Cloud-native microservices security

From LC: This is a new concept topic for an introduction to securing microservices- authentication and authorization in securing cloud-native microservices. Jakarta EE Security provides the capability to configure the basic authentication, form authentication, or custom form authentication mechanism by using annotations in servlets.

Include basic concepts of authentication and authorization and provide a diagram and description of authorization/authentication (see the following list of KC topics for more information, but don't just transfer the long concept topics from the KC) in a microservices scenario (for example, a developer wants to view account page on a website and get prompted to log in).

• https://www.ibm.com/support/knowledgecenter/SSEQTP_liberty/com.ibm.websphere.wlp.doc/ae/rwlp_auth_filter.html
• https://www.ibm.com/support/knowledgecenter/SSEQTP_liberty/com.ibm.websphere.wlp.doc/ae/twlp_sec_sociallogin.html
• https://www.ibm.com/support/knowledgecenter/SSEQTP_liberty/com.ibm.websphere.wlp.doc/ae/cwlp_authentication.html
• https://www.ibm.com/support/knowledgecenter/SSEQTP_liberty/com.ibm.websphere.wlp.doc/ae/cwlp_authorization.html

Background information: https://www.ibm.com/cloud/garage/architectures/microservices/microservices-kubernetes-microprofile

Apps running on OL can be configured to use external security providers to handle authentication/authorization. This ensures that the app never directly accesses or stores the user's password. Using external security providers also relieves developers and administrators of the app of the effort of managing user accounts. Include information about Jakarta EE Security as it's relevant to these scenarios.