Design a Authentication Service

Question

Design a fault-tolerant authentication system that handles millions of requests. Discuss trade-offs in consistency, availability, and performance.

Codemia · Accepted Answer

- **Functional Requirements:**  
  1. User Registration: Users can create accounts with email/password or social logins.  
  2. User Authentication: Validate user credentials for login.  
  3. Password Management: Allow users to reset passwords and manage their accounts.  
  4. Multi-Factor Authentication (MFA): Support for additional verification methods (e.g., SMS, email).  
  5. Session Management: Manage user sessions securely with token-based authentication.

- **Non-Functional Requirements:**  
  1. Scalability: Must handle millions of concurrent requests.  
  2. Fault Tolerance: Should remain operational even if some components fail.  
  3. Low Latency: Response time under 100ms for authentication requests.  
  4. Security: Strong protection against common vulnerabilities (e.g., SQL injection, XSS).  
  5. Audit Logging: Maintain logs of authentication attempts for security audits.

- We expect around 10 million users, with an average of 5 authentication requests per user per day.  
- **Daily Requests Calculation:**  
  10 million users * 5 requests = 50 million requests per day.  
- **Peak Request Estimation:** Assuming 10% of requests happen during peak hours, we need to handle about 5,000 requests per second.  
- **Data Storage Needs:**  
  If each user record is 1 KB and we store user credentials and metadata for 10 million users, we would need approximately 10 GB of storage.

The architecture consists of the following components:  
1. **Client Interface:**  
   - Web and mobile applications for user interaction.  
2. **Load Balancer:**  
   - Distributes incoming requests across multiple authentication servers.  
3. **Authentication Service:**  
   - Stateless microservices built with Node.js to handle login, registration, and session management.  
4. **Database:**  
   - A NoSQL database (e.g., MongoDB) for user data and credentials.  
5. **Cache Layer:**  
   - Redis for session management and caching frequently accessed user information.  
6. **MFA Service:**  
   - A separate service to handle multi-factor authentication via Twilio for SMS and email verification.  
7. **Monitoring & Logging:**  
   - Tools like Prometheus for monitoring and ELK stack for logging to track system performance and security.

The database schema will include the following collections:  
1. **Users Collection:**  
   - `user_id`: String (Unique identifier)  
   - `email`: String (Unique, indexed)  
   - `password_hash`: String  
   - `created_at`: Date  
   - `updated_at`: Date  
   - `is_active`: Boolean  
2. **Sessions Collection:**  
   - `session_id`: String (Unique identifier)  
   - `user_id`: String (Foreign key)  
   - `created_at`: Date  
   - `expires_at`: Date  
   - `ip_address`: String  
3. **MFA Tokens Collection:**  
   - `token_id`: String (Unique identifier)  
   - `user_id`: String (Foreign key)  
   - `token`: String (for verification)  
   - `is_used`: Boolean  
   - `created_at`: Date

- **Consistency vs. Availability:**  
  Choosing a NoSQL database allows for higher availability but might sacrifice some immediate consistency. We can implement eventual consistency for user records.  
- **Performance vs. Security:**  
  Implementing strong password hashing (e.g., bcrypt) can slow down login requests, but it's vital for security. We can mitigate this by caching session tokens.  
- **Single vs. Multi-Service Architecture:**  
  A single monolithic service might simplify deployment but could lead to scalability issues. A microservices approach increases complexity but allows independent scaling of components like the MFA service.

Design a Authentication Service

HRT

What the Interviewer Expects

Key Topics to Cover

How to Approach This

Possible Follow-up Questions

Practice a Similar Problem on Codemia

Sample Answer

Requirements

Capacity Estimation

Submit Your Answer

HRT Software Engineer Interview Guide

Related Questions

Design a high-throughput Inventory Management System

Design a low-latency Rate Limiting System

Design a fault-tolerant Payment System

Design a fault-tolerant Messaging System

Design Walmart Product Search