2019 DevCon - The future of Authentication by Codrin Chirica
- 1. The Future of Authentication Codrin Chirica codrin.chirica@ness.com
- 2. Learn. Connect. Collaborate. Agenda • Authentication until now • Authentication now • Authentication in the future
- 3. Learn. Connect. Collaborate. Authentication until now PROBLEM: • No common, coherent identity management among Alfresco products
- 4. Learn. Connect. Collaborate. Authentication until now • A challenge for customers to configure • ACS and APS need to be kept in-sync with the central user directory (e.g. LDAP sync)
- 5. Learn. Connect. Collaborate. Authentication now SOLUTION: • Alfresco Identity Service (AIS) – What is AIS ? 1
- 6. Learn. Connect. Collaborate. Authentication now • Identity Service leverages the open source identity and access management project Keycloak • https://www.keycloak.org/ • Alfresco theme for login
- 7. Learn. Connect. Collaborate. Authentication now • It provides proof of identity, in the form of a standard token (JWT), understood by: – ACS REST APIs (v1) and CMIS – APS REST APIs – AGS REST API (v1) – ADF
- 8. Learn. Connect. Collaborate. Authentication now • How to deploy ? – The deployment artifact is the alfresco-identity-service Helm Chart https://github.com/Alfresco/charts/blob/master/stable/alfresco-identity-service- 1.0.0.tgz – Deployed, by default, as part of the alfresco-infrastructure Helm Chart https://github.com/Alfresco/charts/blob/master/stable/alfresco-infrastructure-3.0.0.tgz – To deploy, simply run … helm install alfresco-stable/alfresco-infrastructure --version 3.0.0
- 9. Learn. Connect. Collaborate. Authentication now • What gets deployed ? 2
- 10. Learn. Connect. Collaborate. Authentication now • Standalone Distribution – Download the Identity Service zip – Unzip it and run the script:
- 11. Learn. Connect. Collaborate. Authentication now • Useful resources: – Identity Service in GitHub https://github.com/Alfresco/alfresco-identity-service • Issues – https://issues.alfresco.com/jira/projects/MNT/ • (component Alfresco Identity Service) – https://issues.alfresco.com/jira/projects/AUTH/ • (component Alfresco Identity Service)
- 12. Learn. Connect. Collaborate. Authentication in the future • Roadmap for Alfresco Identity Service 2.0 – Digital Workspace – Desktop Sync – Google Docs – Office Docs
- 13. Learn. Connect. Collaborate. Authentication in the future 3 • Problem solved ?!
- 14. Learn. Connect. Collaborate. Authentication in the future • All authentication is done through AIS • ACS does not perform any OTHER authentication
- 15. Learn. Connect. Collaborate. Authentication in the future • All requests sent to ACS must carry a JWT in the header • ACS validates the token
- 16. Learn. Connect. Collaborate. Authentication in the future • User queries public API Gateway • Group queries and group membership will be delegated to AIS
- 17. Learn. Connect. Collaborate. Authentication in the future • Custom authentication ?! 4
- 18. Learn. Connect. Collaborate. Authentication in the future • The Identity Service must accommodate user name changes
- 19. Learn. Connect. Collaborate. Authentication in the future • DEPRECATE: – User profiles in ACS will be deprecated (but not removed) – The authentication chain will be deprecated (but still maintained)
- 20. Learn. Connect. Collaborate. Authentication in the future • Conclusions: – If you have a new project, don't start and write your own authentication chain subsystem, go to Alfresco Identity Service
- 21. Learn. Connect. Collaborate. Authentication in the future • Conclusions: – If you have an extension to the authentication chain, then you can use it but be informed that this will go away at some point in the future.
- 22. The Future of Authentication Codrin Chirica codrin.chirica@ness.com