# Authentication and Authorization in Microservices Architecture: A Systematic Literature Review
## 3 SLR Results
### Quality Factors
It is important to mention that OAuth 2.0 is widely used as an authorization protocol to protect services that use the REST (Representational State \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Pos** & **Mechanism** & **ID** & **Number of Occurrences** \\ \hline \multirow{4}{*}{1\({}^{\circ}\)} & \multirow{4}{*}{OAuth 2.0} & SI, S3, S5, S6,S7, S8, S10, S11, & \\  & & SI2, S13, S14, S15, S16, S17, & 16 \\  & & SI, S20, S21 & \\  & & SI, S3, S4, S5, S6, S9, S11, S12, & \\
2\({}^{\circ}\) & JWT & SI, S13, S14, S15, S17, S21, S22 & 14 \\  & & SI, S2, S3, S4, S5, S6, S11, S12, S13, & \\
3\({}^{\circ}\) & API Gateway & SI4, S16, S17, S19, S20, S22 & 14 \\  & & SI, S2, S9, S10, S14, S19, S21, & 8 \\
5\({}^{\circ}\) & OpenID Connect & SI, S3, S8, S12, S16, S17, S21 & 7 \\
6\({}^{\circ}\) & HTTPS & SI, S14, S15, S17, S19, S20 & 7 \\
7\({}^{\circ}\) & RBAC & SI, S3, S5, S13, S14, S17, S21 & 7 \\
8\({}^{\circ}\) & ABAC & SI, S8, S14, S17, S20, S21 & 6 \\
9\({}^{\circ}\) & XACML & SI, S3, S13, S15, S16, S21 & 6 \\
10\({}^{\circ}\) & HMAC & SI, S2, S3, S5, S14, S21 & 5 \\
11\({}^{\circ}\) & SAML & SI, S2, S13, S14, S21 & 5 \\
12\({}^{\circ}\) & TLS & SI, S10, S14, S15, S16 & 5 \\
13\({}^{\circ}\) & OAuth & SI, S5, S8, S16 & 4 \\
14\({}^{\circ}\) & Multilevel Security & SI, S3, S13 & 3 \\
15\({}^{\circ}\) & DAC & SI4, S21 & 2 \\
16\({}^{\circ}\) & IAM & SI4, S21 & 2 \\
17\({}^{\circ}\) & RSA & S5, S11 & 2 \\
18\({}^{\circ}\) & SASL & SI, S13 & 2 \\
19\({}^{\circ}\) & SSL & S2, S13 & 2 \\
20\({}^{\circ}\) & MTLS & SI, S17 & 2 \\
21\({}^{\circ}\) & OpenID & S2, S14 & 2 \\
22\({}^{\circ}\) & API Keys & S2 & 1 \\
23\({}^{\circ}\) & Captcha & S19 & 1 \\
24\({}^{\circ}\) & CAS & S8 & 1 \\
25\({}^{\circ}\) & X509 Certificates & S1 & 1 \\
26\({}^{\circ}\) & EAS & S3 & 1 \\
27\({}^{\circ}\) & ECDSA & S5 & 1 \\
28\({}^{\circ}\) & GSI & S8 & 1 \\
29\({}^{\circ}\) & IDS & S12 & 1 \\
30\({}^{\circ}\) & LDAP & S8 & 1 \\
31\({}^{\circ}\) & MFA & S19 & 1 \\
32\({}^{\circ}\) & NGAC & S3 & 1 \\
33\({}^{\circ}\) & PBAC & S1 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Security mechanisms used in microservices architecture Transfer) [23; 25; 27], in addition to adopting the HTTPS protocol in data communication [25]. * **JWT (JSON Web Token)**: The JWT is defined by RFC 7519 [40]. It is an open standard that provides a compact and independent way to securely transmit information between applications using a JSON (Javascript Object Notation) object. This information is verifiable and trustworthy as it is digitally signed using a secret [22]. It has a format divided into three parts: Header, Payload and Signature. The header is separated into two parts, token type and the algorithm, that may be a HMAC, SHA256 or RSA [29]. The JWT has an advantage over traditional tokens, this verification can be done directly on the resource server, without connecting to the authentication server [22; 36]. Using JWT it is possible to retrieve user information directly from the token [22; 26]. In addition to user information, it is common to find in a JWT their permissions and expiration time of the token [36]. The JWT has adherence to \"stateless\" applications, that is, those that do not keep a session on the server side, but stay data with the client side, and must be used in each client request to the resource [26]. In a microservices environment, JNTs can be transferred during the communication between them [35]. Finally, it is important to know that JWT can be integrated with the OAuth 2.0 protocol [4; 23]. * **API Gateway**: In the microservices environment, API Gateway acts as an intermediary between the client and the microservices, providing a private network environment that allows the exchange of private data [3; 15], that is, clients do not communicate directly with services, but only with a Gateway, which is responsible for communicates with the requested service.