Auth and Distributed Systems: Don’t Throw the Baby Out with the Bathwater of Auth
summary
The talk compares centralized authorization servers versus bearer-token (e.g., JWT) based distributed authentication for microservice architectures, focusing on resilience trade-offs. It explains how to choose between centralized and distributed approaches, surveys bearer-token options, describes deployment architectures (auth gateway, direct integration), and lists essential features to implement (token refresh, revocation, key rotation), and presents the Biscuit platform built around these use cases.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:27Authentication and authorization
- 4:15Distributed systems problems
- 8:59Centralization versus decentralization
- 10:47Tokens and mitigation
- 13:34Authorization language with Datalog
- 17:14Revocation management
- 19:02Least privilege principle
- 21:53Introducing Biscuit
- 23:42Attacks and solutions with Biscuit
- 26:55Token delivery service
- 28:27Summary and call for contributions
- 28:50Q&A: Biscuit alternatives
- 31:02Q&A: Identity federation
- 32:17Q&A: JWT migration
related talks
46mAuth and Distributed Systems: Don't Throw the Baby Out with the Bathwater
31mAuthentication/Authorization Starters Battle
01h 06mMicroservice Authentication and Authorization
19mOAuth and OpenID Connect for Microservices
38mAuthentication as a Microservice: Portable Customer Identity Management
58mLet's talk Auth
13mService Authentication - Tokens or Certificates?
14mAPI access control strategies beyond JWT bearer tokens