Securing Microservices – Authentication, Authorization, and mTLS

Why Security in Microservices Is Hard

Monoliths usually have one access point (e.g. a web server).
Microservices have many — and each service may:

• Receive public traffic
• Talk to other services
• Handle sensitive data

This means you must protect every door, not just the front gate.

---

Authentication: Who Are You?

Authentication verifies the identity of the caller.

External Users

Use standard protocols:

• OAuth2 + OpenID Connect
• JWT tokens
• Identity providers (Auth0, Keycloak, Okta)

Each request includes a bearer token:

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

Services validate and extract user claims.

Internal Services

For service-to-service identity:

• Use service accounts
• Or mutual TLS (more below)

---

Authorization: What Can You Do?

Authorization controls access to actions or resources.

Common models:

• RBAC (Role-Based Access Control)
  • e.g., “admin” can access /admin
• ABAC (Attribute-Based Access Control)
  • e.g., allow based on department or request metadata
• Scopes (for APIs)
  • e.g., read:orders, write:invoices

Authorization logic can be:

• Built into each service
• Centralized using OPA (Open Policy Agent) or AuthZ services

---

Securing Internal Communication with mTLS

Mutual TLS (mTLS) encrypts and authenticates traffic between services.

Features:

• Encrypts data in transit
• Verifies service identity
• Prevents spoofing or man-in-the-middle attacks

Tools that provide mTLS:

• Istio
• Linkerd
• Consul Connect
• NGINX (with certs)

✅ Let your service mesh manage mTLS automatically.

---

Zero Trust and Defense in Depth

The modern approach = Zero Trust

> “Never trust, always verify.”

This means:

• Every request is authenticated and authorized
• Even if it’s internal
• You assume the network is hostile

Apply defense in depth:

• Gateways validate user tokens
• Services validate internal service identity
• Fine-grained access rules
• Least privilege for service accounts

---

Summary

Security in microservices must cover identity, access, and encryption — everywhere.
Use modern protocols like OAuth2 and JWT for users, and mutual TLS for service communication. Don’t assume your internal network is safe.

---

Next up:
Lesson 10 – Continuous Integration and Deployment for Microservices