Suggestions for authorization in the sidekick component of microservice architecture

Abstract

The article develops proposals on the feasibility of implementing authorization in the sidekick component of a
microservice, which allows separating business logic from authorization tasks, logging, caching, etc. Such an implementation
allows the main business modules to remain focused exclusively on their business logic, changing only when there are updates to
business procedures, and tasks that are common to almost any modern solution to be transferred to auxiliary components such as
a sidekick. Proper implementation of authorization is a key aspect of any system, it is very important and requires taking into
account a large number of features and using best practices to ensure the safety of data from unauthorized access. The possibilities of the open-source Keycloak solution are considered. This solution is a very popular service for authentication/authorization,
it supports standard identification protocols, such as: OpenID Connect, OAuth 2.0, SAML 2.0. The solution supports multi-factor
authentication, supports containerization, and can be easily distributed in a microservices environment like Kubernates and integrated with various external services, including Google, Facebook, etc. The architecture and proposals necessary for integration
with the sidekick component are developed. A study on the performance of the developed solution was conducted. Numerical
values were obtained and presented in tables and graphs. Additionally, it can integrate with various external services, including
Google, Facebook, and others. The article presents the architecture and method required for integration with a sidecar component
and includes a performance analysis of the proposed solution. To enhance the performance further, the sidecar architecture incorporates a local caching mechanism, utilizing Caffeine cache — known for its high performance and effectiveness. This cache
stores authorization tokens, significantly decreasing the volume of calls required to Keycloak by reusing the tokens stored locally
until they expire. This mechanism reduces reliance on central Keycloak servers and minimizes latency, providing a performance
boost through decreased network traffic and accelerated token retrieval processes. Extensive performance testing was conducted
using the Gatling framework to validate the integration and caching strategy. These tests demonstrated that the sidecar configuration, equipped with the local Caffeine cache, maintained consistent performance under varying loads and was capable of horizontal scaling without degradation in response times. Moreover, the reduced load on the Keycloak servers showcased the effectiveness of the caching approach in minimizing backend calls for token validations. The approach confirms the robustness and scalability of the sidecar, poised to handle increased loads efficiently while safeguarding sensitive authorization data.