Microservices have become the hottest topic in software architecture over the past year, and much can be said about their benefits. But there are many challenges related to their security implementation and security context propagation over their components. This session addresses how to perform authentication and authorization inside a microservices architecture, covering technologies such as OAuth2, OpenID Connect, and JSON Web Token and use of Spring Cloud Security to integrate with a Spring and/or Java EE–based application platform.

1. Protecting Java Microservices
Alessandro Ribeiro
Rodrigo Cândido da Silva
Best Practices and Strategies

2. Agenda
● Microservices
● Security requirements
● OAuth2, JWT, OpenID Connect
● Security practices

3. Monolithic vs. Microservices

4. How can we handle security needs over it?

5. REST APIs are vulnerable
● RESTful architecture doesn't define security procedures
● They are equally vulnerable as standard web apps
● There are many security vulnerabilities
○ Injection attacks
○ Replay attacks
○ Cross-site scripting
○ Denial of Service (DoS)
○ Man-in-the-middle

6. Authentication & Authorization

7. OAuth2
● Open standard protocol specification
● Enables applications to access each other’s data
without sharing credentials
● Avoid password issues
● Required for delegating access
○ Third party applications
○ For specified resource and limited time
○ Can be selectively be revoked

8. OAuth2 overview

9. OAuth2 token
● Access Token
○ Short-lived token
● Refresh Token
○ Long-lived token
● Bearer token
○ Hash random token
○ Only defines a secret concept (no user identity)
● Proof of possession
{
"access_token": "2YotnFZFEjr1zCsicMWpAA",
"token_type": "bearer",
"expires_in": 3600,
"scope": "read write",
"refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA"
}

10. What's the issue w/using OAuth2 only?
Not using a stateless token model (needs 3rd party validation)

11. How OAuth2 + JWT will work then?
Stateless token model (embedded validate in the service)

12. JSON Web Tokens
"Compact and self-contained way for securely
transmitting information as a JSON object"

13. JSON Web Tokens
OAuth2 + JWT (Replaces the bearer token to use JWT)
{
"access_token":
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0OTMyODMxNzksInVzZXJfbmFtZSI6InVzZXIiLCJhdX
Rob3JpdGllcyI6WyJVU0VSIiwiTUFOQUdFUiJdLCJqdGkiOiJkMGY5OTY2OC01NzdkLTRkZTEtODkwYi1hNDY1MTBkZj
g2YjAiLCJjbGllbnRfaWQiOiJjbGllbnQiLCJzY29wZSI6WyJvcGVuaWQiXX0.iH1pnwJZPZi05hdpY9MDGIvtx34Dj8
lxc5fdU5c5NCCtUblT_L9kdZO6NaOIIZffbGzSHoyVUEZkSwkGXm6lT1jRTcOHq2khAZlwmO3hN3c1xb8bumAgmpF8fJ
SIKTVIkFJpbVO4uDfHSSbBm6QsTbqHkNgNwWSWbNG1n6ZlsHCcZCh37cmgbh-B4tPD9QEfH3CSI6Z7AgUbS9UCIytjm0
2sgxgAr3liOcykRrdcOvxgIBx_yGDvornQ5JOBVdW-TS0-uJmHe6sHCFYeBNchJhRi7xqZCMYFD6IcP4dftPupzg3IMl
5oWberxhZTCCLoi18JtQyZgIgqmSlOAIq8wg",
"token_type": "bearer",
"expires_in": 43199,
"scope": "read write",
"jti": "d0f99668-577d-4de1-890b-a46510df86b0",
"refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA"
}

14. OpenID Connect
● Identity layer on top of OAuth2 protocol
● ID tokens are JWT tokens
● REST-based
● Provide core endpoints
○ Authorization
○ Token, UserInfo
(Identity, Authentication) + OAuth2 = OpenID Connect

15. Summary view

16. Best Practices

17. Create an API gateway
“Applies the defense in depth principle”

18. Only exposes the gateway at DMZ over TLS
“Cryptography data in transit"

19. Ensure data privacy
“Sensitive data should be encrypted as early as possible"

20. Rate limiting the incoming client traffic
“Prevents the DoS attacks"

21. "External requests should be verified"
Implement CSRF and CORS filter protection

22. Increase security at the container level
“Achieve the least-privilege security concept"

23. Monitor everything that is possible
“Detects and prevents attacks"

25. Q&A
?

26. Thank you!
Obrigado!

27. References
• https://www.slideshare.net/spnewman/appsec-and-microservices
• https://github.com/magnhaug/blogposts/blob/master/microservices-security.md
• http://blog.leanix.net/en/authorization-authentication-with-microservices
• http://colinmorelli.com/blog/2015/5/21/security-in-microservices
• http://guild.beach.io/t/microservices-security/111
• http://techgenix.com/security-challenges-presented-microservices/
• https://book.gameontext.org/microservices/ApplicationSecurity.html
• https://techbeacon.com/8-best-practices-microservices-security
• http://www.devopsschool.com/slides/microservices/security-with-microservices/Security%20with%
20Microservices.pdf
• https://www.owasp.org/index.php/REST_Security_Cheat_Sheet
• http://www.grahamlea.com/2015/07/microservices-security-questions/
• http://blog.restcase.com/top-5-rest-api-security-guidelines/