH BALLERINA

27. SERVICE TO SERVICE
INTERACTION PATTERNS

28. TRUST THE NETWORK
28

29. SHARED JWT + mTLS
29

30. NESTED JWT
30

31. JWT WITH TOKEN EXCHANGE
31

32. CROSS DOMAIN
32

33. ACCESS CONTROL

34. POLICY EVALUATION (CENTRAL PDP)
34

35. POLICY EVALUATION (EMBEDDED PDP)
35

36. OPEN POLICY AGENT (OPA)
▪ A lightweight general-purpose policy engine that can be co-located with your
service.
▪ Policies are written in Rego
▪ Can integrate OPA as a sidecar, host-level daemon, or library.
▪ Integrated with Spring, Service Mesh implementations (Istio, Linkerd), Kafka
https://istio.io/docs/reference/config/policy-and-telemetry/adapters/opa/
▪ Netflix is an early adopter of OPA
36

37. THANK YOU
wso2.com