Uma API Gateway para controle de acesso baseado em arquitetura para microsserviços

Abstract

Background. Currently, the trend in system migration focuses on modernizing legacy systems to microservices architectures. This approach, along with system access control, has garnered increasing interest from the Data Processing Center (CPD) at the Federal University of Santa Maria (UFSM). An Application Programming Interface (API) Gateway aims to modernize the systems’ architecture, improve access management, and help mitigate cybersecurity risks, promoting more secure and efficient communication between institutional systems. Aims. To develop a modern API Gateway based on the Spring Boot framework and Java Development Kit (JDK) 21. Provide centralized access control for the web services of the Education Information System (SIE), allowing for more secure information Exchange through authentication validation via a token. Method. An investigation was conducted through a Systematic Literature Review (SLR) with the aim of identifying solutions, tools, and technologies related to authentication for microservices architecture systems. Results. Based on the experience gained, it was identified that the Spring Boot framework and the Spring Cloud Gateway library are considered suitable technologies for developing an API Gateway that meets the demands of SIE web services. Conclusions. An API Gateway was developed to enhance access control for the SIE web services. The performance evaluation compared this solution with the Kong API Gateway, revealing that both are viable, each with its specific advantages regarding performance and resource consumption.