Pre-authorization for service-to-service requests
Methods and systems for authorizing a service request between two services in a network environment are disclosed. One method includes, in a recurring background process occurring separate from a service request, having a target service obtain a pre-authorization token including a signature of the request service. In response to confirming the pre-authorization token was issued by the request service, the pre-authorization token is acknowledged and stored for access by instance(s) of the target service. The acknowledged pre-authorization token is saved for use with service requests to the target service from the request service. In response to receiving a service request including pre-authorization token at an instance of the target service, the method confirms the pre-authorization token matches a stored, acknowledged pre-authorization token, and, if so confirmed, authorizes the service request. Pre-authorization tokens have a set duration. The methods and systems reduce computational overhead of the authorization, resulting in decreased latency.
1. A method for authorizing a service request between two services in a network environment, the method comprising:
in a recurring background process occurring between a first service and a second service:
obtaining, at the second service, a pre-authorization token from the first service, the pre-authorization token including a signature of the first service,
confirming, at the second service, that the pre-authorization token was issued by the first service specified in the signature,
in response to the second service confirming that the pre-authorization token was issued by the first service specified in the signature, generating, at the second service, an acknowledgement of the pre-authorization token, and
storing, by the second service, the acknowledged pre-authorization token for access by any instance of the second service;
and, separate from the recurring background process:
in response to receiving the service request from the first service including the pre-authorization token at an instance of the second service, confirming, at the instance of the second service, the pre-authorization token matches the stored, acknowledged pre-authorization token, and, in response to the confirmation, authorizing, by the instance of the second service, the service request from the first service,
wherein the recurring background process further comprises generating the pre-authorization token at the first service and publishing, by the first service, the pre-authorization token as an event to a topic, wherein the first service and the second service subscribe to events published to the topic.
2. The method of claim 1 , further comprising in response to receiving the service request from the first service including the pre-authorization token at the instance of the second service and not confirming the pre-authorization token matches the stored, acknowledged pre-authorization token, indicating, by the instance of the second service, the service request is unauthorized.
3. The method of claim 1 , wherein the second service includes a plurality of instances of the second service, and wherein the pre-authorization token is configured for validation by a predetermined one of the plurality of the instances of the second service.
4. The method of claim 3 , wherein each instance of the second service subscribes to events published to the topic.
5. The method of claim 4 , wherein storing the acknowledged pre-authorization token for access by any instance of the second service includes storing the acknowledged pre-authorization token for a set duration.
6. The method of claim 5 , wherein the recurring background process: generates, by the first service, another pre-authorization token after expiration of the set duration, and publishes, by the first service, the another pre-authorization token as an event to the topic.
7. The method of claim 1 , further comprising publishing, by the second service, the acknowledgement as an event to the topic.
8. A system for authorizing a service request between two services in a network environment, the system comprising:
a target service configured to run a recurring background process occurring between a request service and the target service, the recurring background process including:
obtaining, at the target service, a pre-authorization token from the request service, the pre-authorization token including a signature of the request service,
confirming, at the target service, that the pre-authorization token was issued by the request service specified in the signature,
in response to the target service confirming that the pre-authorization token was issued by the request service specified in the signature, generating, at the target service, an acknowledgement of the pre-authorization token, and
storing, in a storage device, by the target service, the acknowledged pre-authorization token for access by any instance of the target service;
and, separate from the recurring background process,
in response to receiving the service request from the request service including the pre-authorization token at an instance of the target service, confirming, at the instance of the target service, the pre-authorization token matches the stored, acknowledged pre-authorization token, and, in response to the confirmation, authorizing, by the instance of the target service, the service request from the request service,
wherein the recurring background process further comprises generating the pre-authorization token at the request service and publishing, by the request service, the pre-authorization token as an event to a topic, wherein the request service and the target service subscribe to events published to the topic.
9. The system of claim 8 , further comprising in response to receiving the service request including the pre-authorization token at the instance of the target service and not confirming the pre-authorization token matches the stored, acknowledged pre-authorization token, indicating, by the instance of the target service, the service request is unauthorized.
10. The system of claim 8 , wherein the target service includes a plurality of instances of the target service, and wherein the pre-authorization token is configured for validation by a predetermined one of the plurality of instances of the target service.
11. The system of claim 10 , wherein each instance of the target service subscribes to events published to the topic.
12. The system of claim 8 , further comprising publishing, by the target service, the acknowledgement as an event to the topic.
13. The system of claim 8 , wherein the storage device is configured to store each acknowledged pre-authorization token for access by any instance of the target service for a set duration.
14. The system of claim 8 , wherein the storage device is configured to publish the acknowledgement and the pre-authorization token as an event posted thereto, wherein each of the request service and the target service subscribe to events published to the storage device.
15. A method for authorizing a service request between two services in a network environment, the method comprising:
in a recurring background process occurring between a first service and a second service:
generating, at a first service, a pre-authorization token including a signature of the first service,
publishing, by the first service, the pre-authorization token,
validating, at the second service, that the pre-authorization token was issued by the first service specified in the signature, and in response to validating the pre-authorization token, generating, at the second service, an acknowledgment acknowledging validation of the pre-authorization token as being issued by the first service specified in the signature in the pre-authorization token, and
storing, by the second service, the acknowledged pre-authorization token for access by the first service;
and, separate from the recurring background process:
transmitting, by the first service, the service request including the acknowledged pre-authorization token to the second service; and
receiving, at the first service, an authorization, from the second service, for the service request,
wherein the recurring background process further comprises generating the pre-authorization token at the first service and publishing, by the first service, the pre-authorization token as an event to a topic, wherein the first service and the second service subscribe to events published to the topic.
16. The method of claim 15 , wherein the second service includes a plurality of instances of the second service, wherein the pre-authorization token is configured for validation by a predetermined one of the plurality of instances of the second service, and wherein the first service publishes the pre-authorization token to the plurality of instances of the second service.
17. The method of claim 15 , wherein the signature includes a signed cryptographic value.
18. The method of claim 15 , wherein the second service includes a plurality of instances of the second service, and wherein each instance of the second service subscribes to events published to the topic.
19. The method of claim 15 , wherein storing the acknowledged pre-authorization token includes storing the acknowledged pre-authorization token for a set duration.
20. The method of claim 19 , wherein during the recurring background process, the first service generates another pre-authorization token after expiration of the set duration, and the first service publishes the another pre-authorization token as an event to the topic.
21. A system for authorizing a service request between two services in a network environment, the system comprising:
wherein the request service is configured to perform a recurring background process with a target service, the recurring background process including:
generating, at the request service, a pre-authorization token including a signature of the request service,
publishing, by the request service, the pre-authorization token,
validating, at the target service, that the pre-authorization token was issued by the request service specified in the signature, and in response to validating the pre-authorization token, generating, at the target service an acknowledgment acknowledging validation of the pre-authorization token as being issued by the request service specified in the signature in the pre-authorization token, and
storing, in a storage device, the acknowledged pre-authorization token for access by the request service;
and, separate from the recurring background process:
transmitting, by the request service, the service request including the acknowledged pre-authorization token to the target service; and
receiving, at the request service an authorization from the target service for the service request,
wherein the recurring background process further comprises publishing, to the storage device, the acknowledgement and the pre-authorization token as an event, wherein the request service and the target service subscribe to events published to the storage device.
22. The system of claim 21 , wherein the target service includes a plurality of instances of the target service, and wherein the pre-authorization token is configured for validation by a predetermined one of the plurality of instances of the target service.
23. The system of claim 22 , wherein each instance of the target service subscribes to events published to the storage device.
24. The system of claim 21 , wherein the pre-authorization token is valid for a set duration, and wherein the request service is further configured to generate another pre-authorization token after an expiration of the set duration, and publish the another pre-authorization token as an event to the storage device.