![● Identification: set of attributes related to an entity
(person -> attribute [name, email] )
● Authentication: is the process of verifying an identity (who they say they are)
● Authorization: is the process of verifying what someone is allowed to do
(permissions)
● Accounting: logs, user action, traceability of action
IAAA Security Factor](https://image.slidesharecdn.com/vjvcsowdqwiscvi11bq9-signature-bfa48c0cb7507fc8a7e4f5c326ae0fe4f63559a39e602afe2bad7425998b8940-poli-180927134521/85/Draft-building-secure-applications-with-keycloak-oidc-jwt-3-320.jpg)
Draft: building secure applications with keycloak (oidc/jwt)
- 1. Building secure applications with keycloak (OIDC/JWT) Abhishek Koserwal Red Hat
- 2. Agenda ● IAAA Security factor ● Oauth2/OpenID ● Why? Keycloak ● OIDC/SAML - Keycloak adapters (which & why?) ● Understanding Json Web Token (JWT) ● Integrating frontend(Angular/React) with keycloak adapter. - ● Access token/refresh token ● JWT Validation at backend & securing API endpoints ● Q & A
- 3. ● Identification: set of attributes related to an entity (person -> attribute [name, email] ) ● Authentication: is the process of verifying an identity (who they say they are) ● Authorization: is the process of verifying what someone is allowed to do (permissions) ● Accounting: logs, user action, traceability of action IAAA Security Factor
- 4. Are we using Oauth2/OpenID? Delegation Auth Allow website to access my data without providing my password? ➔ Authentication/Identity Level ➔ Authorization/Access Control Level ➔ Site needs to manage security ➔ Store hash password, verify the hash against a database
- 5. ● Oauth2 != Authentication, only Authorization ● Access Granting Protocol ● Delegated access OAuth2/OpenID? ● Identity, Authentication + Oauth2 = OpenID Connect ● Federation
- 6. Why? Keycloak ● Open source Identity and Access Management solution (https://github.com/keycloak/keycloak) ● Browsers, mobiles and clouds ● Many accounts ● Admin headache Features ● SSO ● Admin console ● Login forms ● Account management ● Multi-factor auth ● Social login ● ..
- 7. Setup: keycloak docker pull jboss/keycloak docker run -d -e KEYCLOAK_USER=<USERNAME> -e KEYCLOAK_PASSWORD=<PASSWORD> -p 8081:8080 jboss/keycloak Require docker daemon running Standalone server distribution (https://www.keycloak.org/downloads.htm)