How a short-lived, signed token keeps a single user's identity and authorization honest as a request travels across a chain of microservices.

Welcome to Tokenetes: Transaction Tokens for Microservices.

Tokenetes is a Cloud Native Computing Foundation sandbox project, with initial contributions from SGNL.ai, that implements Transaction Tokens — the IETF OAuth working group's draft standard for carrying trustworthy identity and context through a microservice call chain. The problem it addresses is old and stubborn: once an external request crosses the edge of your system and fans out into a dozen internal service calls, the original "who" and "why" usually evaporate, and services start trusting each other simply because they share a network. Tokenetes restores that lost context by issuing a short-lived, cryptographically signed JWT — a TraT — that immutably asserts the external user and the purpose of the call, and by having every downstream service verify it before acting. This book opens with the confused-deputy problem that motivates the whole design, then explains what a Transaction Token actually contains and how it relates to OAuth Token Exchange. From there we tour the three components — the Tokenetes Service, the Tokenetes Agent sidecar, and the Kubernetes resources that describe generation and verification rules — before working through the interception and delegation modes, the end-to-end request flow, and finally the operational practices and ecosystem fit that make TraTs worth adopting.

This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.

A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.

We hope it serves you well.

— Shriira Press

Contents

1. Chapter 1 — The Confused Deputy in the Cluster
2. Chapter 2 — What a Transaction Token Is
3. Chapter 3 — The Tokenetes Architecture
4. Chapter 4 — Rules as Kubernetes Resources
5. Chapter 5 — Interception and Delegation
6. Chapter 6 — The Request Flow End to End
7. Chapter 7 — Tokenetes in Practice