{"id":40865,"date":"2020-02-05T10:07:04","date_gmt":"2020-02-05T07:07:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961"},"modified":"2020-02-05T10:07:04","modified_gmt":"2020-02-05T07:07:04","slug":"sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","title":{"rendered":"SSO n\u00eb arkitektur\u00ebn mikrosh\u00ebrbimeve. P\u00ebrdorim Keycloak. Pjesa e par\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>N\u00eb \u00e7do kompani t\u00eb madhe, dhe X5 Retail Group nuk \u00ebsht\u00eb p\u00ebrjashtim, me zhvillimin rritet numri i projekteve ku k\u00ebrkohet identifikimi i p\u00ebrdoruesve. Me kalimin e koh\u00ebs, k\u00ebrkohet nj\u00eb kalim fluid i p\u00ebrdoruesve nga nj\u00eb aplikacion n\u00eb tjetrin dhe at\u00ebher\u00eb lind nevoja p\u00ebr p\u00ebrdorimin e nj\u00eb serveri t\u00eb vet\u00ebm p\u00ebr identifikim, Single-Sign-On (SSO). Por si t\u00eb veprojm\u00eb kur provajder\u00ebt e till\u00eb t\u00eb identitetit si AD ose t\u00eb tjer\u00eb, q\u00eb nuk kan\u00eb atribute t\u00eb tjera shtes\u00eb, tashm\u00eb p\u00ebrdoren n\u00eb projekte t\u00eb ndryshme. P\u00ebr k\u00ebt\u00eb, do t\u00eb na ndihmojn\u00eb sistemet e klas\u00ebs s\u00eb quajtur \"broker\u00ebt e identitetit\". M\u00eb t\u00eb funksional\u00ebt jan\u00eb p\u00ebrfaq\u00ebsuesit e tij, t\u00eb till\u00eb si Keycloak, Gravitee Access Management, etj. M\u00eb s\u00eb shpeshti, skenar\u00ebt e p\u00ebrdorimit mund t\u00eb jen\u00eb t\u00eb ndrysh\u00ebm: nd\u00ebrveprimi i makinave, pjes\u00ebmarrja e p\u00ebrdoruesve, etj. Zgjidhja duhet t\u00eb mb\u00ebshtes\u00eb nj\u00eb funksionalitet fleksib\u00ebl dhe t\u00eb shkall\u00ebzuesh\u00ebm, n\u00eb gjendje t\u00eb bashkoj\u00eb t\u00eb gjitha k\u00ebrkesat n\u00eb nj\u00eb, dhe nj\u00eb zgjidhje e till\u00eb n\u00eb kompanin\u00eb ton\u00eb aktualisht \u00ebsht\u00eb brokeri i identitetit \u2013 Keycloak. <\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikrosh\u00ebrbimeve. P\u00ebrdorim Keycloak. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/02\/3a7f1d5f68fa5d07fc30f2804dc62bef.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nKeycloak \u2013 \u00ebsht\u00eb nj\u00eb produkt me kod t\u00eb hapur, i destinuar p\u00ebr identifikimin dhe kontrollin e qasjes, dhe i mb\u00ebshtetur nga kompania RedHat. Ai \u00ebsht\u00eb baza p\u00ebr produktet e kompanis\u00eb q\u00eb p\u00ebrdorin SSO \u2013 RH-SSO.<\/p>\n<h3>Koncepte themelore <\/h3>\n<p>\nPara se t\u00eb filloni t\u00eb shqyrtoni zgjidhjet dhe qasjet, duhet t\u00eb p\u00ebrcaktoni terminologjin\u00eb dhe sekuenc\u00ebn e proceseve:<\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikrosh\u00ebrbimeve. P\u00ebrdorim Keycloak. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/02\/3a83d4364425aeed1019662fd1d5f152.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Identifikimi<\/b> \u2014 \u00ebsht\u00eb procedura e njohjes s\u00eb subjektit sipas identifikuesit t\u00eb tij (thjesht, kjo \u00ebsht\u00eb p\u00ebrcaktimi i emrit, login-it ose numrit).<\/p>\n<p><b>Autentifikimi<\/b> \u2013 \u00ebsht\u00eb procedura e verifikimit t\u00eb identitetit (p\u00ebrdoruesi verifikohet me an\u00eb t\u00eb nj\u00eb fjal\u00ebkalimi, letra verifikohet me an\u00eb t\u00eb nj\u00eb n\u00ebnshkrimi elektronike, etj.)<\/p>\n<p><b>Autorizimi<\/b> \u2013 \u00ebsht\u00eb ofrimi i qasjes n\u00eb nj\u00eb burim t\u00eb caktuar (p\u00ebr shembull, n\u00eb email-in tuaj).<\/p>\n<h4>Brokeri i identifikimit Keycloak<\/h4>\n<p>\n<b>Keycloak<\/b> \u2014 \u00ebsht\u00eb nj\u00eb zgjidhje p\u00ebr menaxhimin e identifikimit dhe qasjes me kod t\u00eb hapur, e destinuar p\u00ebr t'u p\u00ebrdorur n\u00eb Sistemet e Informacionit ku mund t\u00eb p\u00ebrdoren modele t\u00eb arkitektur\u00ebs mikrosh\u00ebrbimeve.<\/p>\n<p>Keycloak ofron funksione t\u00eb tilla si hyrje e vetme (SSO), identifikim broker dhe hyrje sociale, federat\u00eb p\u00ebrdoruesish, adaptues klient\u00ebsh, konsol\u00eb administratori dhe konsol\u00eb menaxhimi p\u00ebr llogarit\u00eb.<\/p>\n<p>Funksionaliteti baz\u00eb, i mb\u00ebshtetur n\u00eb Keycloak:<\/p>\n<ul>\n<li>Single-Sign On dhe Single-Sign Out p\u00ebr aplikacionet e shfletuesit.<\/li>\n<li>Mb\u00ebshtetje p\u00ebr OpenID\/OAuth 2.0\/SAML.<\/li>\n<li>Identity Brokering \u2013 autentifikimi me an\u00eb t\u00eb ofruesve t\u00eb jasht\u00ebm t\u00eb identitetit OpenID Connect ose SAML.<\/li>\n<li>Social Login \u2013 mb\u00ebshtetje p\u00ebr Google, GitHub, Facebook, Twitter p\u00ebr identifikimin e p\u00ebrdoruesve.<\/li>\n<li>User Federation \u2013 sinkronizimi i p\u00ebrdoruesve nga server\u00ebt LDAP dhe Active Directory dhe ofrues t\u00eb tjer\u00eb identiteti.<\/li>\n<li>Kerberos bridge \u2013 p\u00ebrdorimi i serverit Kerberos p\u00ebr autentifikimin automatik t\u00eb p\u00ebrdoruesve.<\/li>\n<li>Admin Console \u2014 p\u00ebr menaxhimin e centralizuar t\u00eb konfigurimeve dhe parametrave t\u00eb zgjidhjes p\u00ebrmes Web.<\/li>\n<li>Account Management Console \u2013 p\u00ebr menaxhimin e vet\u00ebp\u00ebrdoruesve t\u00eb profileve t\u00eb p\u00ebrdoruesve.<\/li>\n<li>Kustomizimi i zgjidhjes n\u00eb baz\u00eb t\u00eb stilit t\u00eb mark\u00ebs s\u00eb kompanis\u00eb.<\/li>\n<li>2FA Authentication \u2013 mb\u00ebshtetje p\u00ebr TOTP\/HOTP me Google Authenticator ose FreeOTP.<\/li>\n<li>Login Flows \u2013 vet\u00eb-regjistrimi i p\u00ebrdoruesve, rikuperimi dhe rinovimi i fjal\u00ebkalimeve dhe t\u00eb tjera.<\/li>\n<li>Session Management \u2013 administrator\u00ebt mund t\u00eb menaxhojn\u00eb sesionet e p\u00ebrdoruesve nga nj\u00eb pik\u00eb t\u00eb vetme.<\/li>\n<li>Token Mappers \u2013 lidhja e atributeve t\u00eb p\u00ebrdoruesve, roleve dhe atributeve t\u00eb tjera t\u00eb k\u00ebrkuara n\u00eb tokene.<\/li>\n<li>Menaxhimi fleksib\u00ebl i politikave p\u00ebrmes realm, aplikacioneve dhe p\u00ebrdoruesve.<\/li>\n<li>Mb\u00ebshtetje CORS \u2013 adaptuesit e klient\u00ebve kan\u00eb mb\u00ebshtetje t\u00eb integruar p\u00ebr CORS.<\/li>\n<li>Interfatat e Sh\u00ebrbimeve (SPI) \u2013 nj\u00eb num\u00ebr i madh SPI q\u00eb lejojn\u00eb konfigurimin e aspekteve t\u00eb ndryshme t\u00eb funksionimit t\u00eb serverit: rrjedhat e autentikimit, ofruesit e identitetit, p\u00ebrputhja e protokolleve dhe shum\u00eb m\u00eb tep\u00ebr.<\/li>\n<li>Adaptuesit e klient\u00ebve p\u00ebr aplikacione JavaScript, WildFly, JBoss EAP, Fuse, Tomcat, Jetty, Spring.<\/li>\n<li>Mb\u00ebshtetje p\u00ebr pun\u00ebn me aplikacione t\u00eb ndryshme q\u00eb mb\u00ebshtesin bibliotek\u00ebn OpenID Connect Relying Party ose bibliotek\u00ebn SAML 2.0 Service Provider.<\/li>\n<li>Mund\u00ebsia e zgjerimit duke p\u00ebrdorur plugins.<\/li>\n<\/ul>\n<p>\nP\u00ebr proceset CI\/CD, si dhe automatizimin e proceseve t\u00eb menaxhimit n\u00eb Keycloak, mund t\u00eb p\u00ebrdoret REST API\/JAVA API. Dokumentacioni \u00ebsht\u00eb i disponuesh\u00ebm n\u00eb format elektronik: <\/p>\n<p>REST API <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs-api\/8.0\/rest-api\/index.html\">https:\/\/www.keycloak.org\/docs-api\/8.0\/rest-api\/index.html<\/a><\/noindex><br \/>\nJAVA API <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs-api\/8.0\/javadocs\/index.html\">https:\/\/www.keycloak.org\/docs-api\/8.0\/javadocs\/index.html<\/a><\/noindex><\/p>\n<h4>Ofruesit e identitetit t\u00eb nivelit sip\u00ebrmarr\u00ebs (On-Premise)<\/h4>\n<p>\nMund\u00ebsia e autentikimit t\u00eb p\u00ebrdoruesve p\u00ebrmes sh\u00ebrbimeve t\u00eb Federat\u00ebs s\u00eb P\u00ebrdoruesve.<\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikrosh\u00ebrbimeve. P\u00ebrdorim Keycloak. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/02\/59bbeaf4630855467ddb003d52b0c1b6.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGjithashtu mund t\u00eb p\u00ebrdoret autentikim i p\u00ebrbashk\u00ebt \u2014 n\u00ebse p\u00ebrdoruesit autentikohen n\u00eb stacionet e pun\u00ebs me Kerberos (LDAP ose AD), ata mund t\u00eb autentikohen automatikisht n\u00eb Keycloak pa nevoj\u00ebn p\u00ebr t\u00eb p\u00ebrs\u00ebritur emrin e p\u00ebrdoruesit dhe fjal\u00ebkalimin. <\/p>\n<p>P\u00ebr autentikimin dhe autorizimin e m\u00ebtejsh\u00ebm t\u00eb p\u00ebrdoruesve, mund t\u00eb p\u00ebrdoret nj\u00eb DBMS relacional, q\u00eb \u00ebsht\u00eb m\u00eb e p\u00ebrshtatshme p\u00ebr mjediset e zhvillimit sepse nuk k\u00ebrkon konfiguraime t\u00eb gjata dhe integrime n\u00eb fazat e hershme t\u00eb projekteve. N\u00eb m\u00ebnyr\u00eb default, Keycloak p\u00ebrdor nj\u00eb DBMS t\u00eb integruar p\u00ebr ruajtjen e konfigurimeve dhe t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesve.<\/p>\n<p>Lista e DBMS-ve t\u00eb mb\u00ebshtetur \u00ebsht\u00eb e gjer\u00eb dhe p\u00ebrfshin: MS SQL, Oracle, PostgreSQL, MariaDB, Oracle dhe t\u00eb tjer\u00eb. T\u00eb testuarit m\u00eb s\u00eb miri deri m\u00eb tani jan\u00eb Oracle 12C Release1 RAC dhe Galera 3.12 kluster p\u00ebr MariaDB 10.1.19. <\/p>\n<h4>Ofruesit e identitetit \u2014 login social <\/h4>\n<p>\n\u00cbsht\u00eb e mundur t\u00eb p\u00ebrdoret login nga rrjetet sociale. P\u00ebr aktivizimin e mund\u00ebsis\u00eb p\u00ebr t\u00eb autentikuar p\u00ebrdoruesit, p\u00ebrdoret konsola e administratorit n\u00eb Keycloak. Nuk k\u00ebrkohen ndryshime n\u00eb kodin e aplikacioneve dhe ky funksionalitet \u00ebsht\u00eb i disponuesh\u00ebm \"nga kutia\" dhe mund t\u00eb aktivizohet n\u00eb \u00e7do faz\u00eb t\u00eb zbatimit t\u00eb projektit.<\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikrosh\u00ebrbimeve. P\u00ebrdorim Keycloak. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/02\/546ddea10c79662ca37a448d3dfc1fd0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr autentikimin e p\u00ebrdoruesve, \u00ebsht\u00eb e mundur t\u00eb p\u00ebrdoren ofruesit e identitetit OpenID\/SAML.<\/p>\n<h3>Skema tipike t\u00eb autorizimit duke p\u00ebrdorur OAuth2 n\u00eb Keycloak<\/h3>\n<p>\n<b>Authorization Code Flow <\/b> \u2014 p\u00ebrdoret me aplikacionet server (server-side applications). Nj\u00eb nga llojet m\u00eb t\u00eb zakonshme t\u00eb autorizimit, pasi p\u00ebrshtatet mir\u00eb p\u00ebr aplikacionet server, ku kodi burimor i aplikacionit dhe t\u00eb dh\u00ebnat e klientit nuk jan\u00eb t\u00eb qassh\u00ebm p\u00ebr t\u00eb tjer\u00ebt. Procesi n\u00eb k\u00ebt\u00eb rast mb\u00ebshtetet n\u00eb ridrejtimin (redirection). Aplikacioni duhet t\u00eb jet\u00eb n\u00eb gjendje t\u00eb nd\u00ebrveproj\u00eb me agjent\u00ebt e p\u00ebrdoruesit (user-agent), si shfletuesin e internetit \u2014 p\u00ebr t\u00eb marr\u00eb kodet e autorizimit t\u00eb API-s\u00eb t\u00eb ridrejtuara p\u00ebrmes agjentit t\u00eb p\u00ebrdoruesit.<\/p>\n<p><b>Fluksi Implicit<\/b> \u2014 p\u00ebrdoret nga aplikacionet mobile ose webs (aplikacionet q\u00eb punojn\u00eb n\u00eb pajisjen e p\u00ebrdoruesit).<\/p>\n<p>Lloji implicit i autorizimit p\u00ebrdoret nga aplikacionet mobile dhe ato n\u00eb web, ku privat\u00ebsia e klientit nuk mund t\u00eb garantohet. Lloji implicit i autorizimit gjithashtu p\u00ebrdor ridirektimin e agjentit t\u00eb p\u00ebrdoruesit, duke transferuar tokenin e aksesit te agjenti i p\u00ebrdoruesit p\u00ebr p\u00ebrdorim t\u00eb m\u00ebtejsh\u00ebm n\u00eb aplikacion. Kjo e b\u00ebn tokenin t\u00eb disponuesh\u00ebm p\u00ebr p\u00ebrdoruesin dhe aplikacione t\u00eb tjera n\u00eb pajisjen e p\u00ebrdoruesit. N\u00eb k\u00ebt\u00eb lloj autorizimi nuk kryhet autentifikimi i aplikacionit, dhe vet\u00eb procesi mb\u00ebshtetet n\u00eb URL-n\u00eb e ridirektimit (e regjistruar m\u00eb par\u00eb n\u00eb sh\u00ebrbim).<\/p>\n<p>Fluksi Implicit nuk mb\u00ebshtet token\u00ebt e rinovimit (refresh tokens).<br \/>\n<br \/>\n<b>Fluksi i Grant-it t\u00eb Kredencialeve t\u00eb Klientit<\/b> \u2014 p\u00ebrdoren kur aplikacioni ka qasje n\u00eb API. Ky lloj autorizimi zakonisht p\u00ebrdoret p\u00ebr nd\u00ebrveprime 'server-server', q\u00eb duhet t\u00eb kryhen n\u00eb sfond pa nd\u00ebrveprim t\u00eb menj\u00ebhersh\u00ebm me p\u00ebrdoruesin. Fluxi i ofrimit t\u00eb kredencialeve t\u00eb klientit lejon q\u00eb sh\u00ebrbimi n\u00eb internet (klienti konfidencial) t\u00eb p\u00ebrdor\u00eb kredencialet e tij n\u00eb vend t\u00eb personifikimit t\u00eb p\u00ebrdoruesit p\u00ebr verifikimin e identitetit kur th\u00ebrret nj\u00eb sh\u00ebrbim tjet\u00ebr n\u00eb internet. P\u00ebr nj\u00eb nivel m\u00eb t\u00eb lart\u00eb sigurie, sh\u00ebrbimi q\u00eb b\u00ebn thirrjen mund t\u00eb p\u00ebrdor\u00eb nj\u00eb certifikat\u00eb (ndryshe nga sekreti i zakonsh\u00ebm) si kredenciale.<\/p>\n<p>Specifikimi OAuth2 p\u00ebrshkruhet n\u00eb <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc6749\">RFC-6749<\/a><\/noindex> <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc8259\">RFC-8252<\/a><\/noindex> <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc6819\">RFC-6819<\/a><\/noindex><\/p>\n<h3>Tokeni JWT dhe p\u00ebrfitimet e tij<\/h3>\n<p>\nJWT (JSON Web Token) \u2014 nj\u00eb standard i hapur (<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc7519\">https:\/\/tools.ietf.org\/html\/rfc7519<\/a><\/noindex>), i cili p\u00ebrcakton nj\u00eb m\u00ebnyr\u00eb t\u00eb kompakt\u00eb dhe autonome p\u00ebr t\u00eb transferuar informacionin n\u00eb m\u00ebnyr\u00eb t\u00eb sigurt midis pal\u00ebve n\u00eb form\u00ebn e nj\u00eb objekti JSON.<\/p>\n<p>Sipas standardit, tokeni p\u00ebrb\u00ebhet nga tre pjes\u00eb n\u00eb formatin base-64, t\u00eb ndara me pika. Pjesa e par\u00eb quhet header dhe p\u00ebrmban llojin e tokenit dhe emrin e algoritmit t\u00eb hash-it p\u00ebr t\u00eb marr\u00eb n\u00ebnshkrimin digjital. Pjesa e dyt\u00eb ruan informacionin kryesor (p\u00ebrdoruesi, atributet etj.). Pjesa e tret\u00eb \u00ebsht\u00eb n\u00ebnshkrimi digjital.<\/p>\n<p>..<br \/>\nMos e ruani kurr\u00eb tokenin n\u00eb baz\u00ebn tuaj t\u00eb t\u00eb dh\u00ebnave. Sepse nj\u00eb token i vlefsh\u00ebm \u00ebsht\u00eb ekuivalent me nj\u00eb fjal\u00ebkalim; ruajtja e tokenit \u00ebsht\u00eb e barabart\u00eb me ruajtjen e fjal\u00ebkalimit t\u00eb hapur.<br \/>\n<b>Access-token <\/b>\u00ebsht\u00eb nj\u00eb token q\u00eb i jep pronarit t\u00eb tij qasje n\u00eb burimet e mbrojtura t\u00eb serverit. Zakonisht ka nj\u00eb jet\u00ebshkurt\u00ebr dhe mund t\u00eb mbaj\u00eb informacion shtes\u00eb, si p\u00ebr shembull adres\u00ebn IP t\u00eb pal\u00ebs q\u00eb k\u00ebrkon k\u00ebt\u00eb token.<\/p>\n<p><b>Refresh-token <\/b>\u00ebsht\u00eb nj\u00eb token q\u00eb u lejon klient\u00ebve t\u00eb k\u00ebrkojn\u00eb access-token t\u00eb rinj pas skadimit t\u00eb koh\u00ebs s\u00eb tyre t\u00eb jet\u00ebs. K\u00ebto token\u00eb zakonisht jepen p\u00ebr nj\u00eb periudh\u00eb afatgjat\u00eb.<\/p>\n<p>P\u00ebrfitimet kryesore t\u00eb p\u00ebrdorimit n\u00eb arkitektur\u00ebn mikros\u00ebrvizore:<\/p>\n<ul>\n<li>Mund\u00ebsia p\u00ebr t\u00eb pasur qasje n\u00eb aplikacione dhe sh\u00ebrbime t\u00eb ndryshme p\u00ebrmes nj\u00eb autentifikimi nj\u00eb her\u00ebsh.<\/li>\n<li>N\u00eb munges\u00eb t\u00eb disa atribut\u00ebve t\u00eb k\u00ebrkuar n\u00eb profilin e p\u00ebrdoruesve, \u00ebsht\u00eb e mundshme q\u00eb t\u00eb pasurohet me t\u00eb dh\u00ebna q\u00eb mund t\u00eb shtohen n\u00eb ngarkes\u00eb, p\u00ebrfshir\u00eb dhe automatizimin dhe \"n\u00eb flak\u00eb\".<\/li>\n<li>Nuk \u00ebsht\u00eb e nevojshme t\u00eb ruhet informacioni mbi sesionet aktive; aplikacioni server duhet vet\u00ebm t\u00eb verifikoj\u00eb n\u00ebnshkrimin.<\/li>\n<li>Menaxhim m\u00eb fleksib\u00ebl i aksesit p\u00ebrmes atributeve shtes\u00eb n\u00eb ngarkes\u00eb.<\/li>\n<li>P\u00ebrdorimi i n\u00ebnshkrimit t\u00eb tokenit p\u00ebr titullin dhe ngarkes\u00ebn rrit sigurin\u00eb e zgjidhjes n\u00eb t\u00ebr\u00ebsi.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Tokeni JWT \u2014 p\u00ebrb\u00ebrja<\/h3>\n<p>\n<b>Titulli<\/b> \u2014 sipas parazgjedhjeve, titulli p\u00ebrmban vet\u00ebm tipin e tokens dhe algoritmin e p\u00ebrdorur p\u00ebr enkriptim.<\/p>\n<p>Tipi i tokenit ruhet n\u00eb \u00e7el\u00ebsin \u00abtyp\u00bb. \u00c7el\u00ebsi \u00abtyp\u00bb injorohet n\u00eb JWT. N\u00ebse \u00e7el\u00ebsi \u00abtyp\u00bb \u00ebsht\u00eb i pranish\u00ebm, vlera e tij duhet t\u00eb jet\u00eb JWT p\u00ebr t\u00eb treguar se ky objekt \u00ebsht\u00eb JSON Web Token.<\/p>\n<p>\u00c7el\u00ebsi i dyt\u00eb \u00abalg\u00bb p\u00ebrcakton algoritmin e p\u00ebrdorur p\u00ebr enkriptimin e tokenit. Sipas parazgjedhjeve, ai duhet t\u00eb vendoset n\u00eb HS256. Titulli kodifikohet n\u00eb base64.<\/p>\n<p>{ \"alg\": \"HS256\", \"typ\": \"JWT\"}<br \/>\n<b>Ngarkesa (p\u00ebrmbajtja)<\/b> \u2014 n\u00eb ngarkes\u00eb ruhet \u00e7do informacion q\u00eb nevojitet p\u00ebr t'u verifikuar. \u00c7do \u00e7el\u00ebs n\u00eb ngarkes\u00eb njihet si \"deklarat\u00eb\". P\u00ebr shembull, n\u00eb aplikacion mund t\u00eb hyhet vet\u00ebm me ftes\u00eb (promocion i mbyllur). Kur duam t\u00eb ftojm\u00eb dik\u00eb t\u00eb marr\u00eb pjes\u00eb, i d\u00ebrgojm\u00eb atij nj\u00eb let\u00ebr me ftes\u00eb. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb verifikohet se adresa e email-it i p\u00ebrket personit q\u00eb pranon ftes\u00ebn, prandaj ne do ta p\u00ebrfshijm\u00eb k\u00ebt\u00eb adres\u00eb n\u00eb ngarkes\u00eb, duke e ruajtur at\u00eb n\u00eb \u00e7el\u00ebsin \"e-mail\".<\/p>\n<p>{ \"email\": \"example@x5.ru\" }<br \/>\n<br \/>\n\u00c7el\u00ebsat n\u00eb ngarkes\u00eb mund t\u00eb jen\u00eb t\u00eb rast\u00ebsish\u00ebm. Megjithat\u00eb, ka disa t\u00eb rezervuar:<\/p>\n<ul>\n<li>iss (L\u00ebshuesi) \u2014 p\u00ebrcakton aplikacionin nga i cili d\u00ebrgohet tokeni.<\/li>\n<li>sub (Subjekti) \u2014 p\u00ebrcakton tem\u00ebn e tokenit.<\/li>\n<li>aud (Audita) \u2013 nj\u00eb array i vargjeve ndjeshme ndaj rastit ose URI, q\u00eb \u00ebsht\u00eb nj\u00eb list\u00eb e marr\u00ebsve t\u00eb k\u00ebtij tokeni. Kur pala q\u00eb pranon merr JWT me k\u00ebt\u00eb \u00e7el\u00ebs, ajo duhet t\u00eb kontrolloj\u00eb pranin\u00eb e saj n\u00eb marr\u00ebsit \u2014 p\u00ebrndryshe ta injoroj\u00eb tokenin.<\/li>\n<li>exp (Koha e skadenc\u00ebs) \u2014 tregon se kur skadon vlefshm\u00ebria e token-it. Standarti JWT k\u00ebrkon q\u00eb n\u00eb t\u00eb gjitha implementimet e tij token-et me skadenc\u00eb t\u00eb refuzohen. \u00c7el\u00ebsi exp duhet t\u00eb jet\u00eb nj\u00eb shenj\u00eb kohe n\u00eb formatin UNIX.<\/li>\n<li>nbf (Jo Para) \u2014 \u00ebsht\u00eb koha n\u00eb formatin UNIX, q\u00eb p\u00ebrcakton momentin kur token-i do t\u00eb b\u00ebhet i vlefsh\u00ebm.<\/li>\n<li>iat (L\u00ebshuar N\u00eb) \u2014 ky \u00e7el\u00ebs p\u00ebrfaq\u00ebson koh\u00ebn kur token-i \u00ebsht\u00eb l\u00ebshuar dhe mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb p\u00ebrcaktuar mosh\u00ebn e JWT. \u00c7el\u00ebsi iat duhet t\u00eb jet\u00eb nj\u00eb shenj\u00eb kohe n\u00eb formatin UNIX.<\/li>\n<li>Jti (ID e JWT) \u2014 nj\u00eb varg q\u00eb p\u00ebrcakton nj\u00eb identifikues unik t\u00eb k\u00ebtij token-i duke marr\u00eb parasysh t\u00eb gjitha shkronjat.<\/li>\n<\/ul>\n<p>\n\u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptohet se ngarkesa e dobishme nuk transmetohet n\u00eb form\u00eb t\u00eb enkriptuar (megjithat\u00eb, token-et mund t\u00eb jen\u00eb t\u00eb ngjashme dhe n\u00eb at\u00eb rast \u00ebsht\u00eb e mundur t\u00eb transmetohen t\u00eb dh\u00ebna t\u00eb enkriptuara). Prandaj, nuk \u00ebsht\u00eb e mundur t\u00eb ruhet ndonj\u00eb informacion sekret brenda saj. Si\u00e7 \u00ebsht\u00eb edhe titulli, ngarkesa e dobishme kodifikohet n\u00eb base64.<br \/>\n<b>N\u00ebnshkrimi<\/b> \u2014 kur kemi titullin dhe ngarkes\u00ebn, mund t\u00eb llogarisim n\u00ebnshkrimin.<\/p>\n<p>P\u00ebrzgjidhen t\u00eb koduara n\u00eb base64: titulli dhe ngarkesa, ato bashkohen n\u00eb nj\u00eb varg p\u00ebrmes pik\u00ebs. Pastaj ky varg dhe \u00e7el\u00ebsi sekret kalojn\u00eb n\u00eb algoritmin e enkriptimit t\u00eb p\u00ebrcaktuar n\u00eb titull (\u00e7el\u00ebsi \"alg\"). \u00c7el\u00ebsi mund t\u00eb jet\u00eb \u00e7do varg. Vargjet m\u00eb t\u00eb gjata do t\u00eb jen\u00eb m\u00eb t\u00eb preferueshme, pasi do t\u00eb k\u00ebrkojn\u00eb m\u00eb shum\u00eb koh\u00eb p\u00ebr t\u00eb gjetur.<\/p>\n<p>{ \"alg\": \"RSA1_5\", \"payload\": \"A128CBC-HS256\"}<\/p>\n<h3>Nd\u00ebrtimi i arkitektur\u00ebs s\u00eb nj\u00eb klasteri t\u00eb q\u00ebndruesh\u00ebm Keycloak<\/h3>\n<p>\nP\u00ebrsa i p\u00ebrket p\u00ebrdorimit t\u00eb nj\u00eb klasteri t\u00eb vet\u00ebm p\u00ebr t\u00eb gjitha projektet, k\u00ebrkesat p\u00ebr zgjidhjen e SSO jan\u00eb t\u00eb rritura. Kur numri i projekteve \u00ebsht\u00eb i vog\u00ebl, k\u00ebto k\u00ebrkesa nuk ndihen fort n\u00eb t\u00eb gjitha projektet, megjithat\u00eb me rritjen e numrit t\u00eb p\u00ebrdoruesve dhe integrimeve, rriten k\u00ebrkesat p\u00ebr disponueshm\u00ebrin\u00eb dhe performanc\u00ebn. <\/p>\n<p>Rritja e rrezikut t\u00eb d\u00ebshtimit t\u00eb nj\u00eb SSO t\u00eb vet\u00ebm ngre k\u00ebrkesat p\u00ebr arkitektur\u00ebn e zgjidhjes dhe metodat e p\u00ebrdorura p\u00ebr rezervimin e komponent\u00ebve dhe \u00e7on n\u00eb nj\u00eb SLA shum\u00eb strikte. Si\u00e7 ndodh, shpesh gjat\u00eb zhvillimit ose fazave t\u00eb hershme t\u00eb zbatimit t\u00eb zgjidhjeve, projektet kan\u00eb infrastruktur\u00eb t\u00eb vet\u00ebn q\u00eb nuk \u00ebsht\u00eb e q\u00ebndrueshme ndaj d\u00ebshtimeve. Me zhvillimin, \u00ebsht\u00eb e nevojshme t\u00eb planifikohet mund\u00ebsia e zhvillimit dhe shkall\u00ebzimit. Nj\u00eb klaster i q\u00ebndruesh\u00ebm ndaj d\u00ebshtimeve nd\u00ebrtuar m\u00eb fleksib\u00ebl me p\u00ebrdorimin e virtualizimit t\u00eb kontejner\u00ebve ose qasjes hibride. <\/p>\n<p>P\u00ebr t\u00eb punuar n\u00eb modin Active\/Active dhe Active\/Passive, klasteri k\u00ebrkon ruajtjen e q\u00ebndrueshm\u00ebris\u00eb s\u00eb t\u00eb dh\u00ebnave n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave relacional \u2014 t\u00eb dy nyjet e baz\u00ebs s\u00eb t\u00eb dh\u00ebnave duhet t\u00eb replikohen n\u00eb m\u00ebnyr\u00eb sinxhrone midis qendrave t\u00eb t\u00eb dh\u00ebnave t\u00eb distribuuara gjeografikisht.<\/p>\n<p>Shembulli m\u00eb i thjesht\u00eb i instalimit t\u00eb q\u00ebndruesh\u00ebm ndaj d\u00ebshtimeve.<\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikrosh\u00ebrbimeve. P\u00ebrdorim Keycloak. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/02\/c0df30a07e7dda5ae892a1fca3790a45.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCilat jan\u00eb p\u00ebrfitimet e p\u00ebrdorimit t\u00eb nj\u00eb klasteri t\u00eb vet\u00ebm:<\/p>\n<ul>\n<li>Disponueshm\u00ebri e lart\u00eb dhe performanc\u00eb.<\/li>\n<li>Mb\u00ebshtetje p\u00ebr m\u00ebnyrat e pun\u00ebs: Active\/Active, Active\/Passive.<\/li>\n<li>Mund\u00ebsia e shkall\u00ebzimit dinamik \u2014 me p\u00ebrdorimin e virtualizimit t\u00eb kontejner\u00ebve.<\/li>\n<li>Mund\u00ebsia e menaxhimit dhe monitorimit t\u00eb centralizuar.<\/li>\n<li>Q\u00ebndrim i vet\u00ebm p\u00ebr identifikimin\/autentifikimin\/autorizimin e p\u00ebrdoruesve n\u00eb projekte.<\/li>\n<li>Interaction m\u00eb e qart\u00eb mes projekteve t\u00eb ndryshme pa p\u00ebrfshirjen e p\u00ebrdoruesve.<\/li>\n<li>Mund\u00ebsia e rip\u00ebrdorimit t\u00eb tokenit JWT n\u00eb projekte t\u00eb ndryshme.<\/li>\n<li>Nj\u00eb pik\u00eb e vetme besimi.<\/li>\n<li>Nisje m\u00eb e shpejt\u00eb e projekteve duke p\u00ebrdorur mikrosh\u00ebrbime\/virtualizimin e kontejner\u00ebve (nuk k\u00ebrkohet ngritja dhe konfigurimi i komponenteve t\u00eb tjera).<\/li>\n<li>Mund\u00ebsia p\u00ebr t\u00eb bler\u00eb mb\u00ebshtetje komerciale nga shit\u00ebsi. <\/li>\n<\/ul>\n<p><\/p>\n<h3>\u00c7far\u00eb duhet t\u00eb kushtohet v\u00ebmendje gjat\u00eb planifikimit t\u00eb klasterit<\/h3>\n<p><\/p>\n<h4>DBMS<\/h4>\n<p>\nKeycloak p\u00ebrdor nj\u00eb sistem menaxhimi DBMS p\u00ebr ruajtjen e: realms, clients, users, etj.<br \/>\nMb\u00ebshtetet nj\u00eb gam\u00eb e gjer\u00eb e DBMS: MS SQL, Oracle, MySQL, PostgreSQL. Keycloak vjen me nj\u00eb baz\u00eb t\u00eb dh\u00ebnash relacional t\u00eb integruar. P\u00ebrdorimi rekomandohet p\u00ebr ambientet e pak ngarkuara \u2013 si p\u00ebr shembull ambientet e zhvillimit.<\/p>\n<p>P\u00ebr pun\u00ebn n\u00eb modalitetin Active\/Active dhe Active\/Passive t\u00eb klasterit k\u00ebrkohet t\u00eb sigurohet q\u00eb t\u00eb dh\u00ebnat t\u00eb jen\u00eb t\u00eb q\u00ebndrueshme n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave relacionale dhe t\u00eb dy nyjet e klasterit t\u00eb baz\u00ebs s\u00eb t\u00eb dh\u00ebnave t\u00eb replikohen n\u00eb m\u00ebnyr\u00eb t\u00eb sinkronizuar mes Qendrave t\u00eb T\u00eb Dh\u00ebnave.<\/p>\n<h4>Cache e shp\u00ebrndar\u00eb (Infinispan)<\/h4>\n<p>\nP\u00ebr funksionimin e sakt\u00eb t\u00eb klasterit, k\u00ebrkohet sinkronizimi shtes\u00eb i tipeve t\u00eb ndryshme t\u00eb caches duke p\u00ebrdorur JBoss Data Grid:<\/p>\n<p>Sesione t\u00eb autentikimit \u2014 p\u00ebrdoret p\u00ebr ruajtjen e t\u00eb dh\u00ebnave gjat\u00eb autentikimit t\u00eb nj\u00eb p\u00ebrdoruesi t\u00eb caktuar. K\u00ebrkesat nga ky cache zakonisht p\u00ebrfshijn\u00eb vet\u00ebm shfletuesin dhe serverin Keycloak, dhe jo aplikacionin.<\/p>\n<p>Tokenat e veprimit \u2014 p\u00ebrdoren p\u00ebr skenar\u00ebt kur p\u00ebrdoruesi duhet t\u00eb konfirmoj\u00eb nj\u00eb veprim asinkronisht (n\u00ebp\u00ebrmjet email-it). P\u00ebr shembull, gjat\u00eb procesit t\u00eb rikujtimit t\u00eb fjal\u00ebkalimit, cache-i i actionTokens Infinispan p\u00ebrdoret p\u00ebr t\u00eb ndjekur metadata n\u00eb lidhje me shenjat e veprimit t\u00eb lidhura q\u00eb jan\u00eb p\u00ebrdorur tashm\u00eb, ndaj nuk mund t\u00eb p\u00ebrdoren p\u00ebrs\u00ebri.<\/p>\n<p>Caching dhe pastrimi i t\u00eb dh\u00ebnave t\u00eb q\u00ebndrueshme - p\u00ebrdoret p\u00ebr t\u00eb b\u00ebr\u00eb cache t\u00eb t\u00eb dh\u00ebnave t\u00eb q\u00ebndrueshme p\u00ebr t\u00eb shmangur k\u00ebrkesat e panevojshme n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave. Kur ndonj\u00eb server Keycloak azhurnon t\u00eb dh\u00ebnat, t\u00eb gjith\u00eb server\u00ebt e tjer\u00eb Keycloak n\u00eb t\u00eb gjitha qendrat e t\u00eb dh\u00ebnave duhet t\u00eb jen\u00eb n\u00eb dijeni p\u00ebr k\u00ebt\u00eb.<\/p>\n<p>Puna \u2014 p\u00ebrdoret vet\u00ebm p\u00ebr d\u00ebrgimin e mesazheve t\u00eb pastrimit midis nyjeve t\u00eb klasterit dhe qendrave t\u00eb t\u00eb dh\u00ebnave. <\/p>\n<p>Seancat e p\u00ebrdoruesve \u2014 p\u00ebrdoren p\u00ebr t\u00eb ruajtur t\u00eb dh\u00ebnat e seancave t\u00eb p\u00ebrdoruesve, t\u00eb cilat vlejn\u00eb p\u00ebr gjat\u00eb seanc\u00ebs s\u00eb shfletuesit t\u00eb p\u00ebrdoruesit. Cache duhet t\u00eb trajtoj\u00eb k\u00ebrkesat HTTP nga p\u00ebrdoruesi dhe aplikacioni. <\/p>\n<p>Mbrojtja nga forcimi bruto \u2014 p\u00ebrdoret p\u00ebr t\u00eb ndjekur t\u00eb dh\u00ebnat e hyrjeve t\u00eb d\u00ebshtuar. <\/p>\n<h4>Balancimi i ngarkes\u00ebs<\/h4>\n<p>\nBalancuesi i ngarkes\u00ebs \u00ebsht\u00eb pika e vetme e hyrjes n\u00eb keycloak dhe duhet t\u00eb mb\u00ebshtes\u00eb seancat e ngjitura. <\/p>\n<h4>Servis t\u00eb aplikacioneve<\/h4>\n<p>\nP\u00ebrdoren p\u00ebr t\u00eb kontrolluar nd\u00ebrveprimin e komponent\u00ebve nd\u00ebrmjet tyre dhe mund t\u00eb virtualizohen ose containerizohen duke p\u00ebrdorur mjete ekzistuese p\u00ebr automatizim dhe shkall\u00ebzim dinamik t\u00eb infrastruktur\u00ebs. Skem\u00ebt m\u00eb t\u00eb zakonshme t\u00eb ndarjes jan\u00eb n\u00eb OpenShift, Kubernates, Rancher.<\/p>\n<p>K\u00ebtu p\u00ebrfundon pjesa e par\u00eb \u2014 teorike. N\u00eb ciklet e ardhshme t\u00eb artikujve do t\u00eb shqyrtohen shembuj integrimesh me ofrues t\u00eb ndrysh\u00ebm t\u00eb identitetit dhe shembuj konfigurimesh.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/X5RetailGroup\/blog\/486778\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0421 \u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0431\u0435\u0441\u0448\u043e\u0432\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0438 \u0442\u043e\u0433\u0434\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Single-Sing-On (SSO). \u041d\u043e \u043a\u0430\u043a \u0431\u044b\u0442\u044c, \u043a\u043e\u0433\u0434\u0430 \u0442\u0430\u043a\u0438\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b \u043a\u0430\u043a AD \u0438\u043b\u0438 \u0438\u043d\u044b\u0435, \u043d\u0435 \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":40866,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-40865","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47SSO \u043d\u0430 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c Keycloak. \u0427\u0430\u0441\u0442\u044c \u21161 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-05T07:07:04+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-05T07:07:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSO mbi arkitektur\u00eb mikrosherbimesh. P\u00ebrdorim Keycloak. Pjesa \u21161 | ProHoster","description":"N\u00eb \u00e7do kompani t\u00eb madhe, dhe X5 Retail Group nuk b\u00ebn p\u00ebrjashtim, me zhvillimin rritet numri i projekteve ku k\u00ebrkohet autorizimi i p\u00ebrdoruesve.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSO \u043d\u0430 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c Keycloak. \u0427\u0430\u0441\u0442\u044c \u21161 | ProHoster","og:description":"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.","og:url":"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T07:07:04+00:00","article:modified_time":"2020-02-05T07:07:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"40865","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:46:14","updated":"2022-09-27 14:28:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/40865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=40865"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/40865\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/40866"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=40865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=40865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=40865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}