Examkin

Question

Difficulty: HardIdentity and Access Management Architecture

A fintech platform is designing its microservices-based API infrastructure. The mobile application client must request access to user data across multiple independent backend services on behalf of authenticated users. The architecture requires that microservices independently verify scoped permissions statelessly without querying a central authentication service on every request, while avoiding exposure of user credentials. Which of the following identity and access management architecture designs best satisfies these requirements?

  1. Implement an OAuth 2.0 authorization server that issues digitally signed JSON Web Tokens (JWTs) carrying user scopes and claims for decentralized verification by downstream microservices.Answer
  2. B
    Enforce network-edge Web Application Firewall (WAF) filtering combined with IP address whitelisting as the primary mechanism for authenticating microservice requests.
  3. C
    Configure a centralized RADIUS server to perform real-time LDAP directory lookups for user credentials on every API request processed by backend microservices.
  4. D
    Deploy a SAML 2.0 web browser single sign-on profile using HTTP POST bindings to transmit XML authorization assertions between microservice endpoints.

Answer

Implement an OAuth 2.0 authorization server that issues digitally signed JSON Web Tokens (JWTs) carrying user scopes and claims for decentralized verification by downstream microservices.
The correct solution uses an OAuth 2.0 authorization server issuing digitally signed JSON Web Tokens (JWTs). In a microservices architecture, JWTs allow individual microservices to perform stateless token verification using public key cryptography while evaluating authorization scopes directly from the payload without querying a central server.

Step-by-Step Solution

1
Analyze the core architectural requirements
Identified the need for delegated authorization, stateless verification at the microservice level, fine-grained access control (scopes), and protection of user credentials.
Microservices require lightweight, scalable authorization that scales independently without centralized bottlenecks.
2
Evaluate protocol suitability for microservice API security
OAuth 2.0 paired with JSON Web Tokens (JWTs) provides token-based delegated authorization where tokens are self-contained and digitally signed by the authorization server.
JWTs contain claims and scopes embedded directly in the payload, allowing each backend service to verify the signature using the authorization server's public key statelessly.
3
Eliminate inappropriate architectural designs
Perimeter IP whitelisting relies on network trust, RADIUS/LDAP lookups add synchronous central bottlenecks, and SAML 2.0 is designed primarily for web browser authentication flows.
These alternatives fail to meet Zero Trust, performance, or API design constraints.

Key Concept

Stateless Delegated API Authorization with OAuth 2.0 and Signed JWTs
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic