Authentication and authorization across microservices

1. A computer implemented method, comprising:

receiving an access request made to a microservice from a requesting entity, requesting access to the microservice, along with an access token;

obtaining an identity of the requesting entity from the access token;

identifying an access pattern used by the requesting entity, the access pattern representing computing actions performed to obtain the access token and request access to the microservice;

identifying permissions in an access policy, corresponding to the microservice, based on:

the identity of the requesting entity, and

the access pattern; and

generating, based on the permissions, an authorization output indicative of an authorization determination with respect to the access request.

2. The computer implemented method of claim 1 wherein the permissions in the access policy comprise;

a first permission corresponding a first access pattern, wherein the first permission defines authorization of access requests when the first access pattern is used to obtain an access token; and

a second permission corresponding a second access pattern different than the first access pattern, wherein the second permission defines authorization of access requests when the second access pattern is used to obtain an access token.

3. The computer implemented method of claim 1 , and further comprising:

before identifying the permissions, validating the access token comprising:

identifying access permissions corresponding to the access token; and

validating that the requested access is included in the access permissions.

4. The computer implemented method of claim 1 wherein generating the authorization output comprises:

if the permissions identified from the access policy include the requested access, then generating the authorization output authorizing the access request.

5. The computer implemented method of claim 1 wherein generating the authorization output comprises:

if the permissions identified from the access policy do not include the requested access, then generating the authorization output denying the access request.

6. The computer implemented method of claim 1 and further comprising:

registering authentication metadata for the requesting entity and for the microservice with an authentication server;

receiving, at the authentication server, an access token request from the requesting entity, requesting the access token; and

issuing the access token from the authentication server to the requesting entity based on the authentication metadata.

7. The computer implemented method of claim 1 wherein

identifying the access pattern comprises:

based on identifying that the requesting entity to which the access token is issued is an application that directly sent the access token to the microservice,

identifying the access pattern as a direct access pattern, and

identifying permissions in the access policy, corresponding to the application, comprises:

identifying the permissions in the access policy based on the identity of the application and the access pattern being a direct access pattern.

8. The computer implemented method of claim 1 wherein

identifying the access pattern comprises:

based on identifying that the requesting entity to which the access token is issued is an application that sends the access token to an intermediate microservice that forwards the access token to the microservice, identifying the access pattern as a protected forwarded access pattern, and

identifying permissions in the access policy, corresponding to the application, comprises:

identifying the permissions in the access policy based on the identity of the application and the access pattern being a protected forwarded access pattern.

9. The computer implemented method of claim 1 wherein

identifying the access pattern comprises:

based on identifying that the requesting entity to which the access token is issued is a service or microservice that obtains the access token without providing authentication for a specific set of permissions, identifying the access pattern as a high privileged access pattern, and

identifying permissions in the access policy, corresponding to the application, comprises:

identifying the permissions in the access policy based on the identity of the service or microservice which comprises the requesting entity and the access pattern being a high privileged access pattern.

10. The computer implemented method of claim 1 and further comprising:

logging interaction information, including the access request, an identity of the microservice, the identity of the requesting entity, an indicator of the access pattern, the permissions, an access policy identifier, and the authorization output indicative of the authorization determination, in an interaction processing system.

11. The computer implemented method of claim 10 and further comprising:

generating a risk assessment model based on the logged interaction information, the risk assessment model being configured to identify a risk assessment level based on interaction information provided to the risk assessment model during a runtime operation;

generating a runtime risk assessment level with the risk assessment model, corresponding to the interaction information provided to the risk assessment model during the runtime operation; and

returning risk assessment model with the authorization determination.

12. The computer implemented method of claim 1 , wherein the computing actions performed to obtain the access token comprise computing actions performed prior to receiving the access request.

13. A computer system, comprising:

one or more processors; and

memory storing instructions which, when executed by the one or more processors causes the one or more processors to perform steps comprising:

receiving an access request made to a microservice from a requesting entity, requesting access to the microservice, along with an access token;

obtaining an identity of the requesting entity from the access token;

identifying an access pattern used by the requesting entity to obtain the access token and request access to the microservice;

identifying permissions in an access policy, corresponding to the microservice, based on the identity of the requesting entity and the access pattern; and

generating an authorization output indicative of an authorization determination with respect to the access request.

14. The computer system of claim 13 wherein the instructions cause the one or more processors to perform steps further comprising:

before identifying permissions, validating the access token.

15. The computer system of claim 14 wherein validating the access token comprises:

identifying access permissions corresponding to the access token; and

validating that the requested access is included in the access permissions.

16. The computer system of claim 13 wherein generating the authorization output comprises;

if the permissions identified from the access policy include the requested access, then generating the authorization output authorizing the access request; and

if the permissions identified from the access policy do not include the requested access, then generating the authorization output denying the access request.

17. The computer system of claim 13 wherein identifying the access pattern comprises:

identifying that the requesting entity to which the access token is issued is an application that directly sent the access token to the microservice; and

identifying the access pattern as a direct access pattern, and wherein identifying permissions in the access policy, corresponding to the application, comprises identifying the permissions in the access policy based on the identity of the application and the access pattern being a direct access pattern.

18. The computer system of claim 13 wherein identifying the access pattern comprises:

identifying that the requesting entity to which the access token is issued is an application that sends the access token to an intermediate microservice that forwards the access token to the microservice; and

identifying the access pattern as a protected forwarded access pattern, and wherein identifying permissions in the access policy, corresponding to the application, comprises identifying the permissions in the access policy based on the identity of the application and the access pattern being a protected forwarded access pattern.

19. The computer system of claim 13 wherein identifying the access pattern comprises:

identifying that the requesting entity to which the access token is issued is a service or microservice that obtains the access token without providing authentication for a specific set of permissions; and

identifying the access pattern as a high privileged access pattern, and wherein identifying permissions in the access policy, corresponding to the application, comprises identifying the permissions in the access policy based on the identity of the service or microservice which comprises the requesting entity and the access pattern being a high privileged access pattern.

20. A computing system, comprising:

one or more hardware processors; and

memory storing instructions which, when executed by the one or more hardware processors, cause the computing system to:

provide a metadata management computing system;

serve, by an authentication server disposed in the metadata management computing system, a plurality of different sets of authentication metadata to a plurality of different microservices, each set of authentication metadata corresponding to a different microservice and identifying a context in which the corresponding microservice is permitted to authenticate, partitioned based on logical or physical partitions; and

serve, by an authorization server disposed in the metadata management computing system, a plurality of different sets of authorization policy metadata to a plurality of different microservices, each set of authorization policy metadata corresponding to a different microservice and identifying access permitted by the corresponding microservice by identifying permitted access in terms of permissions and access patterns and being partitioned based on logical or physical partitions.