Authentication & Authorization
Authentication = who you are (verify identity), Authorization = what you can do (check permission).
41.1 Why is it used?
- With every request you must know who the user is, otherwise anyone could view anyone else's order or account.
- In microservices each service cannot check passwords separately, so a central identity system and a token are needed.
- With SSO the user logs in once and gets into all apps (mail, HR, dashboard) without logging in again.
- RBAC/ABAC decides which actions a customer, seller or admin can perform.
- With MFA the account stays safe even if the password leaks (OTP, authenticator app, passkey).
41.2 How it works
- Session based: after login the server keeps the session in a session store (Redis) and gives the browser a session-id cookie. Logout/revoke is easy.
- JWT: the server issues a signed token (header.payload.signature), and every service verifies the signature and identifies the user without a DB call. Stateless, but hard to revoke.
- Access token + Refresh token: the access token is short-lived (5-15 min) and the refresh token gets a new access token, reducing the risk of theft.
- OAuth 2.0: an authorization protocol; in "Login with Google" the app does not get your password, only an access token with limited scope. For web apps use the Authorization Code + PKCE flow.
- OpenID Connect (OIDC): an identity layer on top of OAuth 2.0 that gives an ID token (JWT) carrying user info (sub, email).
- SSO: log in at one Identity Provider (IdP) and the other apps trust that login via SAML or OIDC.
- RBAC: permissions based on role (admin, seller, customer). ABAC: based on attributes (department, region, time, resource owner).
- MFA: two or more factors: something you know (password), something you have (phone OTP, TOTP app), something you are (fingerprint).
- 1.Mobile App: login with OTP / password (MFA OTP on a new device)
- 2.Identity Provider (Keycloak / Cognito / Auth0): verify password + MFA
- 3.IdP issues an access JWT (15 min) + refresh token (30 days, secure storage)
- 4.App sends Authorization: Bearer <JWT> on every call
- 5.API Gateway: verify the JWT signature with the IdP JWKS public key (no DB call, stateless, fast)
- 6.Order Service: check the role claim (RBAC); customer = only own orders, admin = all
- 7.On expiry, get a new access token with the refresh token
The 3 parts of a JWT: header ({"alg":"RS256"}) . payload (sub, role=customer, exp) . signature (by the IdP private key). It is Base64 encoded, NOT encrypted: do not put passwords or sensitive data in it.
- 1.Session: Browser cookie sid -> Server -> Redis session store (state on the server, logout / revoke easy)
- 2.JWT: Mobile Bearer JWT -> Service A / Service B, each service verifies by itself, no lookup (stateless, easy to scale, but hard to revoke)
- 3.Fix: short access token + revoke the refresh token
AuthN = who you are (login, MFA, OIDC). AuthZ = what you can do (RBAC / ABAC, OPA): a customer sees own orders, a seller edits own products, an admin handles all orders and refunds. OAuth 2.0 = authorization scoped token; OIDC = login / identity ID token.
41.3 Tools you can use
| Tool | Type | How it is used |
|---|---|---|
| Keycloak | Open-source IdP / IAM | Self-host it and manage OIDC, OAuth 2.0, SAML, SSO, MFA and roles all in one place. |
| Auth0 (Okta) | Managed identity SaaS | To set up customer login (B2C) quickly; social login, MFA and rules come ready-made. |
| AWS Cognito | AWS managed user pools | Easy signup, login and JWT tokens for mobile/web app users, plus an API Gateway authorizer in AWS. |
| Okta Workforce Identity | Enterprise SSO SaaS | SSO for employees: Office 365, Slack, AWS console all with one login, with MFA. |
| Microsoft Entra ID (Azure AD) | Azure identity service | Employee SSO, conditional access and MFA in Azure and Microsoft 365. |
| Open Policy Agent (OPA) | Policy engine | Write fine-grained authorization (ABAC) rules like code and enforce them in services. |
41.4 Comparison: Keycloak vs Auth0 vs AWS Cognito vs Okta
| Point | Keycloak | Auth0 | AWS Cognito | Okta |
|---|---|---|---|---|
| Type | Open-source, self-hosted | Managed SaaS | AWS managed service | Managed SaaS |
| Best for | Full control, on-prem or private cloud | Customer login, quick launch | Users of AWS-based apps | Enterprise employee SSO |
| Cost | License free, but servers and team cost | Based on monthly active users, can get expensive | Cheap, MAU based, free tier | Per user license, expensive |
| Setup effort | High - HA, upgrades yourself | Low | Low-medium | Low |
| Protocols | OIDC, OAuth2, SAML | OIDC, OAuth2, SAML | OIDC, OAuth2, SAML federation | OIDC, OAuth2, SAML |
| Customization | Very high (themes, SPI) | Good (Actions, rules) | Limited, via Lambda triggers | Good, enterprise policies |
| Scaling | You scale the cluster yourself | Vendor handles it | AWS auto scale | Vendor handles it |
41.5 When to choose which
- Keycloak: when you want data under your own control (bank, telecom, on-prem) and you have an ops team.
- Auth0: a startup that needs B2C login, social login and MFA quickly without infrastructure.
- AWS Cognito: the whole stack is on AWS and you want a cheap managed user pool.
- Okta / Entra ID: SSO for company employees and access control for SaaS apps.
- Session vs JWT: in a single monolith web app sessions are simple; in microservices/mobile JWT is better.
41.6 Real-world example
Such a scenario: Login + JWT flow in an e-commerce app
- The user logs in on the mobile app with OTP or password, and the request goes to the IdP (like Keycloak/Cognito).
- The IdP verifies the password and asks for an MFA OTP on a risky login (new device).
- On success the IdP issues a 15 min access token (JWT) and a 30 day refresh token.
- The app sends the header "Authorization: Bearer <JWT>" on every API call.
- The API Gateway verifies the JWT signature with the IdP public key (JWKS), with no DB call.
- The order service checks the role/claims in the JWT: a customer can see only their own orders, an admin can see all.
- When the access token expires the app gets a new token with the refresh token; on logout the refresh token is revoked.
41.7 Interview tips
- Putting passwords or sensitive data in a JWT: a JWT is only Base64 encoded, not encrypted.
- Issuing a long-lived access token (7 days); if stolen it cannot be revoked. Keep a short expiry + refresh token.
- Treating Authentication and Authorization as the same thing: always explain the difference in an interview.
- Calling OAuth 2.0 a login protocol; OIDC is for login/identity, OAuth is only for authorization.