Summary

In this chapter, you have learned the fundamental principles of authentication and authorization and how to apply both to gRPC endpoints. You now know that authentication is when the user proves that they are who they claim to be, while authorization is making sure that the user has the necessary permissions to access a resource.

You have learned how a separate application can act as an SSO provider to allow you to authenticate a user into all applications inside your ecosystem. You have learned how the OpenID Connect protocol is used to authenticate the user into a relevant application, while OAuth is used for user authorization.

You have learned that a JWT contains a JSON payload object that describes the user so that the protected application can tell whether the user is who they claim to be and whether they have the necessary permissions. A JWT is validated by a signature to protect it from forgery.

And this concludes the chapter on applying authentication and...