Spellpoint presentation slides from Ubisecure's IAMwithUBI Nordic IAM event May 2018. How Customer IAM (CIAM) principles and technology can be applied to identities for microservices to provide authentication and authorization of APIs.

1. SPELLPOINT
N O R D I C I A M C O N F E R E N C E 2 0 1 8

2. Microservice has no finger to type with
Securing Access for the non-interactive
24.5.2018 Tero Pasanen, Senior IAM Architect

3. Identity and Access Management (IAM)…
…is needed because all data cannot be available to everyone.
So how to grant and enforce right accesses efficiently
…and how to ensure security.

4. …this holds true for the more traditional software ecosystem, but what
about the modern, agile, API based architectures?

5. Well.
Does it really matter?
I mean, what matters to the end-user?

6. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC
 Monolith dusty mainframe servers  Latest buzzword friendly
microservices backed by
blockchain audit ledgers?
21a0d5
Service 1 Service 2

7. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC
What matters to the end-user…
Correct data and trust
…and probably usability too.

8. So are we lost in digital transformation?
It’s API, it’s all open to
everyone
Someone will take care of
it, we’ll have an API for
that
Where do you get the
data for the access
control API?
Someone will take care of
it, we’ll have an API for that

9. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC
All-out API environment?
 Probably not.
 Consider consistent user rights
across different types of sw
ecosystems
 Avoid platform lock-in

10. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC
Microservices ecosystem – Remember SOA?
SOA
People
Process
Practice
Platform
 Existing investments?
 ESB  API Gateway
 SAML  OpenID Connect,
Oauth, JWT
 SOA – Agile?

11. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC
Microservices ecosystem puts agility in the dead center
Agility &
DevOps
Quick to
develop
Easy to
deploy
Possibly
short-
lived
Easily
scalable

12. However…

13. There are more attack surfaces in the microservices world

14. So we need to authenticate and authorize
 Authenticate source and target
API’s
 To ensure data confidentiality and
integrity
 Authorize end-user actions
 .. in the way-way back-end systems

15. Copyright © Spellpoint Oy, 2000 – 2018 PUBLIC
Ways to do it
 API Key “Do you know who I am?”
 OAuth (possibly with JWT) as bearer token “I’ve got a ticket to ride”
 MSSL (Mutual Authentication) “..and I can prove it”

16. Performance matters
Amazon: 100ms of latency cost 1% in sales
Google: extra 0.5 seconds in search page generation time dropped traffic by 20%

17. Looks a lot like traditional IAM

18. Take away
With microservices we still have an end-point - service URL - to protect. Lo-and-
behold - that is just what customer IAM SSO services do.
Be efficient utilizing light weight protocols like OpenID Connect for
authentication and OAuth for authorization.
And provide access to legacy applications using the already established
controls.

19. Copyright © Spellpoint Oy, 2000 – 2018 CONFIDENTIAL
SECURING THE DIGITAL EVOLUTION

20. END OF PRESENTATION