# Authentication and Authorization in Microservices Architecture: A Systematic Literature Review
## 4 Discussions
#### Study Limitations  
The study was performed with searches in DBLP, IEEE and Scopus databases. To prevent relevant works from being discarded, the snowballing process was applied. Even with this concern, it is possible that, increasing the number of databases for consultations, new studies may be found. However, as verified in some studies collected, there is currently a lack of studies on the subject [3; 4; 7; 16; 21; 25; 28]. It was also verified that there is a lack of studies demonstrating the practical implementation of security in microservices [24; 28; 37]. Hence, it is likely that over the next few years, if the research related to the subject in question increases, a new systematic review will be necessary, in order to complement the knowledge collected in this work. We cannot conclude that the mechanisms less mentioned in the studies are less used, therefore, it is important to explore all of them, that can be done in a future work. Finally, it is important to note that this study is more focused on identifying answers to the research questions, that is, it is possible that the answers to these questions may be the subject of further studies pointing out which challenges are  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Challenge** & **Mechanism** & **Open-Source** \\ \hline Increased attack surface (compared to monolithic) & API Gateway (S2, S3, S4, S6, S12, S13, S16,  S17, S20, S22), OAuth 2.0 (S7, S12, S13),  SSO (S14) & Spring (S4, S7), Kong (S6, S11) \\  & OAuth 2.0 (S1, S5, S6, S7, S8, S10, S12, S13,  S14, S15, S16, S17, S21),  SAML(S2),  OpenID(S2, S14, S16, S17), JWT (S9, S12,  S13, S14, S15, S17, S21)  XACML (S3), NGAC (S3), JWT (S3, S6,  S12), OpenID (S3, S12, S16), OAuth 2.0 (S3, S6, S12, S16), TLS (S3), IDS (S12)  TLS (S10, S14, S15), MTS (S17), SSL (S2), HTTPS (S2, S10, S14, S15, S17, S20),  SAML(S2, S14, S21), XACML (S6, S21),  OpenID(S2, S3, S8, S16, S17), JWT (S4, S5, S6, S12, S13, S14,S15, S16, S17, S21), OAuth 2.0 (S5, S6, S7, S8, S10, S13, S15, S17, S21),  GSI (S8) & Spring (S4), Kong (S6) \\  & JWT (S1, S3, S4, S5, S6, S9, S11, S12, S13,  S14, S15, S17, S21, S22), OAuth 2.0 (S1, S3, S5, S6, S7, S8, S10, S11, S12, S13, S14, S15, S16, S17, S20), OpenID Connect S1,  S2, S3, S8, S12, S14, S16, S17, S21)  OAuth 2.0 (S1, S5, S10, S11, S12, S13,  S14, S15, S16, S20, S21), OpenID (S1, S2, S3, S8, S12, S14, S16), TLS(S1), MLS(S1), SSA (S1), SSO (S1, S2), JWT (S1, S5, S11,  S12, S13, S14, S15, S21), HMAC(S2, S21),  ABAC (S8, S17, S20, S21), RBAC (S17, S21), CAS (S8), RSA (S11), XACML (S16), Captcha (S20), Multiple FA (S20), DAC (S21), IAM (S21) & (S8), SSO (S1, S2, 10, S13, S14, S20,  S21, S22), OAuth 2.0 (S12, S14, S16),  OpenID (S12, S14, S16),  JWT (S1, S3, S4, S5, S6, S9, S11, S12, S13,  S14, S15, S17, S21, S22), OAuth 2.0 (S1, S3, S5, S6, S7, S8, S10, S11, S12, S13,  S16, S17, S20, S21), OpenID Connect (S1, S5), S6, S7, S8, S10, S11, S12, S13, S14, S15, S16, S17, S21), OpenID Connect (S1, S5), S6, S7, S8, S10, S11, S12, S13, S14, S15, S16, S20, S21), OpenID Connect (S1, S5, S11) & Spring (S4, S5) \\  & & & \\ Coordinate authentication server with new microservices & LDAP (S8), SSO (S1, S2, 10, S13, S14, S20,  S21, S22), OAuth 2.0 (S12, S14, S16),  OpenID (S12, S14, S16),  OpenID (S12, S14, S16),  JWT (S1, S3, S4, S5, S6, S9, S11, S12, S13,  S14, S15, S17, S21, S22), OAuth 2.0 (S1, S3, S5, S6, S7, S8, S10, S11, S12, S13, S14, S15, S16, S17, S20, S21), OpenID Connect (S1, S5  
most critical in terms of vulnerability, how much they occur in a practical environment, or even which of these challenges should be addressed with priority. The mechanisms can also be implemented and tested in order to find out in a practical environment which of the challenges are mitigated with the implemented mechanism.