RBAC in multi tenant microservices

2
votes

I am part of development of multi-tenant cloud SaaS. Currently we have around 15 micro services. We are using mongo as backend with db per tenant as tenancy sepration. We are now trying to design rbac for the complete platform. Below are the questions I have regarding the same.

  1. Should i have a central authz micro-service for manage my rbac autz ? a. With this if authz service fails all micro-services are affected, and platform is prone or unusable.(bad) b. Service will store roles/permissions for all the resources across the micro-services.(good) c. For every request that comes to api gw post auth will go to authz and before calling micro-service it can be rejected.(good)

  2. Should i have a side car for each micro-service as my autz No single point of failure ... if authz fails for some service other service can continue to work.(good) Every service will have its on permissions ..(good) Auth service can store role and group info for permission it has to reach to individual service for its management (permission CRUD).(bad) Authz evaluation happens at individual service level.(not sure)

Any other approach ?

Thanks Jeet

1
authorizationmicroservicesmulti-tenantsaasrbac

1 Answers

2
votes

I would like to choose the below solution

  1. The API Gateway does the basic authentication check (token validity, tenant identification etc, client id validation etc), if any sanity check fails, returns a 401 from here

  2. In the individual Microservice, we will have a middleware that intercepts the requests and checks for the right permission against the resource (entity) that is being operated upon, incase of a lack of permission, let the microservice return a 403 from here.