# Authentication and Authorization in Microservices Architecture: A Systematic Literature Review
## 3 SLR Results
### Quality Factors
RBAC is user-centric access control model, it does not account for relationship between the requesting entity and the resource [7]. RBAC authorization roles can be incorporated into JWT tokens as an additional attribute [7]. * **ABAC**: Attribute-Based Access Control, based in the words of [PERSON] and [PERSON] [35] \"grants access rights to subjects through the use of policies or rules that combine various types of attributes to facilitate user access to the right resources under the right conditions\". They complemented that it offers more expressivity and flexibility compared to another access control models such as RBAC. The primary goal of ABAC in the words of [PERSON] et al. [25] is \"an access control model is to fulfill the requirements of highly heterogeneous environments such as multi-cloud environment\". They also pointed the benefit of centralized security management and orchestration that will protect the application according to consistent policies. ABAC is recommended to be used when there is fine-grained authorization of resources, such as access to a specific API call [7]. * **XACML**: eXtensible Access Control Markup Language is defined by RFC 7061 [43]. According to this document, XACML \"defines an architecture and a language for access control (authorization). The language consists of requests, responses, and policies\". It is used to create access control policies and can be used with OAuth 2.0 protocol [31]. [PERSON] et al. [31] proposed a model using XACML along with OAuth 2.0. In this case, OAuth 2.0 acts as an authorization service and XACML with policy administration and decision points. [PERSON] and [PERSON] [8] discourage the use of XAML because it use a complicated syntax, causing more work for developers, adding to the fact that there were not many open-source integrations. * **HMAC**: Hash-based Message Authentication Code is defined by RFC 2104. It provides a way to check the integrity of an information transmitted in a medium [44]. In the words of [PERSON] et al., HMAC consists in \"hash-based messaging code to sign the request\". According to the same authors, there are many examples that can be found in internet suggesting the use of HMAC over HTTP. HMAC algorithm can also be used to sign a JWT [22]. * **SAML**: The Security Assertion Markup Language (SAML) 2.0 is defined by RFC 7522 and is defined as an XML-based framework that allows identity and security information to be shared across security domains [45]. In a microservices environment, SAML is used to exchange user attributes stored at the identity provider [35]. [PERSON] et al. [3] affirmed that \"SAML and OpenID is perfect for Authentication and Authorization of someone's on a system but it's also great for service-to-service authentication as well\". Nevertheless, they admitted that SAML is complex when it is compared to other technologies such as Api Keys. RQ.3.What Are the Main Open-Source Technology Solutions That Implement the Authentication and Authorization Mechanisms Identified in the Literature? The main open-source solutions that implement the authentication and authorization mechanisms identified in the literature are presented in Table 6. It is possible to notice that the Spring [46] ecosystem libraries are the most mentioned (Spring Security, Spring Cloud, Spring Boot, Gateway Zuul and Eureka Server), totaling 10 mentions. We realized that Spring Boot and Eureka are not focused on security, but they have specific security libraries that can be used together. For instance, implementing Spring Boot allows to implement Spring Security library, and Eureka helps to implement an API Gateway using Spring Cloud. Some of these studies demonstrated a practical implementation of Spring framework using security mechanisms [21; 22; 24; 25].