Authentication and Authorization in Microservices Architecture: A Systematic Literature Review
The microservice architectural style splits an application into small services, which are implemented independently, with their own deployment unit. This architecture can bring benefits, nevertheless, it also poses challenges, especially about security aspects. In this case, there are several micros...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-03-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/12/6/3023 |
| _version_ | 1797473016436752384 |
|---|---|
| author | Murilo Góes de Almeida Edna Dias Canedo |
| author_facet | Murilo Góes de Almeida Edna Dias Canedo |
| author_sort | Murilo Góes de Almeida |
| collection | DOAJ |
| description | The microservice architectural style splits an application into small services, which are implemented independently, with their own deployment unit. This architecture can bring benefits, nevertheless, it also poses challenges, especially about security aspects. In this case, there are several microservices within a single system, it represents an increase in the exposure of the safety surface, unlike the monolithic style, there are several applications running independently and must be secured individually. In this architecture, microservices communicate with each other, sometimes in a trust relationship. In this way, unauthorized access to a specific microservice could compromise an entire system. Therefore, it brings a need to explore knowledge about issues of security in microservices, especially in aspects of authentication and authorization. In this work, a Systematic Literature Review is carried out to answer questions on this subject, involving aspects of the challenges, mechanisms and technologies that deal with authentication and authorization in microservices. It was found that there are few studies dealing with the subject, especially in practical order, however, there is a consensus that communication between microservices, mainly due to its individual and trustworthy characteristics, is a concern to be considered. To face the problems, mechanisms such as OAuth 2.0, OpenID Connect, API Gateway and JWT are used. Finally, it was found that there are few open-source technologies that implement the researched mechanisms, with some mentions of the Spring Framework. |
| first_indexed | 2024-03-09T20:09:11Z |
| format | Article |
| id | doaj.art-e57865debc5f41f981dc6d901270c033 |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-09T20:09:11Z |
| publishDate | 2022-03-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-e57865debc5f41f981dc6d901270c0332023-11-24T00:22:32ZengMDPI AGApplied Sciences2076-34172022-03-01126302310.3390/app12063023Authentication and Authorization in Microservices Architecture: A Systematic Literature ReviewMurilo Góes de Almeida0Edna Dias Canedo1Department of Computer Science, University of Brasília (UnB), P.O. Box 4466, Brasilia 70910-900, BrazilDepartment of Computer Science, University of Brasília (UnB), P.O. Box 4466, Brasilia 70910-900, BrazilThe microservice architectural style splits an application into small services, which are implemented independently, with their own deployment unit. This architecture can bring benefits, nevertheless, it also poses challenges, especially about security aspects. In this case, there are several microservices within a single system, it represents an increase in the exposure of the safety surface, unlike the monolithic style, there are several applications running independently and must be secured individually. In this architecture, microservices communicate with each other, sometimes in a trust relationship. In this way, unauthorized access to a specific microservice could compromise an entire system. Therefore, it brings a need to explore knowledge about issues of security in microservices, especially in aspects of authentication and authorization. In this work, a Systematic Literature Review is carried out to answer questions on this subject, involving aspects of the challenges, mechanisms and technologies that deal with authentication and authorization in microservices. It was found that there are few studies dealing with the subject, especially in practical order, however, there is a consensus that communication between microservices, mainly due to its individual and trustworthy characteristics, is a concern to be considered. To face the problems, mechanisms such as OAuth 2.0, OpenID Connect, API Gateway and JWT are used. Finally, it was found that there are few open-source technologies that implement the researched mechanisms, with some mentions of the Spring Framework.https://www.mdpi.com/2076-3417/12/6/3023microserviceauthenticationauthorizationsecuritySLR |
| spellingShingle | Murilo Góes de Almeida Edna Dias Canedo Authentication and Authorization in Microservices Architecture: A Systematic Literature Review Applied Sciences microservice authentication authorization security SLR |
| title | Authentication and Authorization in Microservices Architecture: A Systematic Literature Review |
| title_full | Authentication and Authorization in Microservices Architecture: A Systematic Literature Review |
| title_fullStr | Authentication and Authorization in Microservices Architecture: A Systematic Literature Review |
| title_full_unstemmed | Authentication and Authorization in Microservices Architecture: A Systematic Literature Review |
| title_short | Authentication and Authorization in Microservices Architecture: A Systematic Literature Review |
| title_sort | authentication and authorization in microservices architecture a systematic literature review |
| topic | microservice authentication authorization security SLR |
| url | https://www.mdpi.com/2076-3417/12/6/3023 |
| work_keys_str_mv | AT murilogoesdealmeida authenticationandauthorizationinmicroservicesarchitectureasystematicliteraturereview AT ednadiascanedo authenticationandauthorizationinmicroservicesarchitectureasystematicliteraturereview |