MENA Phone Number Database

The third quality aspect is visibility. It is important to note that the FTGO group had implemented monitoring as well as logging in the current application. However, a microservice structure is one that is distributed platform, which presents other challenges. Each request is handled through the API gateway and at a minimum one service. For instance, imagine that you’re trying to figure out which of the six services are the cause of a delay. Imagine trying to figure out the way a request is handled when log entries are spread over 5 different service. To help you comprehend the behaviour of your application, and also to identify problems, you need to use observability patterns in a variety of ways.

This chapter begins by explaining how to implement security within the microservices architecture. In the next chapter, I explain the best ways to design services that can be configured. I will cover a couple of various mechanisms to configure services. In the next section, I will discuss how you can make your services simpler to comprehend and troubleshoot using patterns of observability. I conclude the chapter by explaining how you can make the process of implementing these and other problems by building your service built on microservice framework.

The development of secure services

Cybersecurity is now a major concern for every company. Every day, there are stories about hacker-related incidents that have stolen the company’s information. To create secure software and stay clear of the news the company must deal with a variety of security issues. These include physical security of hardware, the encryption of data during transit and in rest, authorization and authentication as well as pol-icies to patch software security vulnerabilities. The majority of these issues have similar regardless of whether you’re working with the monolithic or microservices architecture. This article focuses on how the microservices architecture can impact security on the application level.

A developer of applications is principally accountable for the implementation of four distinct elements of security

Authentication–Verifying the identity of the application or human (a.k.a. the primary) that is trying to access the application. For instance, an application usually validates the credentials of the principal like an account ID and password, or the API key of an application and secret.

Authorization–Verifying that the principal is allowed to perform the requested operation on the specified data. Most applications make use of a combination of access control lists (ACLs). Role-based security gives every user either one of the roles which give users the ability to execute specific actions. ACLs give users or roles the ability to execute operations on specific business object, or an aggregate.

Auditing–Recording the activities that the principal is performing in order to spot security concerns and assist customer support and ensure conformity.

Secure interprocess communication–Ideally, all communication in and out of ser-vices should be over Transport Layer Security (TLS). Interservice communications may need to be authenticated.

I discuss auditing in depth within section 11.3 and discuss security for inter-service communication when I discuss meshes of service within section 11.4.1. This section is focused on the implementation of the authentication process and authorization.

I start by describing the way security is implemented within the FTGO monolith application. I then discuss the difficulties when implementing security in microservice architecture, and explain why methods that work in a monolithic framework are not suitable for microservice architecture. Then I discuss how to implement security within the microservices architecture.

Let’s begin by looking at the way in which this monolithic FTGO program handles security.

A look at security in a monolithic traditional application

The FTGO application supports a range of human users, such as consumers, customers, and restaurant employees. Users access the application via mobile and browser-based applications. All FTGO users need to sign in to access the application. Figure 11.1 illustrates how clients of the single-sided FTGO application authenticate and send requests.

Once a user has logged into their account using their username with a password and user ID, the user creates an POST request that contains the user’s credentials to FTGO application. The FTGO application validates the credentials and provides an account token for the user. The client is able to include the session token in every next request made to the FTGO application.

Utilizing an appropriate security framework

The process of implementing authentication and authorization properly is a challenge. It is best to choose a well-established security framework. Which framework you should choose depends on your application’s technology stack. A few frameworks that are popular include:

Spring Security
A well-known frame-work framework for Java applications. It’s an advanced framework that handles authorization and authentication.

Apache Shiro

The primary component of the security architecture is the session that stores the principal’s identification and the roles. This FTGO program is classic Java EE application, so the session is an in-memory HttpSession session. A session is identified through an identification token for the session, which clients include in every request. It’s typically an opaque token, such as an cryptographi-cally secure random number. The FTGO session token used by the application comprises an HTTP cookie known as JSESSIONID.

Another important aspect that is part of security’s implementation are the context that stores the information of the person who is making the request. It is a part of the Spring Security framework uses the standard Java EE approach of storing the security context as an unchanging, thread-local variable that is easily accessible to any program that is called to help handle the request. A request handler can call SecurityContextHolder.getContext()
.getAuthentication() in order to get details about the user currently in use including their identity and role. However the Passport framework keeps the security context in the attribute for the user in the request.
In the sequence illustrated in the figure 11.2 is as like this:

The client sends an registration request with the FTGO application.

Login requests are handled through LoginHandler that checks credentials, creates the session and saves details about the person who initiated the session.

Login Handler gives an account token to the client.

The client will include the session token in all requests that call operations.

These requests are first processed by SessionBasedSecurityInterceptor. The interceptor authenticates every request by confirming the session token. It then creates the security context. The security context outlines the role of the principal as well as its responsibilities.

www.EBooksWorld.ir
Making secure services 353

A request handler utilizes the context of security to decide whether it is appropriate to permit users to complete the requested action and verify their identity.

The FTGO application is based on the concept of role-based authorization. It defines a variety of roles that correspond to the various types of users, such as COURIER, CONSUMER, RESTAURANT and ADMIN. It utilizes the declarative security method for limiting access to URLs and other service methods to certain roles. Roles are also incorporated into the logic of business. For instance, a customer is able to only view their purchases while an administrator can access all orders.

The security strategy employed in the single-sided FTGO application is just one of the ways for implementing security. One disadvantage of using an in-memory based session has to do with the fact that that all requests made for the same session to be sent to the exact application instance. This can cause problems with load balancing and operation. For instance, you must install an automatic session draining system which will wait for the expiration of all sessions before shutting down an instance. Another option, which can solve these issues is to record the session data in databases.

Sometimes, you can get rid of the server-side session altogether. In particular, many applications use API clients that are able to provide credentials, like an API secret and key, with every request. This means that there is no need to keep an on-server session. In addition, the application could keep session data by using a session token. In the next section, I will describe a method of using the session token to store the session’s state. However, let’s look at the issues involved in creating security within the microservices architecture.

11.1.2 Implementing security within a microservices architecture

Microservices are an open and distributed architecture. Every request from outside is processed via the API gateway and at a minimum one service. Take, for instance, an order-details() request, which is discussed in chapter 8. The API gateway responds to this query through a variety of services, such as Order Service, Kitchen Service as well as Accounting Service. Each service must incorporate certain features of security. For example, Order Service must only permit customers to view their order, which requires a combination of authorization and authentication. To implement security within a micros-ervice structure, it is necessary to identify who is accountable to authenticate the user and who is accountable for authorization.

One issue that comes with implementing security in microservices is that it’s not possible to duplicate the design of an application that is monolithic. It’s because two components of the security architecture used in monolithic applications are not suitable in a microservices architecture:

In-memory security context – Using an in-memory security context like a thread local, to transfer user identities. Services aren’t able to share memory, therefore they aren’t able to make use of an in-memory security context like a thread-local to transfer user’s identity. In a microservice-based architecture, we require an alternative method of passing user identities between services.

Centralized session – Because an in-memory security context does not have any logic, nor does an in-memory-session. In theory, several applications could connect to the database-based session, with the exception that it violates the notion of loose communication. It is necessary to have a distinct session mechanism for microservices in an architecture.

Let’s start our investigation of security within microservices by exploring how to manage authentication.

AUTHENTICATION OF HANDLING IN THE API GATEWAY

There are many various ways to manage authentication. One possibility is for specific services that authenticate users. The problem with this option is that it allows unauthenticated requests to access the network. It depends on every developer implement security across all their applications. In the end, there’s a substantial chance that an application could be vulnerable to security flaws.

Another issue when implementing authentication into the API is that different clients are authenticated in different ways. Pure API clients provide credentials with each request by using the example of basic authentication. Others clients may first sign into their account and then issue an account token on every request. We do not want to require services to manage a wide range of authentication methods.

The best approach is to allow API gateways API gateway to verify requests prior to forwarding them to the API services. Centralizing API authentication through the API gateway is advantageous in that there’s only one spot to ensure the right authentication. This means that there’s a lower risk of security vulnerabilities. Another advantage is the fact that just the API gateway is required to manage the different authentication methods. This complexity is hidden from the API services.

Figure 11.3 illustrates how this strategy functions. Clients authenticate using an API gate-way. API clients add credentials to every request. Login-based clients post the credentials of the user into the gateway’s API authentication service and receive an authorization token for the session. After an API gateway is authenticated the request, it will invoke one or more of the services.

Pattern Access token

The API gateway sends an ID token that contains details concerning the individual user including their identity as well as their role and roles to the API services it calls.

A service called via the API gateway must know the identity of the person who made the request. It also needs to verify that the request is authenticated. The best solution is for API gateways to API gateway to add an authentication token with every service request. The service utilizes the token to validate the request and gather information regarding the main. The API gateway may offer the token to clients who are oriented towards session for use as the session token.

Sequence of Events that are available for API clients follows:

A customer sends an inquiry with credentials.

API gateway API gateway authenticates credentials and then creates an encryption token and transmits it to the service.

Login-related clients’ sequence follows as the following:

A user makes an account login request with credentials.

The API gateway will return the security token.

The client will include the security token in all requests which invoke operations.

The API gateway authenticates the security token, before forwarding it on to the appropriate service service.

In the next chapter, I’ll explain the process of implementing tokens, however, let’s first consider the second aspect of security that is authorization.

HANDLING AUTHORIZATION

The authentication of credentials for a client is crucial, but not sufficient. A program must also incorporate an authorization mechanism that ensures that the client is authorized to carry out the operation. For instance within the FTGO application, the obtainOrderDetails() query is only able to be used by the person who made the purchase (an example of security based on an instance) as well as a customer service agent who assists the customer.

The best place to implement authorization is via the API gateway. It could, for instance restrict access to GET orders/orderId only those who are customers and customer service agents. If a user isn’t permitted to access a specific path the API gateway may deny the request and then forward it to the provider. Similar to authentication centralizing authorization in the API gateway decreases the chance of security vulnerabilities. You can enable authorization in the API gateway with security frames-work for example, Spring Security.

One disadvantage of the implementation of authorization within API gateway API gateway is the risk of coupling the API gateway to the service which require the updates to occur in lockstep. Additionally the API gateway will typically only grant roles-based access to URL paths. It’s usually not feasible to expect an API gateway to implement ACLs to control access to specific domain objects since it requires a thorough knowledge of the domain functionality.

Another location to implement authorization is within the service. The service can implement the role-based authentication for URLs and for methods used by service providers. It is also able to implement ACLs to control the access of aggregates. Order Service can, for instance, implement a ACL-based, role-based authorization system to manage accessibility to order. Other services within the FTGO application also use similar authorization rules.

Utilizing JWTS to verify user IDENTITY and ROLE

When you are implementing security into microservice architectures you must decide which kind of token your API gateway will utilize to transmit user data to the API services. There are two kinds of tokens you can select from. Another option is to choose opaque tokens, that are generally UUIDs. The drawback to opaque tokens are that they decrease the availability and performance of the token and also increase the time to complete. The reason for this is that the user of such tokens must perform a synchronous RPC connection to a secure provider to verify the token and retrieve the information of the user.

Another alternative, which removes the need for the security service is to use a clear token that contains details concerning the individual. One popular standard used for tokens that are transparent is JSON Web Token (JWT). JWT is a standard method to securely convey claims, like identities and roles of the user among two people. JWTs are used to represent claims between two parties. JWT includes a payload which is an JSON object that has details about the user like their identity and roles, and also other metadata like the expiration date. The JWT is signed using an encryption method that is only available only to the author of the JWT and its recipients, like the API gateway as well as the user who is receiving the JWT for example, the service. The secret makes sure that any malicious third party cannot forge or alter the JWT.

One problem one issue JWT is that, since the token is self-contained, it is irrevocable. The way it is designed, a service can only perform the request following verification of the signature of the JWT and its expiration date. This means that there is no way to remove a JWT that’s been slipped to the hands of a malicious third-party. It is possible to issue JWTs that have expiration dates that are short since this restricts the amount of damage a malicious person can accomplish. The drawback with short-lived JWTs however is that the program must constantly reissue JWTs to keep the session running. It is a good thing that this is only one of numerous protocols that can be solved with a security standard called OAuth 2.0. Let’s examine how that operates.

Utilizing OAUTH 2.0 In A Micro-Service Architecture

Let’s suppose you decide to develop the user Service to the FTGO application to manage the database of users that contains information such as the user’s credentials and roles. The API gateway makes calls to it the User Service to authenticate a client’s request, and to receive an JWT. You can develop an API for a User Service API and implement it with your preferred web framework. However, that’s a generic feature that’s not specific for the FTGO application. The development of this kind of service would not be an efficient usage for development resource.

It’s not necessary to build this type system of infrastructure for security. It is possible to use an off-the-shelf solution or framework that uses a standard known as OAuth 2.0. OAuth 2.0 is an authorization protocol initially designed to allow users of a public cloud-based service, such as GitHub or Google to give an application from a third party access to its data without divulging their password. For instance OAuth 2.0 is the method by which you lets you securely grant a third-party cloud-based Continuous Integration (CI) service access to your GitHub repository.

While the primary goal for OAuth 2.0 was to allow access to cloud services that are accessible to the public however, you can also utilize it to authorize and authenticate within your application. Let’s have a review of how an microservices-based architecture could use OAuth 2.0.

About OAuth 2.0

OAuth 2.0 is a difficult issue. This chapter I will only give an overview of the topic and explain how it could be utilized within a microservices-based architecture. For more details on OAuth 2.0 take a look at the book online OAuth 2.0 Servers, written by Aaron Parecki (www.oauth.com). Chapter 7 of Spring Microservices in Action (Manning, 2017) also covers this topic (https://livebook.manning.com/#!/book/spring-microservices-in-action/chapter-7/).

The fundamental concepts in OAuth 2.0 are as follows:

Authorization Server provides an API to authenticate users and issuing an access token as well as refresh token. Spring OAuth is a fantastic example of a framework to use for creating the OAuth 2.0 Authorization Server.

Access Token – A token that allows access to the Resource Server. The structure of access tokens is dependent on the implementation. However, some implementations, like Spring OAuth, use JWTs.

Refresh Token – A long-lived, yet non-revocable token which a Client utilizes to get a new AccessToken.

Resource Server is a service that utilizes access tokens to grant access. In a microservices-based structure, the services are resource servers.

Client is a user who wants access to the API Gateway Resource Server. In a microservices architecture, API Gateway is the OAuth 2.0 client.

In this section, I will explain the methods to support login-based clients that require logins. First we’ll discuss the process of authenticating API clients.

Figure 11.4 illustrates what happens when the API gateway authenticates an request from the API client. The API gateway authenticates the API client through an OAuth 2.0 authorization server, which will return an access code. The API gateway makes an additional request with this access token and connects to service.
In the sequence depicted in Figure 11.4 is as the following:

The client sends an inquiry, providing the credentials required using basic authentication.

The API gateway makes an OAuth 2.0 Password Grant request (www.oauth.com/ oauth2-servers/access-tokens/password-grant/) to the OAuth 2.0 authentication server.

The authentication server checks that the API client’s credentials, and then returns an access token as well as refresh token.

The API gateway uses access tokens in requests it sends to services. A service checks the access token and then uses it to approve the request.

A OAuth 2.0-based API gateway is able to authenticate clients that are session-oriented through the use of the OAuth 2.0 access token to act as the session token. Furthermore once an access token is expired it is able to get a fresh access token by using it as a refresh token. Figure 11.5 illustrates the way one API gateway can make use of OAuth 2.0 to manage clients that are session-oriented. A client that is an API cli-ent starts sessions by sending its login credentials through the gateway’s /login access point. The API gateway sends an access token as well as refresh token for the user. The API client will then provide both tokens whenever it sends request to API gateway.

This sequence runs as the following:

The client that logs in sends its credentials to the API gateway. API gateway.

The API gateway’s Login Handler makes an OAuth 2.0 Password Grant request (www.oauth.com/oauth2-servers/access-tokens/password-grant/) to the OAuth 2.0 authentication server.

The authentication server verifies the credentials of the client, and then returns an access token as well as an update token.

The API gateway provides access and refresh tokens back to the client in the form of cookies, for example.

The client is able to include accessibility and refresh tokens when it makes requests it sends for the gateway API.

The gateway’s API Session Authentication Interceptor validates the access token, and then includes it in the requests it sends to the API gateway.

If the access token has expired or is about to expire, the API gateway obtains a new access token by making an OAuth 2.0 Refresh Grant request (www.oauth.com/ oauth2-servers/access-tokens/refreshing-access-tokens/), which contains the refresh token, to the authorization server. When the refresh certificate isn’t expired or been removed the authorization server will return an access token that is new. API Gateway passes the new access token to the service and returns it to the customer.

The main benefit that comes with using OAuth 2.0 is that it’s a reputable security standard. The use of an off-the-shelf version of the OAuth 2.0 authentication server means that you won’t need to spend time re-inventing the wheel or risk creating a sloppy design. However, OAuth 2.0 isn’t the only method of implementing security in the microservices architecture. No matter which method you decide to use, three fundamental concepts are:

It is the API gateway is the one responsible for authenticating customers.

The API gateway and services employ an opaque token, like JWT, to transmit details about the primary.

A service utilizes the token to determine the identity and role of the principal.

After we’ve examined ways to secure services Let’s look at ways to make them customizable.

Designing configurable services

Imagine you’re in charge of the Order History Service. As the figure 11.6 illustrates that the service consumes data that originate from Apache Kafka and writes and reads AWS DynamoDB table items. To enable the service to function it must have a number of settings, such as the location on the network of Apache Kafka and the credentials as well as the location of the network to AWS DynamoDB.

The value of these properties in the configuration are dependent on the environment that the service is operating in. For example, the development and production environments utilize various Apache Kafka brokers and different AWS credentials. It’s not sensible to connect a specific system’s properties in the configuration of the deployable service, since it will require that it be rebuilt for each specific environment. Instead, a service must be constructed once by the deployment pipeline, and then placed into multiple environments.

Also, it’s not sensible to wire different kinds of configuration properties in the source code, and then use for instance the profile mechanism of Spring Framework to select the correct setting at the time of execution. This is due to the fact that doing so could expose a vulnerability to secu-rity and limit the areas where it can be used. Additionally, sensitive data such as credentials should be stored securely using a secrets storage mechanism, such as Hashicorp Vault (www.vaultproject.io) or AWS Parameter Store

Instead, you should provide the correct configuration properties to the service during runtime through this Externalized design pattern for configuration.

Pattern Externalized configuration

Externalized configuration mechanisms provide the values for configuration properties to the service instance at the time of execution. There are two primary methods:

Push model: The deployment infrastructure transmits the settings on to the instance through such things as operating system environment variable-ables or an configuration file.
Pull model – The service instance retrieves its configuration parameters from an con-figuration server.

We’ll examine each method beginning from the “push” model.
Utilizing external configurations that are push-based

The push model is based on the collaboration between both the environment for deployment and service. The deployment environment is responsible for the settings properties whenever it creates a service. As the figure 11.7 illustrates, pass the configuration properties as environment variables. Or the deployment environment could use the configuration properties to create an configuration file. The service instance reads the properties of the configuration when it begins to run.
The environment for deployment and the service have to be in agreement on the way that properties for configuration are delivered. The exact mechanism is contingent on the particular deployment environment. For instance chapter 12 explains how you can define the environment variables that are required by the Docker container.

Let’s say you’ve made the decision to provide externalized values for configuration properties with the help of environment variables. The application you’re using could use System.getenv() for you to find the values of these variables. However, if you’re an Java developer most likely, you’re using a framework that offers an easier method of doing this. The FTGO services are built using Spring Boot, which has an extremely flexible externalized configuration mechanism that retrieves configuration properties from a variety of sources with well-defined pre-cedence rules (https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-external-config.html). Let’s take a look at the way it works.

Spring Boot reads properties from many sources. I have found the following sources helpful in a microservices architecture:
Command-line arguments

SPRING_APPLICATION_JSON, an operating system environment variable or JVM system property that contains JSON

JVM System properties

Operating system variables for environment

A configuration file is located in the directory currently in use

A specific property value from a source earlier on this list will override the exact prop-erty value from a source later on in this list. For instance the operating system’s environment variables can override properties taken from an configuration file.

Spring Boot makes these properties accessible for users of the ApplicationContext of the Spring Framework. ApplicationContext. A service may take, for instance, an object’s value by using the annotation @Value:

public class OrderHistoryDynamoDBConfiguration {

@Value(“$”)

private String awsRegion

Spring Framework Spring Framework initializes the awsRegion field with the values of the aws.region property. This property is obtained by one of the resources mentioned earlier, like an config-uration or the AWS_REGION variable in the environment.

It is a successful and widely-used method for reconfiguring a server. The only drawback is that reconfiguring an operating service can be challenging, but not impossible. The deployment infrastructure may not permit you to alter the external configuration of a running process without re-starting it. For instance, you can’t modify the environment variables for a running process. Another drawback is the risk of the property values used for configuration being scattered across the definition of many services. This means that you might want to think about using a pull-based approach. Let’s take a look at the way it is done.

Its Spring Cloud Config project is an excellent example of a server-based configuration framework. It is comprised of an application server and client. The server is able to support a range of backends that store the configuration data, such as databases, version control systems along with Hashicorp Vault. The client pulls configuration property from the server and then injects those properties into the Spring ApplicationContext.

The use of a configuration server comes with many advantages:

Centralized configuration: All the properties of the configuration are kept all in one place and are therefore easier to manage. Furthermore, to remove duplicate configuration properties, certain applications allow you to set general defaults, which can be changed on an individual basis.

Secure encryption of sensitive data – Encrypting sensitive data like database credentials is a best method. The issue with encryption is that the typical service application must decrypt the data, which is why it needs encryption keys. Certain configuration server implementations automatically decrypt properties prior to giving them back to service.
Dynamic reconfiguration – A service might detect changes in property values by for instance, polling, and then reconfigure the service itself.

The biggest drawback of using a server for configuration is that, unless provided from the existing infrastructure it’s an additional piece of infrastructure that must be established and maintained. There are many open source frameworks like Spring Cloud Config, that allow for easier running an infrastructure server for configuration.

We’ve now looked at the ways to design configurable services Let’s discuss how to create observable services.

The design of observable services

Let’s say that you’ve put the FTGO application to production. You’ll probably would like to know how the application is performing: the number of requests it receives per second (RPS), resource usage and so on. Also, you should be aware of a issue, like the service instance failing or a disk that is filling up before it affects the user. If there’s any issue, you’ll need to be able to solve the issue and determine the root of the issue.

The management of production of an application are beyond the control of the developer, for instance monitoring the availability of hardware and its utilization. These are the main responsibility of the operations. However, there are a few ways that you as a ser-vice developers need to implement in order to simplify your service’s manage and troubleshoot. These patterns, as shown in the figure 11.9 show the behavior of your service and health. They permit the monitoring system to observe and show the condition of a service and issue alerts in the event of an issue. They also help in identifying issues easier.

Distributed tracing – Give each external request an ID unique to it and track requests when they are transferred between services.

Exception tracking–Report any exceptions in an exception-tracking system, that de-duplicates the exceptions, informs developers and monitors the resolution of every exception.

Application metrics–Services store metrics, like gauges and counters, then connect them to a server for metrics.

Audit logging — Log user actions.

One distinctive characteristic of many the patterns mentioned is every pattern includes both a developer and operations component. For instance, take this Health check API. The developer is accountable to ensure that their service is able to implement an endpoint for health checks. Operations is the responsible monitoring system which periodically calls the API for health checks. In the same way, for the Log aggregated pattern, the developer is responsible for making sure that their services record relevant information, while operations is accountable for the log collection.