How to set the access control for microservices

Question

I use Loopback Framework to create several services and I use an api gateway (tyk) to manage them.

Unfortunately I do not see how to set the access control for each of them.

I do not want a user to access data that does not belong to him.

Many thanks,

Answer 1

you can easily use two methods to secure your model.

1.From model.json file

inside your model model.json you can include ACL objects.

 "acls": [{
    "accessType": "EXECUTE",
    "principalType": "ROLE",
    "principalId": "$authenticated",
    "permission": "ALLOW"
  }, {
    "accessType": "*",
    "principalType": "ROLE",
    "principalId": "$everyone",
    "permission": "DENY"
  }]

2.Using operational hooks in model.js file you can use operational hooks to manipulate security.

example

 Template.observe('access', function (ctx, next) {
    if(ctx.options.team){
      var teamId = ctx.options.team.teamId;
     ctx.query.where= ctx.query.where  || {or :[ {user_created : 0},{teamId : teamId}]}   ;
    next();
    }

  });

hope this will be helpful.