{"id":40865,"date":"2020-02-05T10:07:04","date_gmt":"2020-02-05T07:07:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961"},"modified":"2020-02-05T10:07:04","modified_gmt":"2020-02-05T07:07:04","slug":"sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","title":{"rendered":"SSO pe arhitectura microserviciilor. Folosim Keycloak. Partea nr. 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00cen orice companie mare, inclusiv X5 Retail Group, pe m\u0103sur\u0103 ce evolueaz\u0103, cre\u0219te num\u0103rul proiectelor \u00een care este necesar\u0103 autentificarea utilizatorilor. Odat\u0103 cu trecerea timpului, este necesar un transfer f\u0103r\u0103 cusur al utilizatorilor dintr-o aplica\u021bie \u00een alta, iar atunci apare necesitatea de a utiliza un server unic de autentificare Single-Sign-On (SSO). Dar ce s\u0103 facem atunci c\u00e2nd astfel de furnizori de identificare precum AD sau altele, care nu au atribute suplimentare, sunt deja folosi\u021bi \u00een diferite proiecte. \u00cen ajutor vine o clas\u0103 de sisteme numit\u0103 \u201ebrokeri de identificare\u201d. Cele mai func\u021bionale dintre acestea sunt reprezentate de solu\u021bii precum Keycloak, Gravitee Access Management \u0219i altele. Cel mai frecvent scenariile de utilizare pot fi variate: interac\u021biuni automate, participarea utilizatorilor \u0219i altele. Solu\u021bia trebuie s\u0103 suporte o func\u021bionalitate flexibil\u0103 \u0219i scalabil\u0103, capabil\u0103 s\u0103 reuneasc\u0103 toate cerin\u021bele \u00eentr-una singur\u0103, iar solu\u021bia noastr\u0103 la acest moment este brokerul de identificare \u2013 Keycloak. <\/p>\n<p><img decoding=\"async\" alt=\"SSO pe arhitectura microserviciilor. Folosim Keycloak. Partea nr. 1\" src=\"\/wp-content\/uploads\/2020\/02\/3a7f1d5f68fa5d07fc30f2804dc62bef.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nKeycloak este un produs open-source destinat autentific\u0103rii \u0219i gestion\u0103rii accesului, sus\u021binut de compania RedHat. Este baza pentru produsele companiilor care utilizeaz\u0103 SSO \u2013 RH-SSO.<\/p>\n<h3>Concepturi de baz\u0103 <\/h3>\n<p>\n\u00cenainte de a \u00eencepe s\u0103 ne ocup\u0103m de solu\u021bii \u0219i abord\u0103ri, trebuie s\u0103 ne clarific\u0103m termenii \u0219i ordinea proceselor:<\/p>\n<p><img decoding=\"async\" alt=\"SSO pe arhitectura microserviciilor. Folosim Keycloak. Partea nr. 1\" src=\"\/wp-content\/uploads\/2020\/02\/3a83d4364425aeed1019662fd1d5f152.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Identificare<\/b> \u2014 este procedura de recunoa\u0219tere a subiectului prin identificatorul s\u0103u (pe scurt, aceasta este definirea numelui, a loginului sau a num\u0103rului).<\/p>\n<p><b>Autentificare<\/b> \u2014 este procedura de verificare a autenticit\u0103\u021bii (utilizatorul este verificat prin parol\u0103, scrisoarea este verificat\u0103 prin semn\u0103tur\u0103 electronic\u0103 etc.)<\/p>\n<p><b>Autorizare<\/b> \u2014 este furnizarea accesului la un anumit resurs\u0103 (de exemplu, la e-mail).<\/p>\n<h4>Brokerul de identificare Keycloak<\/h4>\n<p>\n<b>Keycloak<\/b> \u2014 este o solu\u021bie pentru gestionarea identific\u0103rii \u0219i accesului cu surs\u0103 deschis\u0103, destinat\u0103 utiliz\u0103rii \u00een sisteme informa\u021bionale \u00een care pot fi utilizate tipare de arhitectur\u0103 microservicii.<\/p>\n<p>Keycloak ofer\u0103 func\u021bii precum autentificare unic\u0103 (SSO), identificare broker \u0219i autentificare social\u0103, federarea utilizatorilor, adaptoare pentru clien\u021bi, consol\u0103 de administrare \u0219i consol\u0103 de gestionare a conturilor.<\/p>\n<p>Func\u021bionalitatea de baz\u0103 sus\u021binut\u0103 \u00een Keycloak:<\/p>\n<ul>\n<li>Single-Sign On \u0219i Single-Sign Out pentru aplica\u021bii web.<\/li>\n<li>Suport pentru OpenID\/OAuth 2.0\/SAML.<\/li>\n<li>Identity Brokering \u2013 autentificare prin intermediul furnizorilor de identitate externi OpenID Connect sau SAML.<\/li>\n<li>Social Login \u2013 suport pentru Google, GitHub, Facebook, Twitter pentru identificarea utilizatorilor.<\/li>\n<li>User Federation \u2013 sincronizarea utilizatorilor din servere LDAP \u0219i Active Directory \u0219i al\u021bi furnizori de identitate.<\/li>\n<li>Kerberos bridge \u2013 utilizarea serverului Kerberos pentru autentificarea automat\u0103 a utilizatorilor.<\/li>\n<li>Admin Console \u2014 pentru gestionarea centralizat\u0103 a set\u0103rilor \u0219i parametrilor solu\u021biei prin intermediul Web.<\/li>\n<li>Account Management Console \u2013 pentru autogestionarea profilului utilizatorilor.<\/li>\n<li>Personalizarea solu\u021biei pe baza stilului de brand al companiei.<\/li>\n<li>2FA Authentication \u2013 suport pentru TOTP\/HOTP prin Google Authenticator sau FreeOTP.<\/li>\n<li>Login Flows \u2013 posibilitatea auto-\u00eenregistr\u0103rii utilizatorilor, recuperarea \u0219i resetarea parolei \u0219i altele.<\/li>\n<li>Session Management \u2013 administratorii pot gestiona sesiunile utilizatorilor dintr-un singur loc.<\/li>\n<li>Token Mappers \u2013 corelarea atributelor utilizatorilor, rolurilor \u0219i altor atribute necesare \u00een tokenuri.<\/li>\n<li>Gestionarea flexibil\u0103 a politicilor prin realm, aplica\u021bie \u0219i utilizatori.<\/li>\n<li>CORS Support \u2013 adaptoare client pentru a avea suport \u00eencorporat pentru CORS.<\/li>\n<li>Service Provider Interfaces (SPI) \u2013 un num\u0103r mare de SPI-uri care permit configurarea diferitelor aspecte ale func\u021bion\u0103rii serverului: fluxuri de autentificare, furnizori de identitate, maparea protocoalelor \u0219i multe altele.<\/li>\n<li>Adaptoare client pentru aplica\u021bii JavaScript, WildFly, JBoss EAP, Fuse, Tomcat, Jetty, Spring.<\/li>\n<li>Suport pentru lucrul cu diferite aplica\u021bii care folosesc biblioteca OpenID Connect Relying Party sau SAML 2.0 Service Provider Library.<\/li>\n<li>Posibilitatea extinderii prin utilizarea pluginurilor.<\/li>\n<\/ul>\n<p>\nPentru procesele CI\/CD, precum \u0219i pentru automatizarea proceselor de gestionare \u00een Keycloak, poate fi utilizat\u0103 REST API\/JAVA API. Documenta\u021bia este disponibil\u0103 \u00een format electronic: <\/p>\n<p>REST API <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs-api\/8.0\/rest-api\/index.html\">https:\/\/www.keycloak.org\/docs-api\/8.0\/rest-api\/index.html<\/a><\/noindex><br \/>\nJAVA API <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs-api\/8.0\/javadocs\/index.html\">https:\/\/www.keycloak.org\/docs-api\/8.0\/javadocs\/index.html<\/a><\/noindex><\/p>\n<h4>Furnizori de identitate la nivel de \u00eentreprindere (On-Premise)<\/h4>\n<p>\nPosibilitatea autentific\u0103rii utilizatorilor prin serviciile User Federation.<\/p>\n<p><img decoding=\"async\" alt=\"SSO pe arhitectura microserviciilor. Folosim Keycloak. Partea nr. 1\" src=\"\/wp-content\/uploads\/2020\/02\/59bbeaf4630855467ddb003d52b0c1b6.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDe asemenea, poate fi utilizat\u0103 autentificarea unic\u0103 \u2014 dac\u0103 utilizatorii se autentific\u0103 pe sta\u021biile de lucru cu Kerberos (LDAP sau AD), atunci ace\u0219tia pot fi autentifica\u021bi automat \u00een Keycloak f\u0103r\u0103 a fi necesar s\u0103 \u00ee\u0219i reintroduc\u0103 numele de utilizator \u0219i parola. <\/p>\n<p>Pentru autentificarea \u0219i autorizarea ulterioar\u0103 a utilizatorilor, se poate utiliza o baz\u0103 de date rela\u021bional\u0103, ceea ce este cel mai aplicabil pentru mediile de dezvoltare, deoarece nu necesit\u0103 configura\u021bii \u0219i integrare extins\u0103 \u00een etapele incipiente ale proiectelor. \u00cen mod implicit, Keycloak folose\u0219te o baz\u0103 de date \u00eencorporat\u0103 pentru stocarea set\u0103rilor \u0219i datelor utilizatorilor.<\/p>\n<p>Lista bazelor de date suportate este extins\u0103 \u0219i include: MS SQL, Oracle, PostgreSQL, MariaDB, Oracle \u0219i altele. Cele mai testate p\u00e2n\u0103 \u00een prezent sunt Oracle 12C Release1 RAC \u0219i clusterul Galera 3.12 pentru MariaDB 10.1.19. <\/p>\n<h4>Furnizori de identificare - conectare social\u0103 <\/h4>\n<p>\nEste posibil\u0103 utilizarea autentific\u0103rii prin re\u021bele sociale. Pentru a activa posibilitatea de autentificare a utilizatorilor, se utilizeaz\u0103 consola de administrare Keycloak. Nu sunt necesare modific\u0103ri \u00een codul aplica\u021biilor, iar aceast\u0103 func\u021bionalitate este disponibil\u0103 'din cutie' \u0219i poate fi activat\u0103 \u00een orice etap\u0103 a implement\u0103rii proiectului.<\/p>\n<p><img decoding=\"async\" alt=\"SSO pe arhitectura microserviciilor. Folosim Keycloak. Partea nr. 1\" src=\"\/wp-content\/uploads\/2020\/02\/546ddea10c79662ca37a448d3dfc1fd0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPentru autentificarea utilizatorilor, este posibil\u0103 utilizarea furnizorilor de identitate OpenID\/SAML.<\/p>\n<h3>Scenarii tipice de autorizare utiliz\u00e2nd OAuth2 \u00een Keycloak<\/h3>\n<p>\n<b>Fluxul codului de autorizare <\/b> \u2014 este utilizat cu aplica\u021biile server-side. Este unul dintre cele mai frecvent \u00eent\u00e2lnite tipuri de permisiune pentru autorizare, deoarece se potrive\u0219te bine aplica\u021biilor server-side, \u00een care codul surs\u0103 al aplica\u021biei \u0219i datele clientului nu sunt accesibile ter\u021bilor. Procesul se bazeaz\u0103 pe redirec\u021bionare. Aplica\u021bia trebuie s\u0103 poat\u0103 interac\u021biona cu agentul utilizatorului, cum ar fi un browser web - pentru a ob\u021bine coduri de autorizare API redirec\u021bionate prin agentul utilizatorului.<\/p>\n<p><b>Fluxul implicit<\/b> \u2014 este utilizat de aplica\u021biile mobile sau web (aplica\u021bii care func\u021bioneaz\u0103 pe dispozitivul utilizatorului).<\/p>\n<p>Tipul implicit de autorizare este utilizat de aplica\u021biile mobile \u0219i web unde confiden\u021bialitatea utilizatorului nu poate fi garantat\u0103. Tipul de autorizare implicit folose\u0219te, de asemenea, redirec\u021bionarea agentului utilizatorului, iar tokenul de acces este transmis agentului utilizatorului pentru utilizare ulterioar\u0103 \u00een aplica\u021bie. Acest lucru face ca tokenul s\u0103 fie disponibil pentru utilizator \u0219i pentru alte aplica\u021bii de pe dispozitivul utilizatorului. \u00cen acest tip de autorizare nu se realizeaz\u0103 autentificarea legitimit\u0103\u021bii aplica\u021biei, iar \u00eentregul proces se bazeaz\u0103 pe URL-ul de redirec\u021bionare (\u00eenregistrat anterior \u00een serviciu).<\/p>\n<p>Fluxul Implicit nu accept\u0103 tokenuri de actualizare a tokenului de acces (refresh tokens).<br \/>\n<br \/>\n<b>Fluxul Client Credentials Grant<\/b> \u2014 este utilizat atunci c\u00e2nd aplica\u021bia acceseaz\u0103 API-ul. Acest tip de autorizare este de obicei folosit pentru interac\u021biuni \u201eserver-server\u201d, care trebuie s\u0103 se desf\u0103\u0219oare \u00een fundal, f\u0103r\u0103 interac\u021biune imediat\u0103 cu utilizatorul. Fluxul de furnizare a acreditivului client permite unui serviciu web (client confidential) s\u0103 foloseasc\u0103 propriile sale acreditive \u00een loc s\u0103 se presupun\u0103 identitatea utilizatorului pentru autentificare atunci c\u00e2nd apeleaz\u0103 un alt serviciu web. Pentru un nivel mai ridicat de securitate, este posibil ca serviciul apelant s\u0103 foloseasc\u0103 un certificat (\u00een locul secretului comun) ca acreditive.<\/p>\n<p>Specificarea OAuth2 este descris\u0103 \u00een <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc6749\">RFC-6749<\/a><\/noindex> <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc8259\">RFC-8252<\/a><\/noindex> <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc6819\">RFC-6819<\/a><\/noindex><\/p>\n<h3>Tokenul JWT \u0219i avantajele sale<\/h3>\n<p>\nJWT (JSON Web Token) este un standard deschis (<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc7519\">https:\/\/tools.ietf.org\/html\/rfc7519<\/a><\/noindex>), care define\u0219te o modalitate compact\u0103 \u0219i autonom\u0103 de transmitere securizat\u0103 a informa\u021biilor \u00eentre p\u0103r\u021bi sub form\u0103 de obiect JSON.<\/p>\n<p>Potrivit standardului, un token este compus din trei p\u0103r\u021bi \u00een format base-64, separate prin puncte. Prima parte se nume\u0219te header, care con\u021bine tipul tokenului \u0219i numele algoritmului de hash pentru ob\u021binerea semn\u0103turii digitale. A doua parte stocheaz\u0103 informa\u021bia principal\u0103 (utilizator, atribute etc.). A treia parte este semn\u0103tura digital\u0103.<\/p>\n<p>..<br \/>\nNu salva\u021bi niciodat\u0103 tokenul \u00een baza dvs. de date. Deoarece un token valid este echivalent cu o parol\u0103, a salva un token este la fel cu a salva o parol\u0103 \u00een clar.<br \/>\n<b>Token de acces <\/b>\u2014 este un token care ofer\u0103 proprietarului s\u0103u acces la resursele protejate ale serverului. De obicei, are o durat\u0103 de via\u021b\u0103 scurt\u0103 \u0219i poate con\u021bine informa\u021bii suplimentare, cum ar fi adresa IP a p\u0103r\u021bii care solicit\u0103 acest token.<\/p>\n<p><b>Token de refresh <\/b>\u2014 este un token care permite clien\u021bilor s\u0103 solicite noi token-uri de acces dup\u0103 expirarea duratei lor de via\u021b\u0103. Aceste token-uri sunt de obicei emise pe o perioad\u0103 lung\u0103.<\/p>\n<p>Principalele avantaje ale utiliz\u0103rii \u00een arhitectura microservicii:<\/p>\n<ul>\n<li>Posibilitatea de a accesa diverse aplica\u021bii \u0219i servicii prin autentificare unic\u0103.<\/li>\n<li>\u00cen absen\u021ba unui num\u0103r de atribute necesare \u00een profilul utilizatorilor, este posibil\u0103 \u00eembog\u0103\u021birea acestuia cu date ce pot fi ad\u0103ugate \u00een payload, inclusiv automatizat \u0219i \u201e\u00een timp real\u201d.<\/li>\n<li>Nu este necesar\u0103 stocarea informa\u021biilor despre sesiunile active, aplica\u021bia de server trebuie doar s\u0103 verifice semn\u0103tura.<\/li>\n<li>O gestionare mai flexibil\u0103 a accesului prin intermediul atributelor suplimentare \u00een payload.<\/li>\n<li>Utilizarea semn\u0103turii token-ului pentru headere \u0219i payload \u00eembun\u0103t\u0103\u021be\u0219te securitatea solu\u021biei \u00een ansamblu.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Token JWT \u2014 structur\u0103<\/h3>\n<p>\n<b>Titlu<\/b> \u2014 \u00een mod implicit, header-ul con\u021bine doar tipul de token \u0219i algoritmul utilizat pentru criptare.<\/p>\n<p>Tipul token-ului este stocat \u00een cheia \u201etyp\u201d. Cheia \u201etyp\u201d este ignorat\u0103 \u00een JWT. Dac\u0103 cheia \u201etyp\u201d este prezent\u0103, valoarea sa trebuie s\u0103 fie JWT, pentru a indica faptul c\u0103 acest obiect este un JSON Web Token.<\/p>\n<p>Al doilea cheie \u201ealg\u201d define\u0219te algoritmul utilizat pentru criptarea token-ului. \u00cen mod implicit, acesta trebuie s\u0103 fie setat la HS256. Header-ul este codificat \u00een base64.<\/p>\n<p>{ \"alg\": \"HS256\", \"typ\": \"JWT\"}<br \/>\n<b>Payload (con\u021binut)<\/b> \u2014 \u00een payload se stocheaz\u0103 orice informa\u021bie care trebuie verificat\u0103. Fiecare cheie din payload este cunoscut\u0103 sub numele de \u201edeclara\u021bie\u201d. De exemplu, \u00een aplica\u021bie se poate intra doar pe invita\u021bie (promo\u021bie \u00eenchis\u0103). Atunci c\u00e2nd dorim s\u0103 invit\u0103m pe cineva s\u0103 participe, \u00eei trimitem un e-mail cu invita\u021bia. Este important s\u0103 verific\u0103m c\u0103 adresa de e-mail \u00eei apar\u021bine persoanei care accept\u0103 invita\u021bia, a\u0219a c\u0103 vom include aceast\u0103 adres\u0103 \u00een payload, salv\u00e2nd-o \u00een cheia \u201ee-mail\u201d<\/p>\n<p>{ \"email\": \"example@x5.ro\" }<br \/>\n<br \/>\nCheile din payload pot fi arbitrare. Cu toate acestea, exist\u0103 c\u00e2teva rezervate:<\/p>\n<ul>\n<li>iss (Issuer) \u2014 define\u0219te aplica\u021bia din care este trimis token-ul.<\/li>\n<li>sub (Subiect) \u2014 define\u0219te tema token-ului.<\/li>\n<li>aud (Public) \u2013 un array de \u0219iruri sensibile la case sau URI, care reprezint\u0103 lista destinatari ai acestui token. C\u00e2nd partea care prime\u0219te JWT cu aceast\u0103 cheie, trebuie s\u0103 verifice dac\u0103 se reg\u0103se\u0219te \u00een destinatari \u2014 altfel, s\u0103 ignore token-ul.<\/li>\n<li>exp (Timp de Expirare) \u2014 indic\u0103 momentul c\u00e2nd expir\u0103 termenul de valabilitate al token-ului. Standardul JWT necesit\u0103 ca \u00een toate implement\u0103rile sale, token-urile expirate s\u0103 fie respinse. Cheia exp trebuie s\u0103 fie un timestamp \u00een format unix.<\/li>\n<li>nbf (Nu \u00cencepe \u00cenainte) \u2014 este timpul \u00een format unix, care define\u0219te momentul \u00een care token-ul devine valid.<\/li>\n<li>iat (Emis La) \u2014 aceast\u0103 cheie reprezint\u0103 momentul \u00een care token-ul a fost emis \u0219i poate fi folosit pentru a determina vechimea JWT. Cheia iat trebuie s\u0103 fie un timestamp \u00een format unix.<\/li>\n<li>jti (ID JWT) \u2014 un \u0219ir care define\u0219te un identificator unic al acestui token, av\u00e2nd \u00een vedere case.<\/li>\n<\/ul>\n<p>\nEste important s\u0103 \u00een\u021belegem c\u0103 payload-ul nu este transmis sub form\u0103 criptat\u0103 (de\u0219i, token-urile pot fi imbricate \u0219i atunci este posibil s\u0103 se transmit\u0103 date criptate). De aceea, nu este bine s\u0103 stoc\u0103m informa\u021bii sensibile aici. La fel ca \u0219i antetul, payload-ul este codificat \u00een base64.<br \/>\n<b>Semn\u0103tur\u0103<\/b> \u2014 c\u00e2nd avem antetul \u0219i payload-ul, putem calcula semn\u0103tura.<\/p>\n<p>Se iau antetul \u0219i payload-ul, codificate \u00een base64, \u0219i se combin\u0103 \u00eentr-un \u0219ir printr-un punct. Apoi, acest \u0219ir \u0219i cheia secret\u0103 sunt introduse \u00een algoritmul de criptare specificat \u00een antet (cheia \u201ealg\u201d). Cheia poate fi orice \u0219ir. \u0218irurile mai lungi sunt preferate, deoarece necesit\u0103 mai mult timp pentru a fi descifrate.<\/p>\n<p>{ \"alg\": \"RSA1_5\", \"payload\": \"A128CBC-HS256\"}<\/p>\n<h3>Construirea arhitecturii de cluster Keycloak rezistent la erori<\/h3>\n<p>\nAtunci c\u00e2nd se utilizeaz\u0103 un singur cluster pentru toate proiectele, cerin\u021bele pentru solu\u021bia SSO cresc. Atunci c\u00e2nd num\u0103rul de proiecte este mic, aceste cerin\u021be nu sunt at\u00e2t de percepute de toate proiectele, \u00eens\u0103, pe m\u0103sur\u0103 ce num\u0103rul utilizatorilor \u0219i integra\u021biilor cre\u0219te, cerin\u021bele pentru disponibilitate \u0219i performan\u021b\u0103 cresc. <\/p>\n<p>Cre\u0219terea riscurilor de e\u0219ec al SSO-ului unic ridic\u0103 cerin\u021bele pentru arhitectura solu\u021biei \u0219i metodele de rezervare a componentelor utilizate, conduc\u00e2nd la un SLA foarte strict. \u00cen acest context, deseori, \u00een fazele de dezvoltare sau implementare timpurie a solu\u021biilor, proiectele dispun de o infrastructur\u0103 care nu este toleranta la erori. Pe m\u0103sur\u0103 ce se dezvolt\u0103, este necesar s\u0103 se prevad\u0103 posibilit\u0103\u021bile de dezvoltare \u0219i scalare. Cel mai flexibil mod de a construi un cluster tolerant la erori este utilizarea virtualiz\u0103rii \u00een containere sau a unei abord\u0103ri hibride. <\/p>\n<p>Pentru a func\u021biona \u00een modul Active\/Active \u0219i Active\/Passive, clusterul trebuie s\u0103 asigure consisten\u021ba datelor \u00een baza de date rela\u021bional\u0103 \u2014 ambele noduri ale bazei de date trebuie s\u0103 fie replic\u0103ri sincronizate \u00eentre diferitele centre de date geografice.<\/p>\n<p>Cel mai simplu exemplu de instalare tolerant\u0103 la erori.<\/p>\n<p><img decoding=\"async\" alt=\"SSO pe arhitectura microserviciilor. Folosim Keycloak. Partea nr. 1\" src=\"\/wp-content\/uploads\/2020\/02\/c0df30a07e7dda5ae892a1fca3790a45.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCe avantaje ofer\u0103 utilizarea unui cluster unic:<\/p>\n<ul>\n<li>Disponibilitate \u0219i performan\u021b\u0103 ridicate.<\/li>\n<li>Suport pentru moduri de operare: Active\/Active, Active\/Passive.<\/li>\n<li>Capacitatea de scalare dinamic\u0103 \u2014 prin utilizarea virtualiz\u0103rii \u00een containere.<\/li>\n<li>Posibilitatea de gestionare \u0219i monitorizare centralizat\u0103.<\/li>\n<li>O abordare unic\u0103 pentru identificarea\/autentificarea\/autorizarea utilizatorilor \u00een proiecte.<\/li>\n<li>Interac\u021biune mai transparent\u0103 \u00eentre diferitele proiecte f\u0103r\u0103 implicarea utilizatorilor.<\/li>\n<li>Posibilitatea reutiliz\u0103rii tokenului JWT \u00een diverse proiecte.<\/li>\n<li>Un singur punct de \u00eencredere.<\/li>\n<li>Lansare mai rapid\u0103 a proiectelor folosind microservicii\/virtualizare \u00een containere (f\u0103r\u0103 a fi necesar\u0103 ridicarea \u0219i configurarea de componente suplimentare).<\/li>\n<li>Posibilitate de achizi\u021bie a suportului comercial de la furnizor. <\/li>\n<\/ul>\n<p><\/p>\n<h3>Ce merit\u0103 luat \u00een considerare atunci c\u00e2nd se planific\u0103 un cluster<\/h3>\n<p><\/p>\n<h4>Baza de date rela\u021bional\u0103<\/h4>\n<p>\nKeycloak folose\u0219te un sistem de gestionare a bazelor de date pentru a p\u0103stra: realm-uri, clien\u021bi, utilizatori etc.<br \/>\nSe suport\u0103 o gam\u0103 larg\u0103 de baze de date: MS SQL, Oracle, MySQL, PostgreSQL. Keycloak vine cu propria baz\u0103 de date rela\u021bional\u0103 \u00eencorporat\u0103. Este recomandat pentru medii nesolicitate - cum ar fi mediile de dezvoltare.<\/p>\n<p>Pentru a func\u021biona \u00een modul Active\/Active \u0219i Active\/Passive, clusterul trebuie s\u0103 asigure consisten\u021ba datelor \u00een baza de date rela\u021bional\u0103, iar ambele noduri ale clusterului de baze de date sunt replic\u0103ri sincronizate \u00eentre centrele de date.<\/p>\n<h4>Cache distribuit (Infinspan)<\/h4>\n<p>\nPentru func\u021bionarea corect\u0103 a clusterului, este necesar\u0103 sincronizarea suplimentar\u0103 a urm\u0103toarelor tipuri de cache, utiliz\u00e2nd JBoss Data Grid:<\/p>\n<p>Sesiuni de autentificare \u2014 utilizate pentru a salva datele \u00een timpul autentific\u0103rii unui utilizator specific. Cererile din acest cache includ de obicei doar browserul \u0219i serverul Keycloak, nu \u0219i aplica\u021bia.<\/p>\n<p>Token-uri de ac\u021biune \u2014 folosite pentru scenarii \u00een care utilizatorul trebuie s\u0103 confirme o ac\u021biune asincron (prin email). De exemplu, \u00een timpul fluxului de recuperare a parolei, cache-ul actionTokens Infinispan este folosit pentru a urm\u0103ri metadatele legate de token-urile de ac\u021biune deja utilizate, astfel \u00eenc\u00e2t acestea s\u0103 nu poat\u0103 fi reutilizate.<\/p>\n<p>Cache \u0219i invalidarea datelor persistente \u2013 utilizat pentru a cache-ui datele permanente, pentru a evita solicit\u0103rile inutile c\u0103tre baza de date. C\u00e2nd un server Keycloak actualizeaz\u0103 datele, toate celelalte servere Keycloak din toate centrele de date trebuie s\u0103 fie la curent.<\/p>\n<p>Work \u2014 utilizat doar pentru a trimite mesaje de invalidare \u00eentre nodurile clusterului \u0219i centrele de date. <\/p>\n<p>Sesiuni de utilizator \u2014 utilizate pentru a p\u0103stra date despre sesiunile utilizatorilor, care sunt valabile pe durata sesiunii browser-ului utilizatorului. Cache-ul trebuie s\u0103 gestioneze cererile HTTP de la utilizatorul final \u0219i de la aplica\u021bie. <\/p>\n<p>Protec\u021bia \u00eempotriva atacurilor brute \u2014 utilizat\u0103 pentru a urm\u0103ri datele despre \u00eencerc\u0103rile e\u0219uate de autentificare. <\/p>\n<h4>\u00cenc\u0103rcarea echilibrat\u0103<\/h4>\n<p>\nLoad balancer-ul este un singur punct de intrare \u00een keycloak \u0219i trebuie s\u0103 suporte sesiuni sticky. <\/p>\n<h4>Servere de aplica\u021bii<\/h4>\n<p>\nSunt utilizate pentru a controla interac\u021biunea componentelor \u00eentre ele \u0219i pot fi virtualizate sau containerizate utiliz\u00e2nd instrumentele de automatizare disponibile \u0219i scalarea dinamic\u0103 a infrastructurii. Cele mai frecvente scenarii de implementare sunt \u00een OpenShift, Kubernetes, Rancher.<\/p>\n<p>Aceasta a fost prima parte \u2013 partea teoretic\u0103 \u2013 finalizat\u0103. \u00cen urm\u0103toarele serii de articole vor fi discutate exemple de integrare cu diferi\u021bi furnizori de identitate \u0219i exemple de configur\u0103ri.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/X5RetailGroup\/blog\/486778\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0421 \u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0431\u0435\u0441\u0448\u043e\u0432\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0438 \u0442\u043e\u0433\u0434\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Single-Sing-On (SSO). \u041d\u043e \u043a\u0430\u043a \u0431\u044b\u0442\u044c, \u043a\u043e\u0433\u0434\u0430 \u0442\u0430\u043a\u0438\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b \u043a\u0430\u043a AD \u0438\u043b\u0438 \u0438\u043d\u044b\u0435, \u043d\u0435 \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":40866,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-40865","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47SSO \u043d\u0430 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c Keycloak. \u0427\u0430\u0441\u0442\u044c \u21161 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-05T07:07:04+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-05T07:07:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSO pe arhitectura de microservicii. Folosim Keycloak. Partea nr. 1 | ProHoster","description":"\u00cen orice companie mare, iar X5 Retail Group nu face excep\u021bie, pe m\u0103sur\u0103 ce evolueaz\u0103, num\u0103rul proiectelor care necesit\u0103 autorizarea utilizatorilor cre\u0219te.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSO \u043d\u0430 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c Keycloak. \u0427\u0430\u0441\u0442\u044c \u21161 | ProHoster","og:description":"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T07:07:04+00:00","article:modified_time":"2020-02-05T07:07:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"40865","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:46:14","updated":"2022-09-27 14:28:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/40865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=40865"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/40865\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/40866"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=40865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=40865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=40865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}