Key words
Knowledge Factor
Possession Factor
Inherence Factor
All individual factors are not secure, because if any factor comprimise.
So, we got 2FA or MFA came into picture.
SSO
Oauth
JWT (JSon Web Token) ==> not authentication, it's an authorization.
Okta
OpenConnectID
SAML (Secure Assertion Markup Language)
Azure Active Directory
Service Provider
IdentityProvider
Eg: AccessToken --> Employee ID card ( Authorization), validatity( lost or reported, left the orginations, Expire)
Session or Cookie Based Authorization
In Cookie, will maintain SESSION_ID
Load balance will maintain the session log in sticky Session pattern ( Scalability problem)
Here also, we have a problem if the shared session cache pattern is corrupted then it's single point failure
User is responsible to bring all security information for all microservices, so nothing but JWT
For Stateless server, will pass JWT
OAuth:
Service to service authorization
ResourceOwner
ResourceServer
AuthorizationServer
Client
with in same with diff microservices.
OpenIDConnect
Its a specification
No comments:
Post a Comment