Uma API Gateway para controle de acesso baseado em arquitetura para microsserviços

• Ano de defesa: 2024
• Autor(a) principal: Cargnelutti, Rodrigo
• Tipo de documento: Dissertação
• Tipo de acesso: Acesso aberto
• Idioma: por
• Instituição de defesa: Universidade Federal do Pampa; UNIPAMPA; Mestrado Profissional em Engenharia de Software; Brasil; Campus Alegrete
• Palavras-chave em Português: Engenharia de software; Serviços da Web; API Gateway; Controle de acesso; Software engineering; Web services; Access control; CNPQ::CIENCIAS EXATAS E DA TERRA
• Link de acesso: https://repositorio.unipampa.edu.br/jspui/handle/riu/9784

Background. Currently, the trend in system migration focuses on modernizing legacy systems to microservices architectures. This approach, along with system access control, has garnered increasing interest from the Data Processing Center (CPD) at the Federal University of Santa Maria (UFSM). An Application Programming Interface (API) Gateway aims to modernize the systems’ architecture, improve access management, and help mitigate cybersecurity risks, promoting more secure and efficient communication between institutional systems. Aims. To develop a modern API Gateway based on the Spring Boot framework and Java Development Kit (JDK) 21. Provide centralized access control for the web services of the Education Information System (SIE), allowing for more secure information Exchange through authentication validation via a token. Method. An investigation was conducted through a Systematic Literature Review (SLR) with the aim of identifying solutions, tools, and technologies related to authentication for microservices architecture systems. Results. Based on the experience gained, it was identified that the Spring Boot framework and the Spring Cloud Gateway library are considered suitable technologies for developing an API Gateway that meets the demands of SIE web services. Conclusions. An API Gateway was developed to enhance access control for the SIE web services. The performance evaluation compared this solution with the Kong API Gateway, revealing that both are viable, each with its specific advantages regarding performance and resource consumption.