Authorization for Microservices

As part of our award-winning solution, the Axiomatics Policy Decision Point (PDP) uses policies and attribute data (Policy Information Point – PIP) to make decisions about whether an attempted resource access should be permitted or denied.

The PDP is provided as a REST/JSON-based microservice built with cloud-native principles. Enforcement is done in the architecture by Policy Enforcement Points (PEP). By their nature, PEP’s must be environment-specific since it is their job to intercept attempts to access a resource.

This means the enforcement point must be relatively coupled to the resource it is protecting. In a traditional monolithic application, runtime authorization policies can be served and orchestrated from one PDP. However, as the application is broken down into a microservice architecture, there are multiple options to integrate the PDP as part of the microservice and a one-to-one relationship to PDP / microservice is not the only option.

For applications built with microservices, enforcement can be done either through a proxy as part of a service mesh (e.g. Envoy), or an embedded agent (PEP) in the microservices.

Additionally, you could deploy a proxy as a sidecar or as a more centralized service at the node or the cluster level, depending on your scalability needs.