# Authentication and Authorization in Microservices Architecture: A Systematic Literature Review
## 3 SLR Results
### Quality Factors
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Pos** & **Challenge** & **ID** & **Number of Occurrences** \\ \hline
1 st & Communication between microservices & S1, S2, S3, S4, S7, 99, S10, S15, & \\  & Trust between microservices & S16, S17, S18, S23, S24 & 13 \\
2 nd & compromised by & S1, S2, S4, S6, S8, S12, S15, S16, & \\  & unauthorized access & S19, S21, S23, S24 & 12 \\
3 rd & Individual concern for each & S1, S2, S5, S10, S12, S13, S15, & 12 \\  & microservice & S16, S21, S22, S23, S24 & 12 \\
4 th & Increased attack surface & S1, S2, S3, S7, S8, S13, S14, S16, & 10 \\  & (compared to monolithic) & S17, S23 & 10 \\
5 th & Microservice access control & S5, S8, S10, S11, S14, S15, S19, & 9 \\  & S20, S21 & S20, S21 & 8 \\
6 th & Authorization between services & S1, S7, S8, S15, S16, S17, S18, & 8 \\
7 th & Lack of studies about & S1, S2, S4, S8, S10, S13, S17 & 7 \\  & microservices & S1, S13, S15, S17, S20, S21 & 6 \\  & Different teams working on & & \\
9 th & different microservices must & S3, S15, S17, S20, S23 & 5 \\  & have the same understanding & S3, S15, S17, S20, S23 & 5 \\  & of security & & \\
10 th & Bypass on Api Gateway & S3, S4, S6, S12 & 4 \\
11 th & detection/monitoring & S1, S12, S24 & 3 \\
12 th & Escalation of privileges & S2, S16, S24 & 3 \\  & Lack of study demonstrating & & \\
13 th & practical implementation of & S7, S13, S23 & 3 \\  & security in microservices & & \\
14 th & Coordinate authentication & S1, S22 & 2 \\  & server with new microservices & S1, S13 & 2 \\
15 th & Lack of attention in attack & S5, S6 & 2 \\  & reaction/recovery & S1 & 1 \\
16 th & Token validation at each & S5, S6 & 2 \\  & microservice request & S1 & 1 \\
17 th & Public Images may be & & \\  & compromised & & \\  & Many applications in & & \\
18 th & commercial microservices & S4 & 1 \\  & without possibility to & & \\  & evaluate code & & \\  & Use of & & \\
19 th & authentication/authorization & S3 & 1 \\  & server that handles all & & \\  & microservices & & \\
20 th & Possibility of development in & & \\  & various technologies & S23 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Challenges related to authentication and authorization in microservicescomplex to keep this entire ecosystem properly protected. Although each service needs particular attention, [PERSON] and [PERSON] [7] alerted that manual security provisioning of hundreds or thousands of service instances is infeasible. [PERSON] et al. [4] compared monolithic with microservices using a KLOC metric (kilo Lines of Code), they say that in a monolithic application, every 100 kloc will have an average of 39 vulnerabilities. The same quantity of lines of code in a microservice application, will have an average of 180 vulnerabilities. They also alert about the decomposition of monolithic into microservices because security needs to be a global property, not the sum of local security defenses. [PERSON] et al. [27] argue the importance of authentication and authorization in the context of microservice security. They mentioned that \"Microservices should only be invoked after requesting authentication and, ideally, authorization if levels of privileges are available.\". [PERSON] et al. [28] performed a systematic mapping about security mechanisms used in microservices and they discovered that the most reported security mechanisms are related to authorization, authentication and credentials. [PERSON] et al. [29] also agreed that authentication and authorization need to be carefully observed in a microservice architecture, because this scenario presents many points of access for users and the other parts of the application. They argued that the data being especially sensitive, the crucial point of the development is the authentication and the authorization process. [PERSON] et al. [33] proposed the implementation of a global authentication and authorization mechanism named Unified Account Management as a Service (UAMS). In this implementation, they used a RESTful API divided into several microservices.