Authentication & Authorization (OAuth2/JWT/SSO)
SecurityVerifying who a caller is (authentication) and what they're allowed to do (authorization) — the security foundation nearly every other component sits behind.
Authentication (AuthN) answers 'who is making this request' — via passwords, OAuth2/OIDC flows (delegating identity to a provider like Google), or API keys/mTLS for service-to-service calls. Authorization (AuthZ) answers 'what is this already-identified caller allowed to do' — via role-based access control (RBAC), attribute-based access control (ABAC), or simple per-resource ownership checks. A JWT (JSON Web Token) is a common way to carry the *result* of authentication (a signed, tamper-evident claim like 'this is user 123, issued at time T, expires at time T+1hr') so downstream services can verify identity without calling back to the auth server on every single request.
How it connects
Authentication & Authorization (OAuth2/JWT/SSO) as the source, with the components it typically interacts with.
- → API Gateway: Token/session validation is centralized at the gateway so individual services don't each need to re-implement authentication.
- → Database Types (SQL, NoSQL & Beyond): User credentials, sessions, and permissions are persisted in a database that the auth service reads from and writes to.
- → Rate Limiting: Login/token endpoints are rate-limited per account/IP specifically to blunt credential-stuffing and brute-force attacks.