{"id":40865,"date":"2020-02-05T10:07:04","date_gmt":"2020-02-05T07:07:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961"},"modified":"2020-02-05T10:07:04","modified_gmt":"2020-02-05T07:07:04","slug":"sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","title":{"rendered":"SSO n\u00eb arkitektur\u00ebn mikroservisore. P\u00ebrdorim Keycloak. Pjesa \u21161","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>N\u00eb \u00e7do kompani t\u00eb madhe, dhe X5 Retail Group nuk b\u00ebn p\u00ebrjashtim, me kalimin e koh\u00ebs rritet numri i projekteve ku k\u00ebrkohet autorizimi i p\u00ebrdoruesve. Me kalimin e koh\u00ebs, nevojitet nj\u00eb kalim pa pengesa i p\u00ebrdoruesve nga nj\u00eb aplikacion n\u00eb tjetrin dhe at\u00ebher\u00eb lind nevoja p\u00ebr p\u00ebrdorimin e nj\u00eb serveri t\u00eb vet\u00ebm p\u00ebr Identifikimin dhe Autorizimin e P\u00ebrdoruesve (Single-Sign-On - SSO). Por si t\u00eb veprohet, kur ofrues t\u00eb till\u00eb identifikimi si AD apo t\u00eb tjer\u00eb, q\u00eb nuk disponojn\u00eb atribute shtes\u00eb, p\u00ebrdoren tashm\u00eb n\u00eb projekte t\u00eb ndryshme. K\u00ebtu vjen ndihma nga nj\u00eb klas\u00eb sistemesh t\u00eb quajtur \"borker identifikimi\". M\u00eb funksional\u00ebt jan\u00eb p\u00ebrfaq\u00ebsuesit e tij, si Keycloak, Gravitee Access management etj. Scenar\u00ebt e p\u00ebrdorimit shpesh mund t\u00eb jen\u00eb t\u00eb ndrysh\u00ebm: nd\u00ebrveprimi makin\u00eb-makine, pjes\u00ebmarrja e p\u00ebrdoruesve, etj. Zgjidhja duhet t\u00eb mb\u00ebshtes\u00eb nj\u00eb funksionalitet fleksib\u00ebl dhe t\u00eb shkall\u00ebzuesh\u00ebm, i aft\u00eb t\u00eb bashkoj\u00eb t\u00eb gjitha k\u00ebrkesat n\u00eb nj\u00eb, dhe zgjidhja e till\u00eb n\u00eb kompanin\u00eb ton\u00eb aktualisht \u00ebsht\u00eb brokeri identifikues \u2013 Keycloak. <\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikroservisore. P\u00ebrdorim Keycloak. Pjesa \u21161\" src=\"\/wp-content\/uploads\/2020\/02\/3a7f1d5f68fa5d07fc30f2804dc62bef.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nKeycloak \u00ebsht\u00eb nj\u00eb produkt me kod t\u00eb hapur, i destinuar p\u00ebr identifikimin dhe kontrollin e aksesit, dhe mb\u00ebshtetet nga kompania RedHat. Ai \u00ebsht\u00eb baza p\u00ebr produktet e kompanis\u00eb q\u00eb p\u00ebrdorin SSO \u2013 RH-SSO.<\/p>\n<h3>Konceptet themelore <\/h3>\n<p>\nPara se t\u00eb filloni t\u00eb hulumtoni zgjidhjet dhe qasjet, duhet t\u00eb p\u00ebrcaktoni terminologjin\u00eb dhe rendin e proceseve:<\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikroservisore. P\u00ebrdorim Keycloak. Pjesa \u21161\" src=\"\/wp-content\/uploads\/2020\/02\/3a83d4364425aeed1019662fd1d5f152.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Identifikimi<\/b> \u2014 kjo \u00ebsht\u00eb procedura e njohjes s\u00eb subjektit me identifikuesin e tij (thjesht, kjo \u00ebsht\u00eb p\u00ebrcaktimi i emrit, username ose numrit).<\/p>\n<p><b>Autentikimi<\/b> \u2013 kjo \u00ebsht\u00eb procedura e verifikimit (p\u00ebrdoruesi verifikohet me fjal\u00ebkalim, emaili verifikohet me n\u00ebnshkrim elektronik etj.)<\/p>\n<p><b>Autorizimi<\/b> \u2013 kjo \u00ebsht\u00eb ofrimi i aksesit n\u00eb ndonj\u00eb burim (p\u00ebr shembull, n\u00eb emailin elektronik).<\/p>\n<h4>Brokeri identifikues Keycloak<\/h4>\n<p>\n<b>Keycloak<\/b> \u2014 kjo \u00ebsht\u00eb nj\u00eb zgjidhje p\u00ebr menaxhimin e identifikimit dhe aksesit me kod t\u00eb hapur, e destinuar p\u00ebr t'u p\u00ebrdorur n\u00eb informacionin e sistemit ku mund t\u00eb p\u00ebrdoren modelet e arkitektur\u00ebs mikrosh\u00ebrbimeve.<\/p>\n<p>Keycloak ofron funksione si: hyrje t\u00eb vetme (SSO), identifikim brokeri dhe hyrje sociale n\u00eb sistem, federat\u00eb p\u00ebrdoruesish, adaptor\u00eb klient\u00ebsh, konsol\u00ebn e administratorit dhe konsol\u00ebn p\u00ebr menaxhimin e llogarive.<\/p>\n<p>Funksionaliteti i baz\u00ebs, i mb\u00ebshtetur n\u00eb Keycloak:<\/p>\n<ul>\n<li>Single-Sign On dhe Single-Sign Out p\u00ebr aplikacione t\u00eb shfletuesit.<\/li>\n<li>Mb\u00ebshtetje p\u00ebr OpenID\/OAuth 2.0\/SAML.<\/li>\n<li>Identiteti i Sh\u00ebrbimit \u2013 autentikimi me ndihm\u00ebn e ofruesve t\u00eb identitetit t\u00eb jasht\u00ebm OpenID Connect ose SAML.<\/li>\n<li>Login Social \u2013 mb\u00ebshtetje p\u00ebr Google, GitHub, Facebook, Twitter p\u00ebr identifikimin e p\u00ebrdoruesve.<\/li>\n<li>Federimi i P\u00ebrdoruesve \u2013 sinkronizimi i p\u00ebrdoruesve nga server\u00ebt LDAP dhe Active Directory dhe ofrues t\u00eb tjet\u00ebr identiteti.<\/li>\n<li>Bridge Kerberos \u2013 p\u00ebrdorimi i serverit Kerberos p\u00ebr autentikimin automatik t\u00eb p\u00ebrdoruesve.<\/li>\n<li>Konsola e Administratorit \u2014 p\u00ebr menaxhimin e centralizuar t\u00eb konfigurimeve dhe parametrave t\u00eb zgjidhjes p\u00ebrmes Web-it.<\/li>\n<li>Konsola e Menaxhimit t\u00eb Llogarive \u2013 p\u00ebr menaxhimin e pavarur t\u00eb profilit t\u00eb p\u00ebrdoruesve.<\/li>\n<li>Kostumizimi i zgjidhjes n\u00eb baz\u00eb t\u00eb stilit t\u00eb brendsh\u00ebm t\u00eb kompanis\u00eb.<\/li>\n<li>Autentikimi 2FA \u2013 mb\u00ebshtetje p\u00ebr TOTP\/HOTP me ndihm\u00ebn e Google Authenticator ose FreeOTP.<\/li>\n<li>Flukset e Ky\u00e7jes \u2013 regjistrimi i vet\u00eb-p\u00ebrdoruesve, rikuperimi dhe rivendosja e fjal\u00ebkalimeve dhe m\u00eb shum\u00eb.<\/li>\n<li>Menaxhimi i Sesioneve \u2013 administrator\u00ebt mund t\u00eb menaxhojn\u00eb sesionet e p\u00ebrdoruesve nga nj\u00eb pik\u00eb qendrore.<\/li>\n<li>Mappers e Token\u00ebve \u2013 lidhja e atributeve t\u00eb p\u00ebrdoruesve, roleve dhe atributeve t\u00eb tjera t\u00eb nevojshme n\u00eb token\u00eb.<\/li>\n<li>Menaxhimi fleksib\u00ebl i politikave p\u00ebrmes realm, aplikacionit dhe p\u00ebrdoruesve.<\/li>\n<li>Mb\u00ebshtetje CORS \u2013 adaptuesit e klient\u00ebve kan\u00eb mb\u00ebshtetje t\u00eb brendshme p\u00ebr CORS.<\/li>\n<li>Interface t\u00eb Ofruesve t\u00eb Sh\u00ebrbimeve (SPI) \u2013 nj\u00eb s\u00ebr\u00eb SPI-s\u00ebh, duke lejuar konfigurimin e aspekteve t\u00eb ndryshme t\u00eb funksionimit t\u00eb serverit: fluxet e autentikimit, ofruesit e identitetit, p\u00ebrputhja e protokolleve dhe shum\u00eb m\u00eb tep\u00ebr.<\/li>\n<li>Adaptuesit e klient\u00ebve p\u00ebr aplikacionet JavaScript, WildFly, JBoss EAP, Fuse, Tomcat, Jetty, Spring.<\/li>\n<li>Mb\u00ebshtetje p\u00ebr pun\u00ebn me aplikacione t\u00eb ndryshme q\u00eb mb\u00ebshtesin bibliotek\u00ebn e OpenID Connect Relying Party ose bibliotek\u00ebn e Sh\u00ebrbimit t\u00eb Ofruesit SAML 2.0.<\/li>\n<li>Mund\u00ebsia e zgjerimit duke p\u00ebrdorur plugins.<\/li>\n<\/ul>\n<p>\nP\u00ebr proceset CI\/CD, si dhe automatizimin e proceseve t\u00eb menaxhimit n\u00eb Keycloak, mund t\u00eb p\u00ebrdoret REST API\/JAVA API. Dokumentacioni \u00ebsht\u00eb i disponuesh\u00ebm n\u00eb format elektronik: <\/p>\n<p>REST API <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs-api\/8.0\/rest-api\/index.html\">https:\/\/www.keycloak.org\/docs-api\/8.0\/rest-api\/index.html<\/a><\/noindex><br \/>\nJAVA API <noindex><a rel=\"nofollow\" href=\"https:\/\/www.keycloak.org\/docs-api\/8.0\/javadocs\/index.html\">https:\/\/www.keycloak.org\/docs-api\/8.0\/javadocs\/index.html<\/a><\/noindex><\/p>\n<h4>Ofruesit e identitetit t\u00eb nivelit t\u00eb nd\u00ebrmarrjes (On-Premise)<\/h4>\n<p>\nMund\u00ebsia p\u00ebr autentikimin e p\u00ebrdoruesve p\u00ebrmes sh\u00ebrbimeve t\u00eb Federimit t\u00eb P\u00ebrdoruesve.<\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikroservisore. P\u00ebrdorim Keycloak. Pjesa \u21161\" src=\"\/wp-content\/uploads\/2020\/02\/59bbeaf4630855467ddb003d52b0c1b6.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGjithashtu, mund t\u00eb p\u00ebrdoret autentikimi i vazhduesh\u00ebm \u2013 n\u00ebse p\u00ebrdoruesit autentikohen n\u00eb stacionet e pun\u00ebs me Kerberos (LDAP ose AD), ata mund t\u00eb autentikohen automatikisht n\u00eb Keycloak pa pasur nevoj\u00eb t\u00eb japin p\u00ebrs\u00ebri emrin e p\u00ebrdoruesit dhe fjal\u00ebkalimin. <\/p>\n<p>P\u00ebr autentikimin dhe autorizimin e m\u00ebpassh\u00ebm t\u00eb p\u00ebrdoruesve, \u00ebsht\u00eb e mundur t\u00eb p\u00ebrdoren nj\u00eb baz\u00eb e dh\u00ebnash relacional, e cila \u00ebsht\u00eb m\u00eb e aplikueshme p\u00ebr mjediset e zhvillimit, pasi nuk k\u00ebrkon konfigurime t\u00eb zgjatura dhe integrime n\u00eb fazat fillestare t\u00eb projekteve. P\u00ebr default, n\u00eb Keycloak p\u00ebrdoret nj\u00eb baz\u00eb e dh\u00ebnash e integruar p\u00ebr ruajtjen e konfigurimeve dhe t\u00eb dh\u00ebnave mbi p\u00ebrdoruesit.<\/p>\n<p>Lista e bazave t\u00eb dh\u00ebnash t\u00eb mb\u00ebshtetura \u00ebsht\u00eb e gjer\u00eb dhe p\u00ebrfshin: MS SQL, Oracle, PostgreSQL, MariaDB, Oracle dhe t\u00eb tjera. Aktualisht, m\u00eb t\u00eb testuarat jan\u00eb Oracle 12C Release1 RAC dhe Galera 3.12 cluster p\u00ebr MariaDB 10.1.19. <\/p>\n<h4>Ofruesit e identifikimit \u2014 ky\u00e7ja sociale <\/h4>\n<p>\n\u00cbsht\u00eb e mundur p\u00ebrdorimi i ky\u00e7jes nga rrjetet sociale. P\u00ebr aktivizimin e mund\u00ebsis\u00eb p\u00ebr t\u00eb autentifikuar p\u00ebrdoruesit, p\u00ebrdoret konsola e administratorit t\u00eb Keycloak. Nuk k\u00ebrkohen ndryshime n\u00eb kodin e aplikacioneve dhe ky funksionalitet \u00ebsht\u00eb i disponuesh\u00ebm \"nga kutia\" dhe mund t\u00eb aktivizohet n\u00eb \u00e7do faz\u00eb t\u00eb realizimit t\u00eb projektit.<\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikroservisore. P\u00ebrdorim Keycloak. Pjesa \u21161\" src=\"\/wp-content\/uploads\/2020\/02\/546ddea10c79662ca37a448d3dfc1fd0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr autentikimin e p\u00ebrdoruesve, \u00ebsht\u00eb e mundur t\u00eb p\u00ebrdoren ofruesit e identitetit OpenID\/SAML.<\/p>\n<h3>Skenar\u00ebt tipik t\u00eb autorizimit me p\u00ebrdorimin e OAuth2 n\u00eb Keycloak<\/h3>\n<p>\n<b>Fluksi i Kodit t\u00eb Autorizimit <\/b> \u2014 p\u00ebrdoret me aplikacionet server-side. Nj\u00eb nga llojet m\u00eb t\u00eb zakonshme t\u00eb lejes p\u00ebr autorizim, pasi \u00ebsht\u00eb shum\u00eb i p\u00ebrshtatsh\u00ebm p\u00ebr aplikacionet server-side, n\u00eb t\u00eb cilat kode burimi i aplikacionit dhe t\u00eb dh\u00ebnat e klientit nuk jan\u00eb t\u00eb aksesueshme p\u00ebr t\u00eb tjer\u00ebt. Procesi n\u00eb k\u00ebt\u00eb rast \u00ebsht\u00eb i nd\u00ebrtuar mbi ridrejtimin (redirection). Aplikacioni duhet t\u00eb jet\u00eb n\u00eb gjendje t\u00eb nd\u00ebrveproj\u00eb me agjent\u00ebt e p\u00ebrdoruesit (user-agents), si\u00e7 \u00ebsht\u00eb shfletuesi i internetit \u2014 p\u00ebr t\u00eb marr\u00eb kodet e autorizimit t\u00eb API q\u00eb ridrejtohen p\u00ebrmes agjent\u00ebve t\u00eb p\u00ebrdoruesve.<\/p>\n<p><b>Fluksi Implicit<\/b> \u2014 p\u00ebrdoret nga aplikacionet mobile ose web (aplikacione q\u00eb punojn\u00eb n\u00eb pajisjen e p\u00ebrdoruesit).<\/p>\n<p>Tipi implicit i autorizimit p\u00ebrdoret nga aplikacionet mobile dhe web, ku privat\u00ebsia e klientit nuk mund t\u00eb garantohet. Ky tip autorizimi gjithashtu p\u00ebrdor ridrejtime t\u00eb agjentit t\u00eb p\u00ebrdoruesit, ku access token-i i kalon agjentit t\u00eb p\u00ebrdoruesit p\u00ebr p\u00ebrdorim t\u00eb m\u00ebvonsh\u00ebm n\u00eb aplikacion. Kjo e b\u00ebn token-in t\u00eb disponuesh\u00ebm p\u00ebr p\u00ebrdoruesin dhe aplikacione t\u00eb tjera n\u00eb pajisjen e p\u00ebrdoruesit. Me k\u00ebt\u00eb tip autorizimi nuk realizohet verifikimi i v\u00ebrtet\u00ebsis\u00eb s\u00eb aplikacionit, dhe procesi mb\u00ebshtetet n\u00eb URL-n\u00eb e ridrejtuar (e regjistruar m\u00eb par\u00eb n\u00eb sh\u00ebrbim).<\/p>\n<p>Implicit Flow nuk mb\u00ebshtet token-at e rinovimit (refresh tokens).<br \/>\n<br \/>\n<b>Fluksi i Akrediteve t\u00eb Klientit<\/b> \u2014 p\u00ebrdoret kur aplikacioni qasje n\u00eb API. Ky tip autorizimi zakonisht p\u00ebrdoret p\u00ebr nd\u00ebrveprime \"server-server\", t\u00eb cilat duhet t\u00eb kryhen n\u00eb sfond pa nd\u00ebrveprim t\u00eb menj\u00ebhersh\u00ebm me p\u00ebrdoruesin. Fluksi i akrediteve t\u00eb klientit lejon sh\u00ebrbimet n\u00eb internet (klient\u00eb konfidencial\u00eb) t\u00eb p\u00ebrdorin akreditimet e tyre n\u00eb vend t\u00eb identifikimit t\u00eb p\u00ebrdoruesit p\u00ebr verifikim kur thirrin nj\u00eb sh\u00ebrbim tjet\u00ebr n\u00eb internet. P\u00ebr nj\u00eb nivel m\u00eb t\u00eb lart\u00eb sigurie, sh\u00ebrbimi q\u00eb th\u00ebrret mund t\u00eb p\u00ebrdor\u00eb nj\u00eb certifikat\u00eb (n\u00eb vend t\u00eb sekretit t\u00eb zakonsh\u00ebm) si akreditim.<\/p>\n<p>Specifikimi OAuth2 p\u00ebrshkruhet n\u00eb <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc6749\">RFC-6749<\/a><\/noindex> <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc8259\">RFC-8252<\/a><\/noindex> <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc6819\">RFC-6819<\/a><\/noindex><\/p>\n<h3>Token-i JWT dhe p\u00ebrfitimet e tij<\/h3>\n<p>\nJWT (JSON Web Token) \u00ebsht\u00eb nj\u00eb standard i hapur (<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc7519\">https:\/\/tools.ietf.org\/html\/rfc7519<\/a><\/noindex>), i cili p\u00ebrcakton nj\u00eb m\u00ebnyr\u00eb kompakte dhe autonome p\u00ebr transmetimin e sigurt t\u00eb informacionit midis pal\u00ebve n\u00eb form\u00ebn e nj\u00eb objekti JSON.<\/p>\n<p>Sipas standardit, token-i p\u00ebrb\u00ebhet nga tre pjes\u00eb n\u00eb format base-64, t\u00eb ndara me pika. Pjesa e par\u00eb quhet header, ku p\u00ebrmban tipin e token-it dhe emrin e algoritmit t\u00eb hash p\u00ebr marrjen e n\u00ebnshkrimit digjital. Pjesa e dyt\u00eb ruan informacionin kryesor (p\u00ebrdoruesi, atributet etj.). Pjesa e tret\u00eb \u2013 n\u00ebnshkrimi digjital.<\/p>\n<p>..<br \/>\nKurr\u00eb mos e ruani token-in n\u00eb databaz\u00ebn tuaj. Sepse nj\u00eb token i vlefsh\u00ebm \u00ebsht\u00eb ekuivalent me nj\u00eb fjal\u00ebkalim, ruajtja e token-it \u00ebsht\u00eb nj\u00ebsoj si t\u00eb ruani nj\u00eb fjal\u00ebkalim n\u00eb m\u00ebnyr\u00eb t\u00eb hapur.<br \/>\n<b>Access-token <\/b>\u2014 \u00ebsht\u00eb nj\u00eb token q\u00eb i jep akses pronarit t\u00eb tij n\u00eb burimet e mbrojtura t\u00eb serverit. Zakonisht, ai ka nj\u00eb koh\u00ebzgjatje t\u00eb shkurt\u00ebr dhe mund t\u00eb p\u00ebrmbaj\u00eb informacione shtes\u00eb, si adresa IP e pal\u00ebs q\u00eb po k\u00ebrkon k\u00ebt\u00eb token.<\/p>\n<p><b>Token rifreskimi <\/b>\u2014 \u00ebsht\u00eb nj\u00eb token q\u00eb i lejon klient\u00ebve t\u00eb k\u00ebrkojn\u00eb tokene t\u00eb reja t\u00eb aksesit pasi t\u00eb jet\u00eb e skaduar koha e tyre. K\u00ebto tokene zakonisht l\u00ebshohen p\u00ebr nj\u00eb periudh\u00eb t\u00eb gjat\u00eb.<\/p>\n<p>Pikat kryesore t\u00eb p\u00ebrfitimeve t\u00eb aplikimit n\u00eb arkitektur\u00ebn mikroserviz:<\/p>\n<ul>\n<li>Mund\u00ebsia p\u00ebr t\u00eb aksesuar aplikacione dhe sh\u00ebrbime t\u00eb ndryshme p\u00ebrmes nj\u00eb autentifikimi t\u00eb vet\u00ebm.<\/li>\n<li>N\u00eb munges\u00eb t\u00eb nj\u00eb s\u00ebr\u00eb atributesh t\u00eb nevojshme n\u00eb profilin e p\u00ebrdoruesve, \u00ebsht\u00eb e mundur t\u00eb pasurohet me t\u00eb dh\u00ebna q\u00eb mund t\u00eb shtohen n\u00eb ngarkes\u00ebn e dobishme, madje dhe automatizuar dhe \"n\u00eb flak\u00eb\".<\/li>\n<li>Nuk ka nevoj\u00eb t\u00eb ruhet informacioni rreth seancave aktive, aplikacioni server duhet vet\u00ebm t\u00eb kontrolloj\u00eb n\u00ebnshkrimin.<\/li>\n<li>Menaxhim m\u00eb fleksib\u00ebl t\u00eb aksesit p\u00ebrmes atributesh shtes\u00eb n\u00eb ngarkes\u00ebn e dobishme.<\/li>\n<li>P\u00ebrdorimi i n\u00ebnshkrimit t\u00eb tokenit p\u00ebr kok\u00ebn dhe ngarkes\u00ebn e dobishme rrit sigurin\u00eb e zgjidhjes n\u00eb t\u00ebr\u00ebsi.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Tokeni JWT \u2014 p\u00ebrb\u00ebrja<\/h3>\n<p>\n<b>Header-i<\/b> \u2014 me default, koka p\u00ebrmban vet\u00ebm llojin e tokenit dhe algoritmin q\u00eb p\u00ebrdoret p\u00ebr enkriptimin.<\/p>\n<p>Lloji i tokenit ruhet n\u00eb \u00e7el\u00ebsin \"typ\". \u00c7el\u00ebsi \"typ\" injorohet n\u00eb JWT. N\u00ebse \u00e7el\u00ebsi \"typ\" \u00ebsht\u00eb i pranish\u00ebm, vlera e tij duhet t\u00eb jet\u00eb JWT p\u00ebr t\u00eb treguar se ky objekt \u00ebsht\u00eb nj\u00eb JSON Web Token.<\/p>\n<p>\u00c7el\u00ebsi i dyt\u00eb \"alg\" p\u00ebrcakton algoritmin q\u00eb p\u00ebrdoret p\u00ebr enkriptimin e tokenit. Me default, ai duhet t\u00eb vendoset n\u00eb HS256. Koka kodifikohet n\u00eb base64.<\/p>\n<p>{ \"alg\": \"HS256\", \"typ\": \"JWT\"}<br \/>\n<b>Ngarkesa (p\u00ebrmbajtja)<\/b> \u2014 n\u00eb ngarkes\u00ebn e dobishme ruhet \u00e7do informacion q\u00eb duhet t\u00eb verifikohet. \u00c7do \u00e7el\u00ebs n\u00eb ngarkes\u00ebn e dobishme njihet si \"\u00e7\u00ebshtje\". P\u00ebr shembull, n\u00eb aplikacion mund t\u00eb hyni vet\u00ebm me ftes\u00eb (promovim i mbyllur). Kur duam t\u00eb ftojm\u00eb dik\u00eb t\u00eb marr\u00eb pjes\u00eb, i d\u00ebrgojm\u00eb atij nj\u00eb let\u00ebr ftes\u00eb. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb verifikohet se adresa e emailit i p\u00ebrket personit q\u00eb pranon ftes\u00ebn, prandaj do ta p\u00ebrfshijm\u00eb k\u00ebt\u00eb adres\u00eb n\u00eb ngarkes\u00ebn e dobishme, p\u00ebr k\u00ebt\u00eb do ta ruajm\u00eb n\u00eb \u00e7el\u00ebsin \"e-mail\".<\/p>\n<p>{ \"email\": \"example@x5.ru\" }<br \/>\n<br \/>\n\u00c7el\u00ebsat n\u00eb ngarkes\u00ebn e dobishme mund t\u00eb jen\u00eb t\u00eb rastit. Megjithat\u00eb, ka disa t\u00eb rezervuar:<\/p>\n<ul>\n<li>iss (Shk\u00ebput\u00ebsi) \u2014 p\u00ebrcakton aplikacionin nga i cili d\u00ebrgohet tokeni.<\/li>\n<li>sub (Subjekti) \u2014 p\u00ebrcakton tem\u00ebn e tokenit.<\/li>\n<li>aud (Audience) \u2013 nj\u00eb array i vargjeve t\u00eb ndjeshme ndaj regjistrit ose URI, q\u00eb p\u00ebrb\u00ebn nj\u00eb list\u00eb t\u00eb marr\u00ebsve t\u00eb k\u00ebtij tokeni. Kur pala marr\u00ebse merr JWT me k\u00ebt\u00eb \u00e7el\u00ebs, ajo duhet t\u00eb kontrolloj\u00eb pranin\u00eb e saj te marr\u00ebsit \u2014 nd otherwise ignore the token.<\/li>\n<li>exp (Koha e skadimit) \u2014 tregon kur skadon afati i vlefshm\u00ebris\u00eb s\u00eb tokenit. Standardi JWT k\u00ebrkon q\u00eb n\u00eb t\u00eb gjitha implementimet e tij, tokes me afat t\u00eb skaduar t\u00eb refuzohen. \u00c7el\u00ebsi Exp duhet t\u00eb jet\u00eb nj\u00eb sh\u00ebnim kohor n\u00eb formatin unix.<\/li>\n<li>nbf (Nuk p\u00ebrpara) \u2014 kjo \u00ebsht\u00eb koha n\u00eb formatin unix q\u00eb p\u00ebrcakton momentin kur tokeni do t\u00eb b\u00ebhet i vlefsh\u00ebm.<\/li>\n<li>iat (I l\u00ebshuar n\u00eb) \u2014 ky \u00e7el\u00ebs p\u00ebrfaq\u00ebson koh\u00ebn kur tokeni \u00ebsht\u00eb l\u00ebshuar dhe mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb p\u00ebrcaktuar mosh\u00ebn e JWT. \u00c7el\u00ebsi iat duhet t\u00eb jet\u00eb nj\u00eb sh\u00ebnim kohor n\u00eb formatin unix.<\/li>\n<li>Jti (ID e JWT) \u2014 nj\u00eb varg q\u00eb p\u00ebrcakton identifikuesin unik t\u00eb k\u00ebtij tokeni duke marr\u00eb parasysh regjistrin.<\/li>\n<\/ul>\n<p>\n\u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptohet se ngarkesa e dobishme nuk transmetohet n\u00eb form\u00eb t\u00eb enkriptuar (megjithat\u00eb, tokenet mund t\u00eb jen\u00eb t\u00eb ndara dhe at\u00ebher\u00eb \u00ebsht\u00eb e mundur t\u00eb transmetohen t\u00eb dh\u00ebna t\u00eb enkriptura). Prandaj, nuk mund t\u00eb ruani asnj\u00eb informacion sekret n\u00eb t\u00eb. Ashtu si titulli, ngarkesa e dobishme kodifikohet n\u00eb base64.<br \/>\n<b>N\u00ebnshkrimi<\/b> \u2014 kur kemi titullin dhe ngarkes\u00ebn, mund t\u00eb llogaritim n\u00ebnshkrimin.<\/p>\n<p>Marrim titullin dhe ngarkes\u00ebn t\u00eb kodifikuara n\u00eb base64, ato p\u00ebrzihen n\u00eb nj\u00eb varg p\u00ebrmes pik\u00ebs. M\u00eb pas ky varg dhe \u00e7el\u00ebsi sekret hyjn\u00eb n\u00eb algoritmin e enkriptimit t\u00eb specifikuar n\u00eb titull (\u00e7el\u00ebsi \u201calg\u201d). \u00c7el\u00ebsi mund t\u00eb jet\u00eb \u00e7far\u00ebdo vargu. K\u00ebto vargje m\u00eb t\u00eb gjata do t\u00eb jen\u00eb m\u00eb t\u00eb preferuara, pasi do t\u00eb nevojitet m\u00eb shum\u00eb koh\u00eb p\u00ebr t'u zbuluar.<\/p>\n<p>{\"alg\":\"RSA1_5\",\"payload\":\"A128CBC-HS256\"}<\/p>\n<h3>Nd\u00ebrtimi i arkitektur\u00ebs s\u00eb klasterit t\u00eb q\u00ebndruesh\u00ebm t\u00eb Keycloak<\/h3>\n<p>\nKur p\u00ebrdorim nj\u00eb klaster t\u00eb vet\u00ebm p\u00ebr t\u00eb gjith\u00eb projektet, k\u00ebrkesat p\u00ebr zgjidhjen e SSO rriten. Kur numri i projekteve nuk \u00ebsht\u00eb i madh, k\u00ebto k\u00ebrkesa nuk jan\u00eb aq t\u00eb ndjeshme p\u00ebr t\u00eb gjitha projektet, megjithat\u00eb me rritjen e numrit t\u00eb p\u00ebrdoruesve dhe integrimeve, k\u00ebrkesat p\u00ebr disponueshm\u00ebrin\u00eb dhe performanc\u00ebn rriten. <\/p>\n<p>Rritja e riskut t\u00eb d\u00ebshtimit t\u00eb SSO-s\u00eb s\u00eb vetme rrit k\u00ebrkesat ndaj arkitektur\u00ebs s\u00eb zgjidhjes dhe metodave t\u00eb p\u00ebrdorura p\u00ebr ruajtjen e komponent\u00ebve dhe \u00e7on n\u00eb nj\u00eb SLA shum\u00eb t\u00eb ashp\u00ebr. P\u00ebr k\u00ebt\u00eb arsye, shpesh n\u00eb zhvillimin ose n\u00eb fazat e hershme t\u00eb implementimit t\u00eb zgjidhjeve, projektet kan\u00eb infrastrukturen e tyre jo t\u00eb \u00e7rregullt. Me kalimin e koh\u00ebs, \u00ebsht\u00eb e nevojshme t\u00eb parashikohet mund\u00ebsia e zhvillimit dhe shkall\u00ebzimit. Nj\u00eb klaster i q\u00ebndruesh\u00ebm mund t\u00eb nd\u00ebrtohet m\u00eb fleksib\u00ebl duke p\u00ebrdorur virtualizimin e konteiner\u00ebve ose nj\u00eb qasje hibride. <\/p>\n<p>P\u00ebr t\u00eb punuar n\u00eb modalitetet Active\/Active dhe Active\/Passive, klasteri k\u00ebrkon t\u00eb siguroj\u00eb konsistenc\u00ebn e t\u00eb dh\u00ebnave n\u00eb nj\u00eb baz\u00eb t\u00eb dh\u00ebnash relazionale \u2014 t\u00eb dy node-t e baz\u00ebs s\u00eb t\u00eb dh\u00ebnave duhet t\u00eb replikohen sinhronisht midis Qendrave t\u00eb t\u00eb Dh\u00ebnave me shp\u00ebrndarje gjeografike.<\/p>\n<p>Shembulli m\u00eb i thjesht\u00eb i nj\u00eb instalimi t\u00eb q\u00ebndruesh\u00ebm.<\/p>\n<p><img decoding=\"async\" alt=\"SSO n\u00eb arkitektur\u00ebn mikroservisore. P\u00ebrdorim Keycloak. Pjesa \u21161\" src=\"\/wp-content\/uploads\/2020\/02\/c0df30a07e7dda5ae892a1fca3790a45.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCilat jan\u00eb avantazhet e p\u00ebrdorimit t\u00eb nj\u00eb klasteri t\u00eb vet\u00ebm:<\/p>\n<ul>\n<li>Disponueshm\u00ebri e lart\u00eb dhe performanc\u00eb.<\/li>\n<li>Mb\u00ebshtetje p\u00ebr modalitetet e pun\u00ebs: Active\/Active, Active\/Passive.<\/li>\n<li>Mund\u00ebsi p\u00ebr shkall\u00ebzim dinamik \u2014 kur p\u00ebrdoret virtualizimi i konteiner\u00ebve.<\/li>\n<li>Mund\u00ebsi p\u00ebr menaxhim dhe monitorim t\u00eb centralizuar.<\/li>\n<li>Qasje e vetme p\u00ebr identifikimin\/authentifikimin\/autorizimin e p\u00ebrdoruesve n\u00eb projekte.<\/li>\n<li>Nd\u00ebrveprimi m\u00eb i qart\u00eb midis projekteve t\u00eb ndryshme pa pjes\u00ebmarrjen e p\u00ebrdoruesve.<\/li>\n<li>Mund\u00ebsia e rip\u00ebrdorimit t\u00eb tokenit JWT n\u00eb projekte t\u00eb ndryshme.<\/li>\n<li>Pika e vetme e besueshm\u00ebris\u00eb.<\/li>\n<li>Start m\u00eb t\u00eb shpejt\u00eb t\u00eb projekteve duke p\u00ebrdorur mikrosh\u00ebrbimet\/virtualizimin e konteiner\u00ebve (nuk k\u00ebrkohet ngritja dhe konfigurimi i komponenteve shtes\u00eb).<\/li>\n<li>Mund\u00ebsia e blerjes s\u00eb mb\u00ebshtetjes komerciale nga shit\u00ebsi. <\/li>\n<\/ul>\n<p><\/p>\n<h3>\u00c7far\u00eb duhet t\u00eb merrni parasysh kur planifikoni klasterin<\/h3>\n<p><\/p>\n<h4>DBMS<\/h4>\n<p>\nKeycloak p\u00ebrdor nj\u00eb sistem menaxhimi DBMS p\u00ebr t\u00eb ruajtur: realms, clients, users etj.<br \/>\nMb\u00ebshtetet nj\u00eb gam\u00eb e gjer\u00eb DBMS: MS SQL, Oracle, MySQL, PostgreSQL. Keycloak vjen me nj\u00eb baz\u00eb t\u00eb dh\u00ebnash relazionale t\u00eb integruar. P\u00ebrdorimi rekomandohet p\u00ebr mjediset q\u00eb nuk ngarkohen \u2014 si\u00e7 jan\u00eb mjediset e zhvillimit.<\/p>\n<p>P\u00ebr t\u00eb punuar n\u00eb modalitetet Active\/Active dhe Active\/Passive, klasteri k\u00ebrkon t\u00eb siguroj\u00eb konsistenc\u00ebn e t\u00eb dh\u00ebnave n\u00eb nj\u00eb baz\u00eb t\u00eb dh\u00ebnash relazionale dhe t\u00eb dy node-t e klasterit t\u00eb baz\u00ebs s\u00eb t\u00eb dh\u00ebnave replikohen sinhronisht midis Qendrave t\u00eb t\u00eb Dh\u00ebnave.<\/p>\n<h4>Cache i shp\u00ebrndar\u00eb (Infinspan)<\/h4>\n<p>\nP\u00ebr funksionimin e duhur t\u00eb klasterit k\u00ebrkohet sinkronizimi shtes\u00eb i k\u00ebtyre llojeve t\u00eb caches duke p\u00ebrdorur JBoss Data Grid:<\/p>\n<p>Seancat e autentifikimit \u2014 p\u00ebrdoren p\u00ebr ruajtjen e t\u00eb dh\u00ebnave gjat\u00eb autentifikimit t\u00eb nj\u00eb p\u00ebrdoruesi t\u00eb caktuar. K\u00ebrkesat nga ky cache zakonisht p\u00ebrfshijn\u00eb vet\u00ebm shfletuesin dhe serverin Keycloak, jo aplikacionin.<\/p>\n<p>Tokenat e veprimit \u2014 p\u00ebrdoren p\u00ebr skenar\u00ebt kur p\u00ebrdoruesi duhet t\u00eb konfirmoj\u00eb nj\u00eb veprim asinkronisht (p\u00ebrmes emailit). P\u00ebr shembull, gjat\u00eb procesit t\u00eb rikuperimit t\u00eb fjal\u00ebkalimit, cache i actionTokens Infinispan p\u00ebrdoret p\u00ebr t\u00eb ndjekur metadata mbi tokenat e lidhur me veprimet q\u00eb tashm\u00eb jan\u00eb p\u00ebrdorur, prandaj nuk mund t\u00eb p\u00ebrdoren s\u00ebrish.<\/p>\n<p>Caching dhe invalidimi i t\u00eb dh\u00ebnave t\u00eb p\u00ebrhershme \u2013 p\u00ebrdoret p\u00ebr keshimin e t\u00eb dh\u00ebnave t\u00eb p\u00ebrhershme, p\u00ebr t\u00eb shmangur k\u00ebrkesat e panevojshme ndaj baz\u00ebs s\u00eb t\u00eb dh\u00ebnave. Kur ndonj\u00eb server Keycloak p\u00ebrdit\u00ebson t\u00eb dh\u00ebnat, t\u00eb gjith\u00eb server\u00ebt e tjer\u00eb Keycloak n\u00eb t\u00eb gjitha qendrat e t\u00eb dh\u00ebnave duhet t\u00eb din\u00eb p\u00ebr k\u00ebt\u00eb.<\/p>\n<p>Puna \u2014 p\u00ebrdoret vet\u00ebm p\u00ebr d\u00ebrgimin e mesazheve mbi pavlefshm\u00ebrin\u00eb mes nyjave t\u00eb klasterit dhe qendrave t\u00eb t\u00eb dh\u00ebnave. <\/p>\n<p>Seancat e p\u00ebrdoruesve \u2014 p\u00ebrdoren p\u00ebr ruajtjen e t\u00eb dh\u00ebnave mbi seancat e p\u00ebrdoruesve, q\u00eb jan\u00eb t\u00eb vlefshme gjat\u00eb seanc\u00ebs s\u00eb shfletuesit t\u00eb p\u00ebrdoruesit. Cache duhet t\u00eb p\u00ebrpunoj\u00eb k\u00ebrkesat HTTP nga p\u00ebrdoruesit p\u00ebrfundimtar\u00eb dhe aplikacioni. <\/p>\n<p>Mbrojtja nga forcat e k\u00ebqija \u2014 p\u00ebrdoret p\u00ebr t\u00eb ndjekur t\u00eb dh\u00ebnat mbi hyrjet e d\u00ebshtuara. <\/p>\n<h4>Balancimi i ngarkes\u00ebs<\/h4>\n<p>\nBalancuesi i ngarkes\u00ebs \u00ebsht\u00eb pika e vetme e hyrjes n\u00eb keycloak dhe duhet t\u00eb mbajn\u00eb seanca t\u00eb ngjitur. <\/p>\n<h4>Server\u00ebt e aplikacioneve<\/h4>\n<p>\nP\u00ebrdoren p\u00ebr t\u00eb kontrolluar nd\u00ebrveprimin e komponent\u00ebve me nj\u00ebri-tjetrin dhe mund t\u00eb jen\u00eb t\u00eb virtualizuar ose t\u00eb kontejnerizuar duke p\u00ebrdorur mjetet ekzistuese t\u00eb automatizimit dhe shkall\u00ebzimit dinamik t\u00eb infrastruktur\u00ebs. Skenar\u00ebt m\u00eb t\u00eb zakonsh\u00ebm t\u00eb implementimit n\u00eb OpenShift, Kubernates, Rancher.<\/p>\n<p>K\u00ebtu p\u00ebrfundon pjesa e par\u00eb \u2013 teorike. N\u00eb ciklet e ardhshme t\u00eb artikujve do t\u00eb shqyrtohen shembuj integrimesh me ofrues t\u00eb ndrysh\u00ebm identifikimi dhe shembuj t\u00eb konfigurimeve.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/X5RetailGroup\/blog\/486778\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0421 \u0442\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0431\u0435\u0441\u0448\u043e\u0432\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0438 \u0442\u043e\u0433\u0434\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Single-Sing-On (SSO). \u041d\u043e \u043a\u0430\u043a \u0431\u044b\u0442\u044c, \u043a\u043e\u0433\u0434\u0430 \u0442\u0430\u043a\u0438\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b \u043a\u0430\u043a AD \u0438\u043b\u0438 \u0438\u043d\u044b\u0435, \u043d\u0435 \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":40866,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-40865","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47SSO \u043d\u0430 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c Keycloak. \u0427\u0430\u0441\u0442\u044c \u21161 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-05T07:07:04+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-05T07:07:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSO n\u00eb arkitektur\u00ebn mikrosh\u00ebrbimore. P\u00ebrdorim Keycloak. Pjesa \u21161 | ProHoster","description":"N\u00eb \u00e7do kompani t\u00eb madhe, dhe X5 Retail Group nuk b\u00ebn p\u00ebrjashtim, me zhvillimin rritet numri i projekteve ku k\u00ebrkohet autorizimi i p\u00ebrdoruesve.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSO \u043d\u0430 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c Keycloak. \u0427\u0430\u0441\u0442\u044c \u21161 | ProHoster","og:description":"\u0412 \u043b\u044e\u0431\u043e\u0439 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0438 X5 Retail Group \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.","og:url":"https:\/\/prohoster.info\/sq\/blog\/sso-na-mikroservisnoj-arhitekture-ispolzuem-keycloak-chast-%e2%84%961","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T07:07:04+00:00","article:modified_time":"2020-02-05T07:07:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"40865","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:46:14","updated":"2022-09-27 14:28:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/40865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=40865"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/40865\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/40866"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=40865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=40865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=40865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}