Suggestions for authorization in the sidekick component of microservice architecture

The article develops proposals on the feasibility of implementing authorization in the sidekick component of a microservice, which allows separating business logic from authorization tasks, logging, caching, etc. Such an implementation allows the main business modules to remain focused exclusively on their business logic, changing only when there are updates to business procedures, and tasks that are common to almost any modern solution to be transferred to auxiliary components such as a sidekick. Proper implementation of authorization is a key aspect of any system, it is very important and requires taking into account a large number of features and using best practices to ensure the safety of data from unauthorized access. The possibilities of the open-source Keycloak solution are considered. This solution is a very popular service for authentication/authorization, it supports standard identification protocols, such as: OpenID Connect, OAuth 2.0, SAML 2.0. The solution supports multi-factor authentication, supports containerization, and can be easily distributed in a microservices environment like Kubernates and integrated with various external services, including Google, Facebook, etc. The architecture and proposals necessary for integration with the sidekick component are developed. A study on the performance of the developed solution was conducted. Numerical values were obtained and presented in tables and graphs. Additionally, it can integrate with various external services, including Google, Facebook, and others. The article presents the architecture and method required for integration with a sidecar component and includes a performance analysis of the proposed solution. To enhance the performance further, the sidecar architecture incorporates a local caching mechanism, utilizing Caffeine cache — known for its high performance and effectiveness. This cache stores authorization tokens, significantly decreasing the volume of calls required to Keycloak by reusing the tokens stored locally until they expire. This mechanism reduces reliance on central Keycloak servers and minimizes latency, providing a performance boost through decreased network traffic and accelerated token retrieval processes. Extensive performance testing was conducted using the Gatling framework to validate the integration and caching strategy. These tests demonstrated that the sidecar configuration, equipped with the local Caffeine cache, maintained consistent performance under varying loads and was capable of horizontal scaling without degradation in response times. Moreover, the reduced load on the Keycloak servers showcased the effectiveness of the caching approach in minimizing backend calls for token validations. The approach confirms the robustness and scalability of the sidecar, poised to handle increased loads efficiently while safeguarding sensitive authorization data.

Nosko, S.

Sidecar

Національний університет «Полтавська політехніка імені Юрія Кондратюка»

info:eu-repo/semantics/article

application/pdf

https://journals.nupp.edu.ua/sunz/article/view/3681

Control, Navigation and Communication Systems. Academic Journal; Vol. 1 No. 79 (2025): Control, Navigation and Communication Systems; 116-123

uk

https://journals.nupp.edu.ua/sunz/article/view/3681/3020

http://creativecommons.org/licenses/by-nc/4.0