Skip to content

Implement microservice authentication middleware (resolves #500)

Microservice Authentication Middleware — Implementation

Context

Issue #500 (closed) identified that no OPEA microservice endpoint has authentication middleware. The Kong gateway protects the backend BFF, but direct container-to-container access (within the Docker network) bypasses all auth. For GovStack deployment (multi-tenant, sovereign cloud), this is non-negotiable.

This issue implements the authentication middleware for all OPEA microservices (ChatQnA, Retriever, Dataprep, Reranker, Guardrail).

Implementation Approach

Phase 1: JWT Validation Middleware

  • Create a shared Python middleware module in genie-ai-overlay/core/
  • Validate JWT tokens from the Authorization: Bearer header
  • Verify token signature using JWT_SECRET (shared with backend)
  • Reject requests with missing/invalid/expired tokens with 401/403
  • Add /health endpoint exception (health checks must work without auth)

Phase 2: Service-to-Service Auth

  • Implement internal service tokens for microservice-to-microservice calls
  • Use AUTH_SERVICE_USERNAME/AUTH_SERVICE_PASSWORD (already in env template)
  • ChatQnA calling Retriever, Dataprep, Reranker must pass service credentials
  • Backend BFF calling ChatQnA passes the user's JWT

Phase 3: Configuration

  • Add AUTH_ENABLED=true env var (default: true, can be disabled for dev)
  • Add each microservice to docker-compose with the auth env vars
  • Update Kong routes if needed

Affected Services

  • genie-ai-overlay/chatqna/ — main orchestrator
  • genie-ai-overlay/retriever/ — vector/graph retrieval
  • genie-ai-overlay/dataprep/ — document ingestion
  • genie-ai-overlay/reranker/ — result reranking
  • genie-ai-overlay/core/ — shared middleware

Acceptance Criteria

  • All microservice endpoints return 401 without valid JWT
  • Health endpoints remain accessible without auth
  • Service-to-service calls use internal credentials
  • Backend BFF passes user JWT to ChatQnA
  • AUTH_ENABLED=false disables auth for local development
  • Existing E2E chat flow works end-to-end with auth enabled

Related Issues

  • Resolves: #500 (closed) (P0)
  • Blocks: SSE streaming, agentic workflows, GovStack BB integrations

Labels

security, enhancement, 1.Parent_Issue