Serverlessons: Deep Dive on JWT and OpenIDC

Serverless can be great if you have the right use case. Let's look at what makes a good candidate for serverless, then deploy some simple python examples. Along the way, we'll compare AWS console/cli tools with frameworks like Chalice. Zappa, and Serverless.

Do you need to integrate with existing enterprise SSO? Authentication and authorization requires some thought whn using a serverless architecutre. Fortunately, open standards around JSON Web Token (JWTs) and OpenID Connect (OpenIDC) offer a sane way forwards that is safe and flexible.

Bring your hard-won experience and we'll swap stories about what works. Strap in, we'll be moving fast!

Transcript

1. Serverlessons U-M Cloud CoP February 19, 2020 tknox / engineering / caen
2. Big Topic ▪ We will move fast ▪ What is it? ▪ Why do it? ▪ How do you do it? ▪ Q&A and links at the end
3. ▪ For today, applications with: ▪ No servers to provision or manage ▪ Flexible scaling ▪ High availability ▪ No idle capacity What is it?
4. Serverless in AWS
5. Serverless in AWS
6. Event-driven Computing ▪ Loose Coupling ▪ Parallelism ▪ Queueing ▪ Scaling ▪ Robustness
7. Why do it? ▪ Loose Coupling ▪ Parallelism ▪ Queueing ▪ Scaling ▪ Robustness ▪ Focus on what you really want
8. How do you do it? ▪ So many ways… ▪ AWS Console / CLI ▪ Chalice ▪ Zappa ▪ Serverless Framework
9. ▪ Console / CLI ▪ As with many AWS offerings… ▪ People want a Heroku-like experience ▪ Serverless Application Model ▪ SAM, SAM CLI, SAM Repository How do you do it?
10. ▪ Chalice ▪ I'm a Python guy ▪ Open source from AWS Labs ▪ Abstracts and orchestrates a ton ▪ A lot like Flask (see first bullet) How do you do it?
11. Chalice Demo
12. How do you do it? ▪ Zappa ▪ I'm a Python guy ▪ Any WSGI application ▪ Allegedly… ▪ More ambitious
13. Zappa Demo
14. How do you do it? ▪ Serverless Framework ▪ Much more ambitious ▪ Multi-runtime support ▪ Multi-cloud support ▪ Freemium services
15. Serverless Runtimes
16. Serverless Clouds
17. Serverless Demo
18. Challenges BOO ▪ Authentication and Authorization ▪ Not everybody 'gets' Cognito (ahem) ▪ SSO at the front, back & in the middle? ▪ And that's just authN… ▪ Well, authZ can also be bonkers
19. Challenges BOO ▪ Latency ▪ Cold starts are a real problem ▪ Your app's level of 'busy-ness' matters ▪ Cloudwatch Events pinging on a schedule feels… just wrong
20. Challenges YAY! ▪ Authentication and Authorization ▪ OpenID Connect & JSON Web Tokens ▪ Do it listener rules in your ALBs ▪ Or in Cloudfront & Lambda@Edge ▪ Or via APIGW + Lambda Authorizers
21. Challenges YAY? ▪ Latency ▪ AWS Provisioned Concurrency ▪ Announced at reInvent 2019 ▪ Pricing could be murderous ▪ Also, this is serverless, right?
22. Challenges YAY? ▪ Statefulness ▪ OpenID Connect & JSON Web Tokens ▪ This could use some more thought ▪ But you needed to be thinking about statefulness anyway
23. In Summary ▪ Things that sound too good to be true… ▪ Hard things may now be easier ▪ But easy things may now be harder ▪ Consider the user experience ▪ Consider the cost
24. Your Turn Questions, Accusations, Recriminations
25. Thomas Knox tknox@umich.edu github.com/knoxilla engineering.umich.edu
26. ▪ AWS Serverless White Paper ▪ Serverless Application Model ▪ Serverless Application Repository ▪ Chalice at Github ▪ Zappa at Github ▪ Serverless Framework Links and References 1
27. ▪ OpenID Connect ▪ JSON Web Tokens ▪ Cold starts are a real problem ▪ AWS Provisioned Concurrency ▪ This Community of Practice Links and References 2
28. Will be somewhere, eventually-=--- This Talk