Authorization Model for Microservice-Based ERP Software

Enterprise Resource Planning (ERP) and Enterprise Application Integration (EAI) play pivotal roles in enhancing organizational efficiency. ERP serves as a comprehensive software solution, integrating various business processes, while EAI focuses on connecting diverse applications. The adoption of microservices architecture in ERP and EAI introduces challenges in authorization mechanisms. (i) Existing ERP applications often lack granular authorization for microservices, posing security risks. (ii) End-user authorization requires mechanisms for group-based role authorization and individualized permissions. (iii) Microservices authorization must consider access environment requirements. (iv) The authorization model must be flexible, accommodating organizational changes seamlessly. This paper introduces an innovative authorization model that combines policy-based and role-based authorization. The model provides static role-based authorization for end-user interfaces and dynamic policy-based authorization for both end-user interfaces and microservices. The paper outlines the model, emphasizes its adaptability to organizational changes, and suggests implementing the authorization process in the enterprise following the Plan-Do-Check-Act (PDCA) cycle.