Why centralize legacy authentication at the ingress gateway

Most platforms built over time will have a variety of API endpoints, either in a large monolithic codebase or spread across a few services. Ideally there will be a centralized way to handle authentication and authorization, but often they are built at different times for different needs, and can end up with their own separate authentication. This then becomes tricky to manage cohesively when either breaking up a monolith or handling identities consistently across a service-oriented architecture.

Whilst there are many approaches (all valid) to centralizing authentication, this talk looks at how existing legacy authentication code can be abstracted out to a new service. This can work in combination with an ingress gateway, to provide a central place to enforce authentication and determine authorization. Content will include how allow/deny logic works, how authentication information can be sent to downstream services, and how multiple authentication mechanisms can be handled by a single authentication service.