{"id":40865,"date":"2020-02-05T10:07:04","date_gmt":"2020-02-05T07:07:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961"},"modified":"2020-02-05T10:07:04","modified_gmt":"2020-02-05T07:07:04","slug":"sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","title":{"rendered":"SSO na mikroservisn\u00ed architektu\u0159e. Pou\u017e\u00edv\u00e1me Keycloak. \u010c\u00e1st \u010d. 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Ve v\u011bt\u0161in\u011b velk\u00fdch spole\u010dnost\u00ed, v\u010detn\u011b X5 Retail Group, se s rozvojem zvy\u0161uje po\u010det projekt\u016f, kde je pot\u0159eba autorizace u\u017eivatel\u016f. Postupem \u010dasu je nutn\u00fd bezprobl\u00e9mov\u00fd p\u0159echod u\u017eivatel\u016f mezi aplikacemi, co\u017e vy\u017eaduje pou\u017eit\u00ed jednotn\u00e9ho serveru Single-Sign-On (SSO). Ale co, kdy\u017e u\u017e jsou v r\u016fzn\u00fdch projektech vyu\u017e\u00edv\u00e1ny identifika\u010dn\u00ed poskytovatel\u00e9 jako AD nebo jin\u00e9, kter\u00e9 nemaj\u00ed dal\u0161\u00ed atributy? Na pomoc p\u0159ich\u00e1z\u00ed t\u0159\u00edda syst\u00e9m\u016f nazvan\u00fdch \u201eidentifika\u010dn\u00ed brokery\u201c. Mezi nejv\u00edce funk\u010dn\u00ed se \u0159ad\u00ed jejich z\u00e1stupci, jako jsou Keycloak, Gravitee Access management a dal\u0161\u00ed. Nej\u010dast\u011bji mohou b\u00fdt sc\u00e9n\u00e1\u0159e pou\u017eit\u00ed r\u016fzn\u00e9: strojov\u00e1 interakce, zapojen\u00ed u\u017eivatel\u016f atd. \u0158e\u0161en\u00ed by m\u011blo podporovat flexibiln\u00ed a \u0161k\u00e1lovatelnou funk\u010dnost, schopnou sjednotit v\u0161echny po\u017eadavky v jednom, a takov\u00fdm \u0159e\u0161en\u00edm v na\u0161\u00ed spole\u010dnosti je nyn\u00ed identifika\u010dn\u00ed broker \u2013 Keycloak. <\/p>\n<p><img decoding=\"async\" alt=\"SSO na mikroservisn\u00ed architektu\u0159e. Pou\u017e\u00edv\u00e1me Keycloak. \u010c\u00e1st \u010d. 1\" src=\"\/wp-content\/uploads\/2020\/02\/3a7f1d5f68fa5d07fc30f2804dc62bef.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nKeycloak je produkt s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem, ur\u010den\u00fd pro identifikaci a kontrolu p\u0159\u00edstupu, podporovan\u00fd spole\u010dnost\u00ed RedHat. Je z\u00e1kladem pro produkty spole\u010dnosti vyu\u017e\u00edvaj\u00edc\u00ed SSO \u2013 RH-SSO.<\/p>\n<h3>Z\u00e1kladn\u00ed pojmy <\/h3>\n<p>\nNe\u017e za\u010dneme zkoumat \u0159e\u0161en\u00ed a p\u0159\u00edstupy, m\u011bli bychom se jasn\u011b ur\u010dit v term\u00ednech a posloupnosti proces\u016f:<\/p>\n<p><img decoding=\"async\" alt=\"SSO na mikroservisn\u00ed architektu\u0159e. Pou\u017e\u00edv\u00e1me Keycloak. \u010c\u00e1st \u010d. 1\" src=\"\/wp-content\/uploads\/2020\/02\/3a83d4364425aeed1019662fd1d5f152.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Identifikace<\/b> \u2014 to je procedura rozpozn\u00e1v\u00e1n\u00ed subjektu podle jeho identifik\u00e1toru (jin\u00fdmi slovy, to je ur\u010den\u00ed jm\u00e9na, p\u0159ihl\u00e1\u0161en\u00ed nebo \u010d\u00edsla).<\/p>\n<p><b>Autentizace<\/b> \u2014 to je procedura ov\u011b\u0159ov\u00e1n\u00ed (u\u017eivatel se ov\u011b\u0159uje pomoc\u00ed hesla, e-mail se ov\u011b\u0159uje elektronick\u00fdm podpisem atd.)<\/p>\n<p><b>Autentizace<\/b> \u2014 to je poskytov\u00e1n\u00ed p\u0159\u00edstupu k n\u011bjak\u00e9mu zdroji (nap\u0159. k elektronick\u00e9 po\u0161t\u011b).<\/p>\n<h4>Identifika\u010dn\u00ed broker Keycloak<\/h4>\n<p>\n<b>Keycloak<\/b> \u2014 to je \u0159e\u0161en\u00ed pro spr\u00e1vu identifikace a p\u0159\u00edstupu s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem, ur\u010den\u00e9 pro pou\u017eit\u00ed v IS, kde mohou b\u00fdt pou\u017eity vzory mikroservisn\u00ed architektury.<\/p>\n<p>Keycloak nab\u00edz\u00ed takov\u00e9 funkce, jako je jednotn\u00fd p\u0159\u00edstup (SSO), brokersk\u00e1 identifikace a soci\u00e1ln\u00ed p\u0159ihl\u00e1\u0161en\u00ed, federace u\u017eivatel\u016f, klientsk\u00e9 adapt\u00e9ry, administr\u00e1torskou konzoli a konzoli pro spr\u00e1vu \u00fa\u010dt\u016f.<\/p>\n<p>Z\u00e1kladn\u00ed funk\u010dnost podporovan\u00e1 v Keycloak:<\/p>\n<ul>\n<li>Single-Sign On a Single-Sign Out pro webov\u00e9 aplikace.<\/li>\n<li>Podpora OpenID\/OAuth 2.0\/SAML.<\/li>\n<li>Identity Brokering \u2013 autentizace pomoc\u00ed extern\u00edch poskytovatel\u016f identit OpenID Connect nebo SAML.<\/li>\n<li>Social Login \u2013 podpora pro Google, GitHub, Facebook, Twitter pro identifikaci u\u017eivatel\u016f.<\/li>\n<li>User Federation \u2013 synchronizace u\u017eivatel\u016f z LDAP a Active Directory server\u016f a dal\u0161\u00edch poskytovatel\u016f identit.<\/li>\n<li>Kerberos bridge \u2013 vyu\u017eit\u00ed Kerberos serveru pro automatickou autentizaci u\u017eivatel\u016f.<\/li>\n<li>Admin Console \u2014 pro centr\u00e1ln\u00ed spr\u00e1vu nastaven\u00ed a parametr\u016f \u0159e\u0161en\u00ed prost\u0159ednictv\u00edm Webu.<\/li>\n<li>Account Management Console \u2013 pro samospr\u00e1vu u\u017eivatelsk\u00e9ho profilu.<\/li>\n<li>P\u0159izp\u016fsoben\u00ed \u0159e\u0161en\u00ed na z\u00e1klad\u011b firemn\u00edho stylu.<\/li>\n<li>2FA Authentication \u2013 podpora TOTP\/HOTP pomoc\u00ed Google Authenticator nebo FreeOTP.<\/li>\n<li>Login Flows \u2013 u\u017eivatel\u00e9 mohou prov\u00e1d\u011bt sebedeklaraci, obnovu a resetov\u00e1n\u00ed hesla a dal\u0161\u00ed.<\/li>\n<li>Session Management \u2013 administr\u00e1to\u0159i mohou spravovat relace u\u017eivatel\u016f z jednoho m\u00edsta.<\/li>\n<li>Token Mappers \u2013 p\u0159i\u0159azen\u00ed atribut\u016f u\u017eivatel\u016f, rol\u00ed a dal\u0161\u00edch po\u017eadovan\u00fdch atribut\u016f do token\u016f.<\/li>\n<li>Flexibiln\u00ed spr\u00e1va politik prost\u0159ednictv\u00edm realm, aplikac\u00ed a u\u017eivatel\u016f.<\/li>\n<li>CORS Support \u2013 klientsk\u00e9 adapt\u00e9ry maj\u00ed vestav\u011bnou podporu CORS.<\/li>\n<li>Service Provider Interfaces (SPI) \u2013 \u0161irok\u00e1 \u0161k\u00e1la SPI umo\u017e\u0148uje nastavit r\u016fzn\u00e9 aspekty fungov\u00e1n\u00ed serveru: autentiza\u010dn\u00ed toky, poskytovatele identit, mapov\u00e1n\u00ed protokol\u016f a mnoh\u00e9 dal\u0161\u00ed.<\/li>\n<li>Klientsk\u00e9 adapt\u00e9ry pro JavaScript aplikace, WildFly, JBoss EAP, Fuse, Tomcat, Jetty, Spring.<\/li>\n<li>Podpora pro pr\u00e1ci s r\u016fzn\u00fdmi aplikacemi, kter\u00e9 podporuj\u00ed OpenID Connect Relying Party library nebo SAML 2.0 Service Provider Library.<\/li>\n<li>Mo\u017enost roz\u0161\u00ed\u0159en\u00ed pomoc\u00ed plugin\u016f.<\/li>\n<\/ul>\n<p>\nPro procesy CI\/CD, stejn\u011b jako pro automatizaci proces\u016f spr\u00e1vy v Keycloak, lze pou\u017e\u00edt REST API\/JAVA API. Dokumentace je k dispozici v elektronick\u00e9 podob\u011b: <\/p>\n<p>REST API <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs-api\/8.0\/rest-api\/index.html\">https:\/\/www.keycloak.org\/docs-api\/8.0\/rest-api\/index.html<\/a><\/noindex><br \/>\nJAVA API <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs-api\/8.0\/javadocs\/index.html\">https:\/\/www.keycloak.org\/docs-api\/8.0\/javadocs\/index.html<\/a><\/noindex><\/p>\n<h4>Podnikov\u00e9 identifika\u010dn\u00ed poskytovatele (On-Premise)<\/h4>\n<p>\nMo\u017enost autentizace u\u017eivatel\u016f prost\u0159ednictv\u00edm slu\u017eeb User Federation.<\/p>\n<p><img decoding=\"async\" alt=\"SSO na mikroservisn\u00ed architektu\u0159e. Pou\u017e\u00edv\u00e1me Keycloak. \u010c\u00e1st \u010d. 1\" src=\"\/wp-content\/uploads\/2020\/02\/59bbeaf4630855467ddb003d52b0c1b6.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u016f\u017ee b\u00fdt tak\u00e9 pou\u017eita jednolit\u00e1 autentizace \u2013 pokud se u\u017eivatel\u00e9 autentizuj\u00ed na pracovn\u00edch stanic\u00edch s Kerberos (LDAP nebo AD), mohou b\u00fdt automaticky autentizov\u00e1ni na Keycloak bez nutnosti znovu zad\u00e1vat sv\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no a heslo. <\/p>\n<p>Pro autentizaci a n\u00e1slednou autorizaci u\u017eivatel\u016f je mo\u017en\u00e9 pou\u017e\u00edt rela\u010dn\u00ed datab\u00e1zov\u00fd syst\u00e9m, co\u017e je obvykle nejvhodn\u011bj\u0161\u00ed pro v\u00fdvojov\u00e9 prost\u0159ed\u00ed, nebo\u0165 to nevy\u017eaduje dlouh\u00e9 nastaven\u00ed a integrace v ran\u00fdch f\u00e1z\u00edch projekt\u016f. Ve v\u00fdchoz\u00edm nastaven\u00ed Keycloak pou\u017e\u00edv\u00e1 vestav\u011bnou datab\u00e1zi pro ukl\u00e1d\u00e1n\u00ed nastaven\u00ed a \u00fadaj\u016f o u\u017eivatel\u00edch.<\/p>\n<p>Seznam podporovan\u00fdch datab\u00e1zov\u00fdch syst\u00e9m\u016f je rozs\u00e1hl\u00fd a zahrnuje: MS SQL, Oracle, PostgreSQL, MariaDB, Oracle a dal\u0161\u00ed. V sou\u010dasn\u00e9 dob\u011b jsou nejv\u00edce testov\u00e1ny Oracle 12C Release1 RAC a Galera 3.12 cluster pro MariaDB 10.1.19. <\/p>\n<h4>Identifika\u010dn\u00ed poskytovatel\u00e9 \u2014 soci\u00e1ln\u00ed p\u0159ihl\u00e1\u0161en\u00ed. <\/h4>\n<p>\nJe mo\u017en\u00e9 pou\u017e\u00edvat p\u0159ihl\u00e1\u0161en\u00ed ze soci\u00e1ln\u00edch s\u00edt\u00ed. Pro aktivaci mo\u017enosti autentizovat u\u017eivatele se pou\u017e\u00edv\u00e1 konzole administr\u00e1tora Keycloak. \u017d\u00e1dn\u00e9 zm\u011bny v k\u00f3du aplikac\u00ed nejsou pot\u0159ebn\u00e9 a tento funk\u010dn\u00ed prvek je dostupn\u00fd \"out of the box\" a m\u016f\u017ee b\u00fdt aktivov\u00e1n v jak\u00e9koli f\u00e1zi realizace projektu.<\/p>\n<p><img decoding=\"async\" alt=\"SSO na mikroservisn\u00ed architektu\u0159e. Pou\u017e\u00edv\u00e1me Keycloak. \u010c\u00e1st \u010d. 1\" src=\"\/wp-content\/uploads\/2020\/02\/546ddea10c79662ca37a448d3dfc1fd0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPro autentizaci u\u017eivatel\u016f je mo\u017en\u00e9 pou\u017e\u00edt poskytovatele OpenID\/SAML Identity.<\/p>\n<h3>Typick\u00e9 sc\u00e9n\u00e1\u0159e autorizace s pou\u017eit\u00edm OAuth2 v Keycloak.<\/h3>\n<p>\n<b>Authorization Code Flow <\/b> \u2014 pou\u017e\u00edv\u00e1 se se serverov\u00fdmi aplikacemi (server-side applications). Je to jeden z nejb\u011b\u017en\u011bj\u0161\u00edch typ\u016f povolen\u00ed k autorizaci, proto\u017ee se dob\u0159e hod\u00ed pro serverov\u00e9 aplikace, kde nen\u00ed zdrojov\u00fd k\u00f3d aplikace a data klienta p\u0159\u00edstupn\u00e1 t\u0159et\u00edm osob\u00e1m. Proces je v tomto p\u0159\u00edpad\u011b zalo\u017een na p\u0159esm\u011brov\u00e1n\u00ed. Aplikace by m\u011bla b\u00fdt schopna interagovat s u\u017eivatelsk\u00fdm agentem (user-agent), jako je webov\u00fd prohl\u00ed\u017ee\u010d \u2014 z\u00edsk\u00e1vat k\u00f3dy autorizace API p\u0159esm\u011brov\u00e1van\u00e9 prost\u0159ednictv\u00edm u\u017eivatelsk\u00e9ho agenta.<\/p>\n<p><b>Implicit Flow<\/b> \u2014 pou\u017e\u00edv\u00e1 se mobiln\u00edmi nebo webov\u00fdmi aplikacemi (aplikace b\u011b\u017e\u00edc\u00ed na za\u0159\u00edzen\u00ed u\u017eivatele).<\/p>\n<p>Implicitn\u00ed typ opr\u00e1vn\u011bn\u00ed se pou\u017e\u00edv\u00e1 mobiln\u00edmi a webov\u00fdmi aplikacemi, kde nen\u00ed zaru\u010dena d\u016fv\u011brnost klienta. Tento typ opr\u00e1vn\u011bn\u00ed tak\u00e9 vyu\u017e\u00edv\u00e1 p\u0159esm\u011brov\u00e1n\u00ed u\u017eivatelsk\u00e9ho agenta, kdy se p\u0159\u00edstupov\u00fd token p\u0159ed\u00e1v\u00e1 u\u017eivatelsk\u00e9mu agentu k dal\u0161\u00edmu pou\u017eit\u00ed v aplikaci. To \u010din\u00ed token dostupn\u00fdm u\u017eivateli a dal\u0161\u00edm aplikac\u00edm na za\u0159\u00edzen\u00ed u\u017eivatele. P\u0159i tomto typu opr\u00e1vn\u011bn\u00ed se neprov\u00e1d\u00ed autentizace identity aplikace a cel\u00fd proces se spol\u00e9h\u00e1 na URL p\u0159esm\u011brov\u00e1n\u00ed (d\u0159\u00edve registrovan\u00e9 ve slu\u017eb\u011b).<\/p>\n<p>Implicitn\u00ed tok nepodporuje obnovovac\u00ed tokeny (refresh tokens).<br \/>\n<br \/>\n<b>Grant Flow pro klientsk\u00e9 \u00fadaje<\/b> \u2014 se pou\u017e\u00edv\u00e1 p\u0159i p\u0159\u00edstupu aplikace k API. Tento typ opr\u00e1vn\u011bn\u00ed se obvykle pou\u017e\u00edv\u00e1 pro interakce \"server-server\", kter\u00e9 by m\u011bly prob\u00edhat na pozad\u00ed bez okam\u017eit\u00e9 interakce s u\u017eivateli. Grant Flow pro klientsk\u00e9 \u00fadaje umo\u017e\u0148uje webov\u00e9 slu\u017eb\u011b (d\u016fv\u011brn\u00e9mu klientovi) pou\u017e\u00edvat sv\u00e9 vlastn\u00ed \u00fadaje m\u00edsto zt\u011blesn\u011bn\u00ed u\u017eivatele pro autentizaci p\u0159i vol\u00e1n\u00ed jin\u00fdch webov\u00fdch slu\u017eeb. Pro vy\u0161\u0161\u00ed \u00farove\u0148 zabezpe\u010den\u00ed m\u016f\u017ee volaj\u00edc\u00ed slu\u017eba pou\u017e\u00edt certifik\u00e1t (nam\u00edsto sd\u00edlen\u00e9ho tajemstv\u00ed) jako \u00fadaje.<\/p>\n<p>Specifikace OAuth2 je pops\u00e1na v <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc6749\">RFC-6749<\/a><\/noindex> <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc8259\">RFC-8252<\/a><\/noindex> <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc6819\">RFC-6819<\/a><\/noindex><\/p>\n<h3>JWT token a jeho v\u00fdhody<\/h3>\n<p>\nJWT (JSON Web Token) \u2014 otev\u0159en\u00fd standard (<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc7519\">https:\/\/tools.ietf.org\/html\/rfc7519<\/a><\/noindex>), kter\u00fd ur\u010duje kompaktn\u00ed a autonomn\u00ed zp\u016fsob pro bezpe\u010dn\u00fd p\u0159enos informac\u00ed mezi stranami ve form\u011b JSON objektu.<\/p>\n<p>Podle standardu se token skl\u00e1d\u00e1 ze t\u0159\u00ed \u010d\u00e1st\u00ed v base-64 form\u00e1tu odd\u011blen\u00fdch te\u010dkami. Prvn\u00ed \u010d\u00e1st se naz\u00fdv\u00e1 hlavi\u010dka (header), kter\u00e1 obsahuje typ tokenu a n\u00e1zev hashovac\u00edho algoritmu pro z\u00edsk\u00e1n\u00ed digit\u00e1ln\u00edho podpisu. Druh\u00e1 \u010d\u00e1st uchov\u00e1v\u00e1 hlavn\u00ed informace (u\u017eivatel, atributy atd.). T\u0159et\u00ed \u010d\u00e1st \u2013 digit\u00e1ln\u00ed podpis.<\/p>\n<p>..<br \/>\nNikdy neukl\u00e1dejte token ve va\u0161\u00ed datab\u00e1zi. Proto\u017ee platn\u00fd token je ekvivalentn\u00ed heslu, ukl\u00e1d\u00e1n\u00ed tokenu je stejn\u00e9 jako ukl\u00e1d\u00e1n\u00ed hesla v otev\u0159en\u00e9m form\u00e1tu.<br \/>\n<b>Access-token <\/b>\u2014 je to token, kter\u00fd poskytuje jeho majiteli p\u0159\u00edstup k chr\u00e1n\u011bn\u00fdm zdroj\u016fm serveru. Obvykle m\u00e1 kr\u00e1tkou \u017eivotnost a m\u016f\u017ee obsahovat dal\u0161\u00ed informace, jako je IP adresa strany, kter\u00e1 tento token \u017e\u00e1d\u00e1.<\/p>\n<p><b>Refresh token <\/b>\u2014 je to token, kter\u00fd umo\u017e\u0148uje klient\u016fm po\u017eadovat nov\u00e9 access tokeny po uplynut\u00ed jejich \u017eivotnosti. Tyto tokeny jsou obvykle vyd\u00e1v\u00e1ny na del\u0161\u00ed dobu.<\/p>\n<p>Hlavn\u00ed v\u00fdhody pou\u017eit\u00ed v mikroslu\u017ebov\u00e9 architektu\u0159e:<\/p>\n<ul>\n<li>Mo\u017enost p\u0159\u00edstupu k r\u016fzn\u00fdm aplikac\u00edm a slu\u017eb\u00e1m prost\u0159ednictv\u00edm jednor\u00e1zov\u00e9 autentizace.<\/li>\n<li>Pokud chyb\u00ed n\u011bkter\u00e9 po\u017eadovan\u00e9 atributy v profilu u\u017eivatel\u016f, je mo\u017en\u00e9 obohatit data, kter\u00e1 mohou b\u00fdt do payloadu p\u0159id\u00e1na, v\u010detn\u011b automatizace a 'za b\u011bhu'.<\/li>\n<li>Nen\u00ed nutn\u00e9 uchov\u00e1vat informace o aktivn\u00edch relac\u00edch, serverov\u00e1 aplikace by m\u011bla pouze ov\u011b\u0159it podpis.<\/li>\n<li>Flexibiln\u011bj\u0161\u00ed spr\u00e1va p\u0159\u00edstupu d\u00edky dodate\u010dn\u00fdm atribut\u016fm v payloadu.<\/li>\n<li>Pou\u017eit\u00ed podpisu tokenu pro hlavi\u010dku a payload zvy\u0161uje bezpe\u010dnost \u0159e\u0161en\u00ed jako celku.<\/li>\n<\/ul>\n<p><\/p>\n<h3>JWT token \u2014 slo\u017een\u00ed<\/h3>\n<p>\n<b>Nadpis<\/b> \u2014 ve v\u00fdchoz\u00edm nastaven\u00ed hlavi\u010dka obsahuje pouze typ tokenu a algoritmus pou\u017e\u00edvan\u00fd pro \u0161ifrov\u00e1n\u00ed.<\/p>\n<p>Typ tokenu je ulo\u017een v kl\u00ed\u010di 'typ'. Kl\u00ed\u010d 'typ' je v JWT ignorov\u00e1n. Pokud je kl\u00ed\u010d 'typ' p\u0159\u00edtomen, jeho hodnota by m\u011bla b\u00fdt JWT, aby ozna\u010dila, \u017ee tento objekt je JSON Web Token.<\/p>\n<p>Druh\u00fd kl\u00ed\u010d 'alg' ur\u010duje algoritmus pou\u017e\u00edvan\u00fd pro \u0161ifrov\u00e1n\u00ed tokenu. Ve v\u00fdchoz\u00edm nastaven\u00ed by m\u011bl b\u00fdt nastaven na HS256. Hlavi\u010dka je k\u00f3dov\u00e1na v base64.<\/p>\n<p>{ \"alg\": \"HS256\", \"typ\": \"JWT\"}<br \/>\n<b>Payload (obsah)<\/b> \u2014 v payloadu je ulo\u017eena jak\u00e1koli informace, kterou je t\u0159eba ov\u011b\u0159it. Ka\u017ed\u00fd kl\u00ed\u010d v payloadu je zn\u00e1m jako \"claim\". Nap\u0159\u00edklad, do aplikace lze vstoupit pouze na pozv\u00e1n\u00ed (uzav\u0159en\u00e1 promoakce). Kdy\u017e chceme n\u011bkoho pozvat k \u00fa\u010dasti, po\u0161leme mu e-mail s pozv\u00e1n\u00edm. Je d\u016fle\u017eit\u00e9 ov\u011b\u0159it, \u017ee e-mailov\u00e1 adresa pat\u0159\u00ed osob\u011b, kter\u00e1 pozv\u00e1n\u00ed p\u0159ij\u00edm\u00e1, proto tuto adresu zahrneme do payloadu a ulo\u017e\u00edme ji pod kl\u00ed\u010dem \"e-mail\".<\/p>\n<p>{ \"email\": \"example@x5.ru\" }<br \/>\n<br \/>\nKl\u00ed\u010de v payload mohou b\u00fdt libovoln\u00e9. P\u0159esto existuje n\u011bkolik rezervovan\u00fdch:<\/p>\n<ul>\n<li>iss (Issuer) \u2014 ur\u010duje aplikaci, ze kter\u00e9 je token odes\u00edl\u00e1n.<\/li>\n<li>sub (P\u0159edm\u011bt) \u2014 ur\u010duje t\u00e9ma tokenu.<\/li>\n<li>aud (Publikum) \u2013 pole citliv\u00fdch na velikost p\u00edsmen \u0159et\u011bzc\u016f nebo URI, kter\u00e9 p\u0159edstavuje seznam p\u0159\u00edjemc\u016f tohoto tokenu. Kdy\u017e p\u0159ij\u00edmaj\u00edc\u00ed strana obdr\u017e\u00ed JWT s t\u00edmto kl\u00ed\u010dem, m\u011bla by zkontrolovat, zda je sama mezi p\u0159\u00edjemci \u2013 jinak token ignorovat.<\/li>\n<li>exp (\u010cas expirace) \u2014 ud\u00e1v\u00e1, kdy vypr\u0161\u00ed platnost tokenu. Standard JWT vy\u017eaduje, aby ve v\u0161ech implementac\u00edch byly tokeny s vypr\u0161enou platnost\u00ed odm\u00edtnuty. Kl\u00ed\u010d exp by m\u011bl b\u00fdt \u010dasovou zna\u010dkou ve form\u00e1tu unix.<\/li>\n<li>nbf (Nejprve) \u2014 je to \u010das ve form\u00e1tu unix, kter\u00fd ur\u010duje okam\u017eik, kdy token za\u010dne b\u00fdt platn\u00fd.<\/li>\n<li>iat (Vyd\u00e1no) \u2014 tento kl\u00ed\u010d p\u0159edstavuje \u010das, kdy byl token vyd\u00e1n a m\u016f\u017ee b\u00fdt pou\u017eit k ur\u010den\u00ed st\u00e1\u0159\u00ed JWT. Kl\u00ed\u010d iat by m\u011bl b\u00fdt \u010dasovou zna\u010dkou ve form\u00e1tu unix.<\/li>\n<li>Jti (ID JWT) \u2014 \u0159et\u011bzec, kter\u00fd ur\u010duje unik\u00e1tn\u00ed identifik\u00e1tor tohoto tokenu s ohledem na velikost p\u00edsmen.<\/li>\n<\/ul>\n<p>\nJe d\u016fle\u017eit\u00e9 pochopit, \u017ee payload nen\u00ed p\u0159en\u00e1\u0161en ve \u0161ifrovan\u00e9 podob\u011b (i kdy\u017e mohou b\u00fdt tokeny vno\u0159en\u00e9 a pak je mo\u017en\u00e9 p\u0159en\u00e1\u0161et \u0161ifrovan\u00e1 data). Proto do n\u00ed nelze ukl\u00e1dat \u017e\u00e1dn\u00e9 tajn\u00e9 informace. Stejn\u011b jako hlavi\u010dka, payload je zak\u00f3dov\u00e1na v base64.<br \/>\n<b>Podpis<\/b> \u2014 kdy\u017e m\u00e1me hlavi\u010dku a payload, m\u016f\u017eeme vypo\u010d\u00edtat podpis.<\/p>\n<p>Berou se zak\u00f3dovan\u00e9 v base64: hlavi\u010dka a payload, ty se spoj\u00ed do \u0159et\u011bzce p\u0159es te\u010dku. Pot\u00e9 tento \u0159et\u011bzec a tajn\u00fd kl\u00ed\u010d vstupuj\u00ed do algoritmu \u0161ifrov\u00e1n\u00ed, kter\u00fd je uveden v hlavi\u010dce (kl\u00ed\u010d \u201ealg\u201c). Kl\u00ed\u010d m\u016f\u017ee b\u00fdt jak\u00fdkoliv \u0159et\u011bzec. Del\u0161\u00ed \u0159et\u011bzce budou preferov\u00e1ny, proto\u017ee k jejich prolomen\u00ed bude zapot\u0159eb\u00ed v\u00edce \u010dasu.<\/p>\n<p>{\"alg\":\"RSA1_5\",\"payload\":\"A128CBC-HS256\"}<\/p>\n<h3>Budov\u00e1n\u00ed architektury odoln\u00e9ho klastru Keycloak<\/h3>\n<p>\nP\u0159i pou\u017eit\u00ed jednoho klastru pro v\u0161echny projekty se zvy\u0161uj\u00ed po\u017eadavky na \u0159e\u0161en\u00ed SSO. Kdy\u017e je po\u010det projekt\u016f mal\u00fd, tyto po\u017eadavky nejsou pro v\u0161echny projekty tak patrn\u00e9, av\u0161ak se zvy\u0161uj\u00edc\u00edm se po\u010dtem u\u017eivatel\u016f a integrac\u00ed se zvy\u0161uj\u00ed po\u017eadavky na dostupnost a v\u00fdkonnost. <\/p>\n<p>Zvy\u0161ov\u00e1n\u00ed rizik selh\u00e1n\u00ed jednotn\u00e9ho SSO zvy\u0161uje n\u00e1roky na architekturu \u0159e\u0161en\u00ed a pou\u017e\u00edvan\u00e9 metody z\u00e1lohov\u00e1n\u00ed komponent a vede k velmi p\u0159\u00edsn\u00e9mu SLA. V t\u00e9to souvislosti maj\u00ed \u010dast\u011bji projekty p\u0159i v\u00fdvoji nebo ran\u00fdch f\u00e1z\u00edch implementace \u0159e\u0161en\u00ed vlastn\u00ed infrastrukturu, kter\u00e1 nen\u00ed odoln\u00e1 proti selh\u00e1n\u00ed. S postupem \u010dasu je pot\u0159eba zakotvit mo\u017enosti rozvoje a \u0161k\u00e1lov\u00e1n\u00ed. Nejflexibiln\u011bj\u0161\u00ed je budov\u00e1n\u00ed odoln\u00e9ho clusteru s vyu\u017eit\u00edm kontejnerov\u00e9 virtualizace nebo hybridn\u00edho p\u0159\u00edstupu. <\/p>\n<p>Pro pr\u00e1ci v re\u017eimu Active\/Active a Active\/Passive je t\u0159eba zajistit konzistenci dat v rela\u010dn\u00ed datab\u00e1zi \u2014 oba uzly datab\u00e1ze mus\u00ed b\u00fdt synchronn\u011b replikov\u00e1ny mezi r\u016fzn\u00fdmi geograficky rozlo\u017een\u00fdmi datov\u00fdmi centry.<\/p>\n<p>Nejjednodu\u0161\u0161\u00edm p\u0159\u00edkladem odoln\u00e9 instalace.<\/p>\n<p><img decoding=\"async\" alt=\"SSO na mikroservisn\u00ed architektu\u0159e. Pou\u017e\u00edv\u00e1me Keycloak. \u010c\u00e1st \u010d. 1\" src=\"\/wp-content\/uploads\/2020\/02\/c0df30a07e7dda5ae892a1fca3790a45.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJak\u00e9 v\u00fdhody p\u0159in\u00e1\u0161\u00ed pou\u017eit\u00ed jednotn\u00e9ho clusteru:<\/p>\n<ul>\n<li>Vysok\u00e1 dostupnost a v\u00fdkon.<\/li>\n<li>Podpora re\u017eim\u016f provozu: Active\/Active, Active\/Passive.<\/li>\n<li>Mo\u017enost dynamick\u00e9ho \u0161k\u00e1lov\u00e1n\u00ed \u2014 p\u0159i pou\u017eit\u00ed kontejnerov\u00e9 virtualizace.<\/li>\n<li>Mo\u017enost centralizovan\u00e9ho \u0159\u00edzen\u00ed a monitorov\u00e1n\u00ed.<\/li>\n<li>Jednotn\u00fd p\u0159\u00edstup k identifikaci\/autentizaci\/autoriza\u010dn\u00edm u\u017eivatel\u016fm v projektech.<\/li>\n<li>Transparentn\u011bj\u0161\u00ed interakce mezi r\u016fzn\u00fdmi projekty bez \u00fa\u010dasti u\u017eivatel\u016f.<\/li>\n<li>Mo\u017enost op\u011btovn\u00e9ho vyu\u017eit\u00ed JWT tokenu v r\u016fzn\u00fdch projektech.<\/li>\n<li>Jednotn\u00fd d\u016fv\u011bryhodn\u00fd bod.<\/li>\n<li>Rychlej\u0161\u00ed spu\u0161t\u011bn\u00ed projekt\u016f pomoc\u00ed mikroslu\u017eeb\/kontejnerov\u00e9 virtualizace (nen\u00ed pot\u0159eba z\u0159izov\u00e1n\u00ed a konfigurace dal\u0161\u00edch komponent).<\/li>\n<li>Mo\u017enost zakoupen\u00ed komer\u010dn\u00ed podpory od dodavatele. <\/li>\n<\/ul>\n<p><\/p>\n<h3>Na co je t\u0159eba d\u00e1vat pozor p\u0159i pl\u00e1nov\u00e1n\u00ed clusteru<\/h3>\n<p><\/p>\n<h4>Po\u010d\u00e1te\u010dn\u00ed model<\/h4>\n<p>\nKeycloak pou\u017e\u00edv\u00e1 syst\u00e9m spr\u00e1vy datab\u00e1ze k uchov\u00e1v\u00e1n\u00ed: realms, clients, users atd.<br \/>\nPodporuje \u0161irok\u00e9 spektrum datab\u00e1z\u00ed: MS SQL, Oracle, MySQL, PostgreSQL. Keycloak je dod\u00e1v\u00e1n s vlastn\u00ed integrovanou rela\u010dn\u00ed datab\u00e1z\u00ed. Doporu\u010duje se pou\u017e\u00edvat pro m\u00e9n\u011b zat\u00ed\u017een\u00e9 prost\u0159ed\u00ed \u2013 nap\u0159\u00edklad pro v\u00fdvojov\u00e1 prost\u0159ed\u00ed.<\/p>\n<p>Pro pr\u00e1ci v re\u017eimu Active\/Active a Active\/Passive je t\u0159eba zajistit konzistenci dat v rela\u010dn\u00ed datab\u00e1zi a oba uzly datab\u00e1zov\u00e9ho clusteru jsou synchronn\u011b replikov\u00e1ny mezi datov\u00fdmi centry.<\/p>\n<h4>Distribuovan\u00fd cache (Infinspan)<\/h4>\n<p>\nPro spr\u00e1vnou funkci clustera je nutn\u00e1 dodate\u010dn\u00e1 synchronizace n\u00e1sleduj\u00edc\u00edch typ\u016f cache pomoc\u00ed JBoss Data Grid:<\/p>\n<p>Authenticated sessions \u2014 pou\u017e\u00edv\u00e1 se k uchov\u00e1n\u00ed dat p\u0159i autentifikaci konkr\u00e9tn\u00edho u\u017eivatele. Dotazy z t\u00e9to cache obvykle zahrnuj\u00ed pouze prohl\u00ed\u017ee\u010d a server Keycloak, nikoli aplikaci.<\/p>\n<p>Action tokens \u2014 pou\u017e\u00edvaj\u00ed se pro sc\u00e9n\u00e1\u0159e, kdy je t\u0159eba, aby u\u017eivatel potvrdil akci asynchronn\u011b (e-mailem). Nap\u0159\u00edklad b\u011bhem toku zapomenut\u00e9 heslo cache actionTokens Infinispan slou\u017e\u00ed k sledov\u00e1n\u00ed metadat o souvisej\u00edc\u00edch akc\u00edch, kter\u00e9 ji\u017e byly pou\u017eity, tak\u017ee je nelze pou\u017e\u00edt znovu.<\/p>\n<p>Caching a invalidace trval\u00fdch dat \u2013 pou\u017e\u00edv\u00e1 se k ukl\u00e1d\u00e1n\u00ed trval\u00fdch dat do cache, aby se p\u0159ede\u0161lo nadbyte\u010dn\u00fdm dotaz\u016fm do datab\u00e1ze. Kdy\u017e jak\u00fdkoli server Keycloak aktualizuje data, v\u0161echny ostatn\u00ed servery Keycloak ve v\u0161ech datov\u00fdch centrech o tom mus\u00ed v\u011bd\u011bt.<\/p>\n<p>Work \u2014 pou\u017e\u00edv\u00e1 se pouze k zas\u00edl\u00e1n\u00ed zpr\u00e1v o neplatnosti mezi uzly clusteru a datov\u00fdmi centry. <\/p>\n<p>U\u017eivatelsk\u00e9 relace \u2014 pou\u017e\u00edvaj\u00ed se k uchov\u00e1n\u00ed \u00fadaj\u016f relac\u00ed u\u017eivatel\u016f, kter\u00e9 plat\u00ed po dobu relace prohl\u00ed\u017ee\u010de u\u017eivatele. Cache by m\u011bla zpracov\u00e1vat HTTP dotazy od koncov\u00e9ho u\u017eivatele a aplikace. <\/p>\n<p>Ochrana p\u0159ed brute force \u00fatoky \u2014 pou\u017e\u00edv\u00e1 se k sledov\u00e1n\u00ed \u00fadaj\u016f o ne\u00fasp\u011b\u0161n\u00fdch pokusech o p\u0159ihl\u00e1\u0161en\u00ed. <\/p>\n<h4>Vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee<\/h4>\n<p>\nZ\u00e1t\u011b\u017eov\u00fd vyrovn\u00e1va\u010d je jedin\u00fdm bodem vstupu do keycloaku a m\u011bl by podporovat sticky sessions. <\/p>\n<h4>Aplika\u010dn\u00ed servery<\/h4>\n<p>\nPou\u017e\u00edvaj\u00ed se pro kontrolu interakce komponent mezi sebou a mohou b\u00fdt virtualizov\u00e1ny nebo kontejnerizov\u00e1ny s vyu\u017eit\u00edm dostupn\u00fdch automatiza\u010dn\u00edch a dynamick\u00fdch \u0161k\u00e1lovac\u00edch n\u00e1stroj\u016f automatizace infrastruktury. Nej\u010dast\u011bj\u0161\u00ed sc\u00e9n\u00e1\u0159e nasazen\u00ed jsou v OpenShift, Kubernetes, Rancher.<\/p>\n<p>T\u00edmto kon\u010d\u00ed prvn\u00ed \u010d\u00e1st \u2013 teoretick\u00e1. V n\u00e1sleduj\u00edc\u00edch cyklech \u010dl\u00e1nk\u016f budou p\u0159edstaveny p\u0159\u00edklady integrac\u00ed s r\u016fzn\u00fdmi identifika\u010dn\u00edmi poskytovateli a p\u0159\u00edklady konfigurac\u00ed.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/X5RetailGroup\/blog\/486778\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0421 \u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0431\u0435\u0441\u0448\u043e\u0432\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0438 \u0442\u043e\u0433\u0434\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Single-Sing-On (SSO). \u041d\u043e \u043a\u0430\u043a \u0431\u044b\u0442\u044c, \u043a\u043e\u0433\u0434\u0430 \u0442\u0430\u043a\u0438\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b \u043a\u0430\u043a AD \u0438\u043b\u0438 \u0438\u043d\u044b\u0435, \u043d\u0435 \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":40866,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-40865","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47SSO \u043d\u0430 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c Keycloak. \u0427\u0430\u0441\u0442\u044c \u21161 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-05T07:07:04+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-05T07:07:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSO na mikroslu\u017eebn\u00e9 architektu\u0159e. Pou\u017e\u00edv\u00e1me Keycloak. \u010c\u00e1st \u010d. 1 | ProHoster","description":"Ve v\u0161ech velk\u00fdch firm\u00e1ch, a X5 Retail Group nen\u00ed v\u00fdjimka, s rozvojem roste po\u010det projekt\u016f, kde je vy\u017eadov\u00e1na autorizace u\u017eivatel\u016f.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSO \u043d\u0430 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c Keycloak. \u0427\u0430\u0441\u0442\u044c \u21161 | ProHoster","og:description":"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.","og:url":"https:\/\/prohoster.info\/cs\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T07:07:04+00:00","article:modified_time":"2020-02-05T07:07:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"40865","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:46:14","updated":"2022-09-27 14:28:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/40865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=40865"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/40865\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/40866"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=40865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=40865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=40865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}