Centralized vs distributed auth in Microservices - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Centralized Authentication

In a microservices system using centralized authentication, what is the main role of the authentication server?

A It issues tokens and validates user credentials for all services.

B Each microservice independently verifies user credentials.

C It stores user data but does not handle token issuance.

D It only logs authentication attempts without validating users.

💡 Hint

Think about where the user login happens and who trusts the tokens.

In centralized authentication, a dedicated server handles login and issues tokens. Microservices trust these tokens instead of verifying credentials themselves.

❓ Architecture

intermediate

Distributed Authentication Token Validation

In a distributed authentication system, how do microservices typically validate user tokens without a central server?

A Tokens are not validated; services trust all requests.

B Services send token validation requests to a central database.

C Services require users to re-login for each service.

D Each service uses a shared secret or public key to verify token signatures locally.

💡 Hint

Think about how services can trust tokens without asking a central server every time.

Distributed systems often use signed tokens (like JWT) that services can verify locally using a shared secret or public key, avoiding central validation calls.

❓ scaling

advanced

Scaling Challenges of Centralized Authentication

What is a major scaling challenge when using centralized authentication in a large microservices environment?

A The authentication server can become a bottleneck and single point of failure.

B Microservices cannot share user data easily.

C Users must authenticate separately for each microservice.

D Tokens cannot be revoked once issued.

💡 Hint

Consider what happens if many services rely on one server for login.

Centralized authentication means all login requests go to one server, which can slow down or fail under heavy load, affecting the whole system.

❓ tradeoff

advanced

Tradeoffs Between Centralized and Distributed Auth

Which tradeoff best describes the difference between centralized and distributed authentication in microservices?

A Centralized auth requires no tokens; distributed auth requires tokens for every request.

B Centralized auth simplifies token management but risks bottlenecks; distributed auth improves scalability but adds complexity.

C Centralized auth is always faster; distributed auth is always slower.

D Centralized auth cannot support multiple user types; distributed auth can.

💡 Hint

Think about simplicity versus scalability and complexity.

Centralized auth is easier to manage but can slow down under load. Distributed auth scales better but needs more complex token verification and key management.

❓ estimation

expert

Estimating Token Validation Load in Distributed Auth

A microservices system has 100 services and 10,000 users making 1 request per second each. If each service validates tokens locally, approximately how many token validations happen per second across the system?

A 100,000 validations per second

B 10,000 validations per second

C 1,000,000 validations per second

D 100 validations per second

💡 Hint

Multiply users, requests per second, and number of services involved per request.

Each user makes 1 request per second. If each request touches all 100 services and each service validates the token, total validations = 10,000 users * 1 req/sec * 100 services = 1,000,000 validations/sec.

Practice

1. What is the main characteristic of centralized authentication in microservices?

easy

A. No authentication is required between services

B. Each microservice verifies user identity independently

C. Authentication is done by the client application only

D. A single service handles all user login and identity verification

Solution

1. Step 1: Understand centralized authentication

   Centralized authentication means one dedicated service manages all login and identity checks for the system.

2. Step 2: Compare with other options

   Distributed auth where each service verifies independently, client-only auth, or no auth are not centralized.

3. Final Answer:

   A single service handles all user login and identity verification -> Option D

4. Quick Check:

   Centralized auth = single service [OK]

Hint: Centralized means one place handles all auth [OK]

Common Mistakes:

• Confusing centralized with distributed auth
• Thinking each service handles login in centralized auth
• Assuming client-only authentication is centralized

2. Which of the following is a typical token used in distributed authentication?

easy

A. OAuth 2.0 access token

B. SQL query string

C. HTML cookie without signature

D. Plain text password

Solution

1. Step 1: Identify token types in distributed auth

   Distributed authentication commonly uses tokens like OAuth 2.0 access tokens to verify identity without contacting a central service each time.

2. Step 2: Eliminate incorrect options

   SQL queries, unsigned cookies, and plain text passwords are not secure tokens used for distributed auth.

3. Final Answer:

   OAuth 2.0 access token -> Option A

4. Quick Check:

   Distributed auth token = OAuth 2.0 token [OK]

Hint: OAuth tokens are standard for distributed auth [OK]

Common Mistakes:

• Confusing SQL queries with tokens
• Using unsigned cookies as secure tokens
• Thinking plain text passwords are tokens

3. Consider a microservice system where each service validates JWT tokens locally without contacting a central auth server. What is the main advantage of this approach?

medium

A. Reduced latency and less dependency on a central service

B. Simpler token revocation management

C. Centralized control over user sessions

D. No need for token expiration

Solution

1. Step 1: Understand local JWT validation

   When services validate JWT tokens locally, they avoid network calls to a central auth server, reducing latency and dependency.

2. Step 2: Analyze other options

   Token revocation is harder locally, centralized control over user sessions is lost, and tokens still need expiration.

3. Final Answer:

   Reduced latency and less dependency on a central service -> Option A

4. Quick Check:

   Distributed auth local validation = less latency [OK]

Hint: Local token checks speed up requests [OK]

Common Mistakes:

• Assuming token revocation is easier locally
• Thinking local validation means centralized control
• Ignoring token expiration needs

4. A microservice system uses centralized authentication but experiences frequent downtime of the auth service. What is the best way to fix this issue?

medium

A. Use plain text passwords for faster login

B. Remove authentication completely

C. Implement caching of authentication tokens in services

D. Make each service validate tokens independently without central auth

Solution

1. Step 1: Identify problem with centralized auth downtime

   Downtime of the central auth service causes failures in login or token validation.

2. Step 2: Choose a solution to reduce dependency

   Caching tokens locally in services reduces calls to the central auth, improving availability without removing auth or security.

3. Final Answer:

   Implement caching of authentication tokens in services -> Option C

4. Quick Check:

   Fix downtime by caching tokens [OK]

Hint: Cache tokens to reduce auth service calls [OK]

Common Mistakes:

• Removing authentication entirely
• Switching to insecure plain text passwords
• Switching to distributed auth without planning

5. You are designing a large microservices system that requires high security and low latency. Which authentication approach best balances these needs?

hard

A. Centralized authentication with synchronous calls for every request

B. Distributed authentication using signed tokens validated locally with periodic revocation checks

C. No authentication to maximize speed

D. Centralized authentication with no token expiration

Solution

1. Step 1: Analyze security and latency needs

   High security requires token validation and revocation; low latency requires avoiding frequent central calls.

2. Step 2: Evaluate options

   Distributed authentication using signed tokens validated locally with periodic revocation checks uses signed tokens validated locally to reduce latency and periodic revocation checks to maintain security. Centralized authentication with synchronous calls for every request causes latency, no authentication is insecure, and centralized authentication with no token expiration risks stale sessions.

3. Final Answer:

   Distributed authentication using signed tokens validated locally with periodic revocation checks -> Option B

4. Quick Check:

   Balance security and speed with distributed tokens [OK]

Hint: Use local token checks plus revocation for security and speed [OK]

Common Mistakes:

• Choosing no authentication for speed
• Ignoring token expiration and revocation
• Relying on central auth for every request causing latency