A Token Of Respect: Implementing Microservice Identity And Access Management In Go
summary
Implements role-based access control by bundling a compact permission bitset into a JSON Web Token issued by an identity service and enforced by downstream Go microservices. Uses uint64 bitflags with iota, custom big-endian marshaling, and asymmetric JWT signing so tokens carry subject ID plus aggregated role permissions. Runs in production at Manifold for ~1.5 years, keeps headers tiny (one-week token lifetime), and reveals the surprising 64-permission limit early because the compiler fails when a 65th bit is added.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:17System Evolution
- 4:44Access Control Model
- 6:36RoleBased Access Control
- 9:00Simplicity
- 12:34Implementation
- 14:38Tokenization
- 17:23Features
- 22:15Manipulation
- 24:30Single Operations
- 25:08User Interface
- 26:49Questions
related talks
33mSecure your Go APIs with Decentralised Identity Tokens
01h 06mMicroservice Authentication and Authorization
38mAuthentication as a Microservice: Portable Customer Identity Management
39mMicroservice Security via MicroProfile JWT
19mOAuth and OpenID Connect for Microservices
14mAPI access control strategies beyond JWT bearer tokens
45mModern Identity Management in the Era of Serverless and Microservices
48mAdding business logic to your tokens. What could possibly go wrong