11.1. Authentication and Authorization
Authentication answers “who are you”; authorization answers “what may you do” — and in a distributed system both must work for service-to-service calls, not just human logins, at every hop and without a shared session store. This chapter covers OAuth 2.0 and OIDC as the delegation and identity standards, JWT as the stateless token that carries claims across services, the API-key-versus-service-account choice for machine identity, and the RBAC and ABAC models for expressing what an authenticated principal is permitted to do.
Topics Covered
Section titled “Topics Covered”- 11.1.1. OAuth 2.0 & OIDC: Identity Management in a Distributed Environment: Covers OAuth 2.0 for delegated authorization and OIDC for identity in a distributed environment.
- 11.1.2. JWT: Signing, Verification, and Refresh Strategies: Explains JWT signing, verification, refresh strategies, and the alg-confusion attack to defend against.
- 11.1.3. API Key vs. Service Account: Service Identity: Compares API keys and service accounts for establishing machine-to-machine identity.
- 11.1.4. RBAC vs. ABAC: Authorization Models: Contrasts role-based and attribute-based access control for expressing authorization policy.
- 11.1.5. Workload Identity: Service Identity with SPIFFE / SPIRE: Covers workload identity with SPIFFE/SPIRE, giving services cryptographic identities without embedded secrets.