August 2018 Summaries

As the software landscape evolves towards open infrastructure and service meshes, traditional access control methods using local libraries like OmniAuth and PassportJS are becoming less practical. This guide introduces a modern approach to access control within Kubernetes clusters using Ambassador API Gateway and Ory Oathkeeper Identity and Access Proxy. By utilizing open standards and replaceable software components, developers can enhance both development speed and application security. The setup involves deploying Ambassador as a Kubernetes-native API Gateway that facilitates traffic routing and supports external authentication services, while Ory Oathkeeper evaluates incoming HTTP requests based on predefined rules to determine access permissions. The guide provides detailed steps for deploying and configuring both Ambassador and Ory Oathkeeper in a Kubernetes environment, including setting up services, creating and applying access rules, and integrating these tools to manage access to services like httpbin. This method allows for a more scalable and language-agnostic architecture, supporting diverse programming languages and distributed services, while paving the way for a comprehensive access control system with the planned introduction of Ory Hydra and Ory Keto in subsequent guides.

This blog post introduces a series aimed at providing comprehensive guidance on setting up access control in web applications, focusing on both authentication and authorization. It begins with an overview of various access control approaches, highlighting server-side and client-side applications, and discusses the merits and challenges of using cookies and tokens for managing user access. The post emphasizes the importance of using established technologies and protocols like OAuth 2.0 and OpenID Connect for scalable and secure solutions, particularly in environments involving multiple services such as microservices and service-oriented architectures. Single Sign-On (SSO) is recommended to streamline user management and enhance security across distributed systems. The series promises to delve deeper into token-centric access control, comparing systems like Access Control List (ACL) and Role-Based Access Control (RBAC), while also offering insights into open-source tools and best practices to save time and resources. The author aims to provide a thorough, unbiased source of knowledge free from corporate sales agendas, inviting readers to subscribe for updates on future installments.