Securing Your Services with Authentication, Authorization, and RBAC in gRPC
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 14:25· Ballroom Sec 20CD - San Diego Convention Center, Upper Level·
summary
Shows a working gRPC auth system that uses JWT tokens validated with either a shared secret or public/private keys and optionally via OpenID Connect (Keycloak, Dex). Implements authentication as a Go server gRPC interceptor that extracts Authorization metadata, verifies tokens with jwt-go, and injects claims into context. Builds RBAC by parsing info.FullMethod into service+API names, matching roles stored in config, and logs every call for audit. Demo stores token secrets as Kubernetes-namespaced secrets per tenant and proves tenant isolation for CSI storage calls.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 1:00History
- 2:22Sneaker Authentication
- 3:13Password Management
- 4:05Verification of Tokens
- 5:44GRPC Tokens
- 6:34Generating Tokens
- 7:54Pseudocode
- 9:07OpenID Connect
- 11:57Generic interceptor
- 12:52Authentication interceptor
- 14:19JWTGo
- 14:52Authorization Model
- 15:43HTTP verbs
- 16:11Roles
- 17:12Golang
- 20:16GRPC Gateway
- 20:49Rest
- 21:39Live Demo
- 22:24Demo Explanation
- 28:56Documentation
related talks
31mAuthentication and Security in gRPC Microservices
41mKubernetes Auth and Access Control
21mDeep Diving Into gRPC Security: A Case Study on API Security... - Dana White & Austin Pearigen
32mStop giving root access and start securing your Kubernetes clusters instead
26mFortifying gRPC Microservices: Beyond JWT with mTLS and SPIFFE
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew
18mMake Auth great again with Ory
33mSecure your Go APIs with Decentralised Identity Tokens