The ForgeRock Deployment for Cloud Readiness

Patryk Królikowski
ForgeRock Deployment
for Cloud Readiness

Copyright © 2017 ForgeRock, all rights reserved. 3
VS

Configuration as an artefact

GUI as config editor

Container friendliness

12 Factor
Container friendly
Config as an artefact
(Infrastructure as Code)

Copyright © 2017 ForgeRock, all rights reserved.
Lingo
9
helm install stable/mysql
images containersdocker files
K8s manifests helm / charts
yaml

what we support DevOps with?
Sample Dockerfiles:
★ backstage account needed
★ NO images
Sample Kubernetes Manifests
★ for dev/test
Support for deployments using Docker Images
10

DevOps Examples
Minikube / Kubernetes on Google Container Engine:
★ OpenAM / DJ
★ OpenIDM
★ OpenIG
11

something more for Cloud?
ForgeRock Service Broker
★ for Cloud Foundry
★ allows Cloud Foundry apps to access OAuth2 features of our stack
★ automates OAuth2 client profile creation
★ package for installation in Cloud Foundry
12

DIRECTORY SERVICES
IDENTITYGATEWAY
IDENTITYMANAGEMENT
USERMANAGEDACCESS
ACCESSMANAGEMENT
COMMONAUDIT&IDENTITYSERVICES
What about products?

The ForgeRock Deployment for Cloud Readiness

Autonomous Server
★ No crosstalk, no special servers
★ CTS - sole source of state for all tokens
★ Throw me more servers
15

amster
★ realizes configuration as an artefact approach
What is it?
★ interacts with OpenAM via REST based API
★ lightweight OpenAM configurator
★ export/import configs as JSON
16
connect http://www.example.com:8080/openam -k /Users/demo/
keyfile
import-config --path /Users/demo/am-config
:exit

is that all?
… well … no
★ bootstrap - boot.json
★ Agents 5
- no more callbacks
- websocket channel based communications
17

I was (almost) born for DevOps
★ JSON/REST friendly
★ export/import config
but….
★ I still require cluster aware persistence layer
but my parents love me …
★ dynamic cluster handling
★ Immutable Server Configuration
★ config read on startup and stored in memory (not repo)
‣ read only config for PROD and r/w for DEV
19

… me too …
★ stateless
★ I scale easily
★ configs / scripts as an artefact
but….
★ JWT session tokens must use the same key:
‣ same keystore across nodes
‣ distribution via Kubernetes secret volumes
21

… well, I’m a pet
★ stable network identity
★ stable storage
★ sharding- all tokens with same ID go to
same DJ backend
★ in samples we base on Kubernetes
StatefulSet feature.
23
SOURCE: https://www.pinterest.com/pin/539095017866111126/

Caveats
OpenAM
★ browser AuthN is stateful = sticky sessions on LB
★ no direct config export to GIT
★ still some of the OpenAM settings require restart = redeploy
container
OpenIDM
★ JDBC repo available as pre-requirement
★ clusters - node list not modified = may grow fast
24

Configurations
Immutable vs mutable:
★ Config baked into docker image
★ Difficult for OpenAM - shared config store
★ OpenIDM easier and even easier with 5.5
★ OpenIG - well supported
25

OpenAM / OpenDJ example
27

Sample setup
28
kubctl
docker
minikube
helm
fretes
tiller pod
Pod
Docker EngineKubernetes
Minikube
VM

Resources
Docker build files:
https://stash.forgerock.org/scm/docker/docker.git
Kubernetes deployment examples:
https://stash.forgerock.org/scm/docker/fretes.git
Scripts and JSON configs for configuring the AM/DJ/IDM/IG:
https://stash.forgerock.org/scm/cloud/forgeops-init.git
Samples for OpenIG:
https://github.com/ForgeRock/openig-devops-guide
29

The ForgeRock Deployment for Cloud Readiness

More Related Content

What's hot (20)

Similar to The ForgeRock Deployment for Cloud Readiness (20)

More from ForgeRock (20)

Recently uploaded (20)

The ForgeRock Deployment for Cloud Readiness