Security, Authentication, Authorization and SSL

Table of Contents

Different ways to implement Security, Authentication, Authorization and SSL

Keycloak authorization server -

  1. to secure the communication between services
  2. Identity and Access management
  3. Single Sign-on

OAuth2

  1. Delegated authorization with access token

OpenID Connect

  1. Authentication with ID Token

Bearer Tokens

  1. https://swagger.io/docs/specification/authentication/bearer-authentication/
  2. https://oauth.net/2/bearer-tokens/#

It means that the Bearer of this token is granted access. It means that anybody that has access to this access_token, has access to the API (and so, the data). There is no further authorization within a Bearer token. They are considered secure because of the fact that they are valid only for a limited time. If someone gets a hold of a Bearer token and they can use it, they can use it only for one hour before it expires.

Reading material

  1. https://www.keycloak.org/docs/latest/authorization_services/index.html

Links to this note