Kunoma iyiphi inkampani enkulu, kanye ne-X5 Retail Group ayihlukile, njengoba intuthuko iqhubeka, inani lamaphrojekthi adinga ukugunyazwa komsebenzisi liyakhuphuka. Ngokuhamba kwesikhathi, uguquko olungenazihibe lwabasebenzisi ukusuka kolunye uhlelo baye kolunye kuyadingeka bese kuba nesidingo sokusebenzisa iseva eyodwa ye-Single-On (SSO). Kodwa yini okufanele uyenze lapho abahlinzeki bomazisi abanjengo-AD noma abanye abangenazo izimfanelo ezengeziwe sebevele besetshenziswa kumaphrojekthi ahlukahlukene. Ikilasi lamasistimu abizwa ngokuthi “ama-identity brokers” azosiza. Okusebenza kakhulu ngabameleli bayo, njenge-Keycloak, Ukuphathwa kwe-Gravitee Access, njll. Ngokuvamile, izimo zokusetshenziswa zingahluka: ukusebenzisana komshini, ukubamba iqhaza komsebenzisi, njll. Isixazululo kufanele sisekele ukusebenza okuguquguqukayo nokunyukayo okungahlanganisa zonke izidingo endaweni eyodwa, kanye nesixazululo esinjalo Inkampani yethu manje inomthengisi oyinkomba - Keycloak.
I-Keycloak ingumthombo ovulekile wobunikazi kanye nomkhiqizo wokulawula ukufinyelela ogcinwe yi-RedHat. Kuyisisekelo semikhiqizo yenkampani esebenzisa i-SSO - RH-SSO.
Imiqondo eyisisekelo
Ngaphambi kokuba uqale ukubhekana nezixazululo nezindlela, kufanele unqume ngokwemibandela nokulandelana kwezinqubo:
Ukuhlonza kuyinqubo yokuqaphela isihloko ngesihlonzi sakhe (ngamanye amazwi, lena incazelo yegama, ukungena ngemvume noma inombolo).
Ukufakazela ubuqiniso - lena inqubo yokuqinisekisa (umsebenzisi uqinisekiswa kusetshenziswa iphasiwedi, incwadi iqinisekiswa kusetshenziswa isiginesha ye-elekthronikhi, njll.)
Ngena - lokhu ukuhlinzekwa kokufinyelela esisetshenziswa (isibonelo, ukuthumela i-imeyili).
I-Identity Broker Keycloak
isigqoko sikakhiye iwubunikazi bomthombo ovulekile nesixazululo sokuphatha ukufinyelela esidizayinelwe ukusetshenziswa e-IS lapho amaphethini ezakhiwo ze-microservice angasetshenziswa.
I-Keycloak inikezela ngezici ezifana ne-Single Sign-On (SSO), I-Brokered Identity and Social Login, Inhlangano Yabasebenzisi, Ama-adaptha Eklayenti, Ikhonsoli Yokuphatha, kanye Nekhonsoli Yokuphathwa Kwe-akhawunti.
Ukusebenza okuyisisekelo okusekelwa yi-Keycloak:
- Ngena ngemvume kanye kanye futhi uphume kanye ukuze uthole izinhlelo zokusebenza zesiphequluli.
- Usekelo lwe-OpenID/OAuth 2.0/SAML.
- I-Identity Brokering - ukufakazela ubuqiniso kusetshenziswa i-OpenID Connect yangaphandle noma abahlinzeki bomazisi be-SAML.
- Ukungena Komphakathi - Google, GitHub, Facebook, Twitter ukwesekwa kokuhlonza umsebenzisi.
- I-User Federation - ukuvumelanisa abasebenzisi abavela ku-LDAP kanye namaseva e-Active Directory nabanye abahlinzeki bomazisi.
- Ibhuloho le-Kerberos – ukusetshenziswa kweseva ye-Kerberos ukuze kuqinisekiswe umsebenzisi okuzenzakalelayo.
- Ikhonsoli Yomlawuli - yokuphatha okuhlangene kwezilungiselelo nezinketho zesixazululo ngewebhu.
- I-Akhawunti Yokuphathwa Kwekhonsoli - ukuze uzilawulele iphrofayela yomsebenzisi.
- Ukwenza ngokwezifiso isixazululo ngokusekelwe kubunikazi benkampani yenkampani.
- Ukuqinisekiswa kwe-2FA - ukwesekwa kwe-TOTP/HOTP kusetshenziswa i-Google Authenticator noma i-FreeOTP.
- Ukungena Ngemvume - ukuzibhalisa komsebenzisi, ukutholwa kwephasiwedi nokusetha kabusha, nokunye kungenzeka.
- Ukuphathwa Kweseshini - abalawuli bangaphatha izikhathi zabasebenzisi besuka endaweni eyodwa.
- I-Token Mappers - izici zomsebenzisi ezibophayo, izindima nezinye izici ezidingekayo kumathokheni.
- Ukuphathwa kwenqubomgomo okuguquguqukayo ngokusebenzisa indawo, uhlelo lokusebenza nabasebenzisi.
- Usekelo lwe-CORS - Ama-adaptha eklayenti anosekelo olwakhelwe ngaphakathi lwe-CORS.
- I-Service Provider Interfaces (SPI) – inamba enkulu yama-SPI akuvumela ukuthi ulungiselele izici ezihlukahlukene zeseva: ukugeleza kokuqinisekisa, abahlinzeki bobunikazi, imephu yephrothokholi nokunye okuningi.
- Ama-adaptha eklayenti ezinhlelo zokusebenza ze-JavaScript, i-WildFly, i-JBoss EAP, i-Fuse, i-Tomcat, i-Jetty, i-Spring.
- Usekelo lokusebenza ngezinhlelo zokusebenza ezahlukahlukene ezisekela ilabhulali ye-OpenID Connect Relying Party noma i-SAML 2.0 Service Provider Library.
- Anwebeka kusetshenziswa ama-plugin.
Ngezinqubo ze-CI/CD, kanye nokuzenzakalelayo kwezinqubo zokuphatha ku-Keycloak, i-REST API/JAVA API ingasetshenziswa. Amadokhumenti atholakala ngekhompyutha:
I-REST API
I-Java API
Abahlinzeki be-Enterprise Identity (Oku-Premise)
Amathuba okuqinisekiswa komsebenzisi ngezinsizakalo ze-User Federation.
Ukufakazela ubuqiniso kokudlula nakho kungasetshenziswa - uma abasebenzisi begunyazwe ezindaweni zokusebenza nge-Kerberos (LDAP noma AD), lapho-ke bangagunyazwa ngokuzenzakalelayo ku-Keycloak ngaphandle kokuthi banikeze igama labo lomsebenzisi nephasiwedi futhi.
Ukuze kuqinisekiswe nokugunyazwa okwengeziwe kwabasebenzisi, kungenzeka ukusebenzisa i-DBMS ehlobene, esebenza kakhulu ezindaweni zokuthuthukiswa, njengoba ingabandakanyi izilungiselelo ezinde nokuhlanganiswa ezigabeni zokuqala zamaphrojekthi. Ngokuzenzakalelayo, i-Keycloak isebenzisa i-DBMS eyakhelwe ngaphakathi ukuze igcine izilungiselelo nedatha yomsebenzisi.
Uhlu lwama-DBMS asekelwayo lubanzi futhi luhlanganisa: I-MS SQL, i-Oracle, i-PostgreSQL, i-MariaDB, i-Oracle nezinye. Okuhlolwe kakhulu kuze kube manje i-Oracle 12C Release1 RAC kanye neqoqo le-Galera 3.12 le-MariaDB 10.1.19.
Abahlinzeki bomazisi - ukungena ngemvume komphakathi
Kungenzeka ukusebenzisa ukungena ngemvume kusuka kumanethiwekhi omphakathi. Ukuze wenze kusebenze ikhono lokuqinisekisa abasebenzisi, sebenzisa ikhonsoli yokulawula ye-Keyclock. Izinguquko kukhodi yesicelo azidingeki futhi lokhu kusebenza kuyatholakala ngaphandle kwebhokisi futhi kungenziwa kusebenze kunoma yisiphi isigaba sephrojekthi.
Kungenzeka ukusebenzisa abahlinzeki be-OpenID/SAML Identity ukuze uqinisekise umsebenzisi.
Izimo zokugunyazwa ezijwayelekile zisebenzisa i-OAuth2 ku-Keycloak
Ukuhamba Kwekhodi Yokugunyaza - esetshenziswa nezinhlelo zokusebenza eziseceleni kweseva. Enye yezinhlobo ezivame kakhulu zemvume yokugunyazwa ngoba ifaneleka kahle kuzinhlelo zokusebenza zeseva lapho ikhodi yomthombo yohlelo lokusebenza nedatha yeklayenti ingatholakali kubantu bangaphandle. Inqubo kuleli cala isekelwe ekuqondisweni kabusha. Uhlelo lokusebenza kumele lukwazi ukuxhumana ne-ejenti yomsebenzisi (i-ejenti yomsebenzisi), njengesiphequluli sewebhu - ukuthola amakhodi okugunyazwa kwe-API aqondiswe kabusha nge-ejenti yomsebenzisi.
Ukugeleza Okungaqondile - esetshenziswa izinhlelo zokusebenza zeselula noma zewebhu (izinhlelo zokusebenza ezisebenza kudivayisi yomsebenzisi).
Uhlobo lwemvume yokugunyazwa engacacile lusetshenziswa izinhlelo zokusebenza zeselula newebhu lapho ukugcinwa kuyimfihlo kweklayenti kungenakuqinisekiswa. Uhlobo lwemvume engacacile luphinde lusebenzise ukuqondisa kabusha kwe-ejenti yomsebenzisi, lapho ithokheni yokufinyelela idluliselwa kumenzeli womsebenzisi ukuze isetshenziswe ngokwengeziwe kuhlelo lokusebenza. Lokhu kwenza ithokheni itholakale kumsebenzisi nezinye izinhlelo zokusebenza kudivayisi yomsebenzisi. Lolu hlobo lwemvume yokugunyazwa aluqinisekisi ubunikazi besicelo, futhi inqubo ngokwayo incike ku-URL yokuqondisa kabusha (eyayibhaliswe ngaphambilini nesevisi).
Ukugeleza Okungaqondile akusekeli amathokheni okuvuselela amathokheni.
Ukugeleza Kokunikezwa Kwemininingwane Yeklayenti - zisetshenziswa lapho uhlelo lokusebenza lufinyelela i-API. Lolu hlobo lwemvume yokugunyazwa luvamise ukusetshenziselwa ukusebenzisana kweseva neseva okufanele kwenziwe ngemuva ngaphandle kokusebenzisana ngokushesha komsebenzisi. Ukugeleza komnikelo wokuqinisekisa weklayenti kuvumela isevisi yewebhu (iklayenti eliyimfihlo) ukuthi lisebenzise imininingwane yalo esikhundleni sokuzenza umsebenzisi ukuze liqinisekise lapho lishayela enye isevisi yewebhu. Ngezinga eliphezulu lokuvikeleka, kungenzeka ukuthi isevisi yokushaya ucingo isebenzise isitifiketi (esikhundleni semfihlo eyabiwe) njengesiqinisekiso.
Ukucaciswa kwe-OAuth2 kuchazwe ku
Ithokheni ye-JWT nezinzuzo zayo
I-JWT (JSON Web Token) iyindinganiso evuliwe () echaza indlela ehlangene neziqukethwe ngokwayo yokudlulisa ngokuphephile ulwazi phakathi kwezinhlangothi njengento ye-JSON.
Ngokwendinganiso, ithokheni liqukethe izingxenye ezintathu ngefomethi ye-base-64, ehlukaniswe ngamachashazi. Ingxenye yokuqala ibizwa ngokuthi unhlokweni, oqukethe uhlobo lwethokheni kanye negama le-algorithm ye-hashi yokuthola isiginesha yedijithali. Ingxenye yesibili igcina ulwazi oluyisisekelo (umsebenzisi, izimfanelo, njll.). Ingxenye yesithathu isignesha yedijithali.
. .
Ungalokothi ugcine ithokheni ku-DB yakho. Ngenxa yokuthi ithokheni evumelekile ilingana nephasiwedi, ukugcina ithokheni kufana nokugcina iphasiwedi embhalweni ocacile.
Ithokheni yokufinyelela kuwuphawu olunikeza umnikazi walo ukufinyelela kuzinsiza zeseva ezivikelwe. Ngokuvamile inesikhathi esifushane sokuphila futhi ingase iphathe ulwazi olwengeziwe, njengekheli le-IP leqembu elicela ithokheni.
Vuselela ithokheni kuwuphawu oluvumela amaklayenti ukuthi acele amathokheni okufinyelela amasha ngemva kokuphelelwa yisikhathi sokuphila kwawo. Lawa mathokheni ngokuvamile akhishwa isikhathi eside.
Izinzuzo eziyinhloko zokusebenzisa i-microservice architecture:
- Ikhono lokufinyelela izinhlelo zokusebenza nezinsizakalo ezahlukahlukene ngokufakazela ubuqiniso besikhathi esisodwa.
- Uma kungekho inani lezibaluli ezidingekayo kuphrofayela yomsebenzisi, kungenzeka ukucebisa ngedatha engangezwa ekulayishweni okukhokhelwayo, okuhlanganisa okuzenzakalelayo kanye nokuhamba ngezinyawo.
- Asikho isidingo sokugcina ulwazi mayelana namaseshini asebenzayo, uhlelo lokusebenza lweseva ludinga kuphela ukuqinisekisa isiginesha.
- Ukulawulwa kokufinyelela okuguquguqukayo okwengeziwe ngezibaluli ezengeziwe kumthwalo okhokhelwayo.
- Ukusetshenziswa kwesiginesha yethokheni yesihloko kanye nomthwalo wokukhokha kwandisa ukuphepha kwesixazululo sisonke.
Ithokheni ye-JWT - ukwakheka
unhlokweni — ngokuzenzakalelayo, unhlokweni uqukethe kuphela uhlobo lwethokheni kanye ne-algorithm esetshenziselwa ukubethela.
Uhlobo lwethokheni lugcinwa kukhiye othi "thayipha". Ukhiye 'wohlobo' awunakwa ku-JWT. Uma ukhiye othi "thayipha" ukhona, inani lawo kufanele libe yi-JWT ukuze kuboniswe ukuthi le nto iyithokheni yewebhu ye-JSON.
Ukhiye wesibili "alg" uchaza i-algorithm esetshenziswa ukubethela ithokheni. Kufanele isethwe ku-HS256 ngokuzenzakalela. Unhlokweni ufakwe ikhodi ku-base64.
{ "alg": "HS256", "type": "JWT"}
umthwalo wokukhokha (okuqukethwe) - umthwalo okhokhelwayo ugcina noma yiluphi ulwazi oludinga ukubhekwa. Ukhiye ngamunye ekulayisheni waziwa ngokuthi "isimangalo". Isibonelo, ungafaka isicelo kuphela ngesimemo (iphromo evaliwe). Uma sifuna ukumema othile ukuba ahlanganyele, simthumelela incwadi yesimemo. Kubalulekile ukuhlola ukuthi ikheli le-imeyili elomuntu owamukela isimemo, ngakho-ke sizofaka leli kheli emalini ekhokhelwayo, ngalokho siligcina kukhiye "we-imeyili".
{"i-imeyili": "[i-imeyili ivikelwe]"}
Okhiye ekulayishweni kweholo bangaba ngokungafanele. Nokho, kukhona ezimbalwa ezigodliwe:
- iss (Umkhiphi) - unquma isicelo lapho ithokheni ithunyelwa khona.
- sub (Isihloko) - ichaza isihloko sethokheni.
- i-aud (Izethameli) iwuchungechunge lweyunithi yezinhlamvu ezizwela kakhulu icala noma ama-URI awuhlu lwabamukeli baleli thokheni. Lapho uhlangothi olutholayo luthola i-JWT ngokhiye onikeziwe, kufanele luhlole ukuba khona kwalo kubamukeli - ngaphandle kwalokho lizibe ithokheni.
- exp (Isikhathi Sokuphelelwa yisikhathi) - Ibonisa ukuthi ithokheni iphelelwa yisikhathi nini. Izinga le-JWT lidinga ukuthi konke ukusetshenziswa kwalo kwenqabe amathokheni aphelelwe yisikhathi. Ukhiye we-exp kufanele ube isitembu sesikhathi ngefomethi ye-unix.
- I-nbf (Hhayi Ngaphambili) isikhathi esikufomethi ye-unix esinquma isikhathi lapho ithokheni lisebenza khona.
- iat (Ikhishwe Ngo) - Lo khiye umelela isikhathi ithokheni eyakhishwa ngaso futhi ungasetshenziswa ukunquma iminyaka ye-JWT. Ukhiye we-iat kumelwe ube isitembu sesikhathi ngefomethi ye-unix.
- I-Jti (ID ye-JWT) — iyunithi yezinhlamvu echaza isihlonzi esiyingqayizivele sale tokheni, esizwela kakhulu kumacala.
Kubalulekile ukuqonda ukuthi umthwalo okhokhelwayo awudluliswanga ngokubethela (yize amathokheni angafakwa esidlekeni bese kuba nokwenzeka ukudlulisa idatha ebethelwe). Ngakho-ke, awukwazi ukugcina noma yiluphi ulwazi oluyimfihlo kuyo. Njengonhlokweni, umthwalo okhokhelwayo u-base64 ubhalwe ngekhodi.
Isignesha - uma sesinekhanda kanye nomthwalo okhokhelwayo, singabala isiginesha.
Unhlokweni nomthwalo okhokhelwayo okubhalwe ku-base64 kuyathathwa futhi kuhlanganiswe kube umugqa ohlukaniswe ichashazi. Lolu chungechunge nokhiye oyimfihlo bese kufakwa ku-algorithm yokubethela ecaciswe kunhlokweni (ukhiye “alg”). Ukhiye kungaba yinoma iyiphi iyunithi yezinhlamvu. Izintambo ezinde zizokhethwa kakhulu njengoba zizodinga isikhathi esengeziwe sokuzikhetha.
{"alg":"RSA1_5","inkokhelo":"A128CBC-HS256"}
Ukwakha i-Keycloak Failover Cluster Architecture
Uma usebenzisa iqoqo elilodwa kuwo wonke amaphrojekthi, kunezidingo ezengeziwe zesixazululo se-SSO. Uma inani lamaphrojekthi lilincane, lezi zidingo azibonakali kangako kuwo wonke amaphrojekthi, nokho, ngokwenyuka kwenani labasebenzisi nokuhlanganiswa, izidingo zokutholakala nokusebenza ziyakhula.
Ukwandisa ubungozi bokuhluleka kwe-SSO eyodwa kukhulisa izimfuneko zesakhiwo sesixazululo kanye nezindlela ezisetshenziselwa izingxenye ezingasasebenzi futhi kuholela ku-SLA eqinile kakhulu. Mayelana nalokhu, kaningi ngesikhathi sokuthuthukiswa noma ezigabeni zokuqala zokuqalisa izixazululo, amaphrojekthi anengqalasizinda yawo engabekezeleli amaphutha. Njengoba intuthuko iqhubeka, kuyadingeka ukuthi kubekwe phansi amathuba okuthuthukiswa nokukhuliswa. Kuvumelana nezimo kakhulu ukwakha iqoqo le-failover usebenzisa i-containerization ye-container noma indlela ye-hybrid.
Ukuze usebenze kumamodi eqoqo Asebenzayo/Asebenzayo kanye Nama-Isebenzayo/Yenziwayo, kuyadingeka ukuthi uqinisekise ukuvumelana kwedatha kusizindalwazi esihlobene - womabili ama-node esizindalwazi kufanele aphindaphindwe ngokuhambisanayo phakathi kwezikhungo zedatha ezihlukene ezisabalaliswa yi-geo.
Isibonelo esilula kakhulu sokufakwa okubekezelela iphutha.
Yiziphi izinzuzo zokusebenzisa iqoqo elilodwa:
- Ukutholakala okuphezulu nokusebenza.
- Ukusekelwa kwamamodi okusebenza: Iyasebenza / Iyasebenza, Iyasebenza / I-Passive.
- Amathuba okukalwa okuguquguqukayo - uma usebenzisa i-virtualization yesiqukathi.
- Amathuba okuphatha nokuqapha endaweni eyodwa.
- Indlela Ehlanganisiwe yokuhlonza/ukuqinisekisa/ukugunyazwa kwabasebenzisi kumaphrojekthi.
- Ukusebenzisana okusobala phakathi kwamaphrojekthi ahlukene ngaphandle kokuzibandakanya komsebenzisi.
- Amathuba okusebenzisa kabusha ithokheni ye-JWT kumaphrojekthi ahlukahlukene.
- Iphuzu elilodwa lokuthembela.
- Ukwethulwa ngokushesha kwamaphrojekthi kusetshenziswa ama-microservices/containization virtualization (asikho isidingo sokufaka nokumisa izingxenye ezengeziwe).
- Kungenzeka ukuthenga ukwesekwa kwezohwebo kumthengisi.
Yini okufanele icatshangelwe lapho uhlela iqoqo
I-DBMS
I-Keycloak isebenzisa uhlelo lokuphatha isizindalwazi ukugcina: izindawo, amaklayenti, abasebenzisi, njll.
Ibanga elibanzi le-DBMS liyasekelwa: MS SQL, Oracle, MySQL, PostgreSQL. I-Keycloak iza nesizindalwazi sayo sobudlelwano esakhelwe ngaphakathi. Kunconywa ukuthi kusetshenziselwe izindawo ezingalayishiwe - njengendawo yokuthuthukiswa.
Ukuze usebenze kumamodi eqoqo Asebenzayo/Osebenzayo kanye Nesebenzayo/Yenziwayo, kuyadingeka ukuqinisekisa ukufana kwedatha kusizindalwazi esihlobene futhi womabili ama-node eqoqo lesizindalwazi aphindaphindwa ngokulinganayo phakathi kwezikhungo zedatha.
Inqolobane esabalalisiwe (Infinspan)
Ukuze iqoqo lisebenze kahle, ukuvumelanisa okwengeziwe kwezinhlobo zenqolobane elandelayo kusetshenziswa i-JBoss Data Grid kuyadingeka:
Izikhathi zokufakazela ubuqiniso - ezisetshenziselwa ukulondoloza idatha lapho kuqinisekiswa umsebenzisi othile. Izicelo ezisuka kule nqolobane ngokuvamile zibandakanya isiphequluli kuphela neseva ye-Keycloak, hhayi uhlelo lokusebenza.
Amathokheni esenzo - asetshenziselwa izimo lapho umsebenzisi edinga ukuqinisekisa isenzo ngokuvumelanayo (nge-imeyili). Isibonelo, phakathi nokugeleza kwephasiwedi yokukhohlwa, inqolobane ye-Infinispan actionTokens isetshenziselwa ukulandelela imethadatha mayelana namathokheni esenzo ahlotshaniswayo asesetshenzisiwe kakade, ngakho ngeke aphinde asetshenziswe.
Ukugcinwa kunqolobane nokungasebenzi kwedatha eqhubekayo - esetshenziselwa ukugcina idatha eqhubekayo ukugwema imibuzo engadingekile kusizindalwazi. Uma noma iyiphi iseva ye-Keycloak ibuyekeza idatha, zonke ezinye iziphakeli ze-Keycloak kuzo zonke izikhungo zedatha zidinga ukwazi ngakho.
Umsebenzi - Kusetshenziswa kuphela ukuthumela imilayezo engavumelekile phakathi kwamanodi eqoqo nezikhungo zedatha.
Izikhathi zomsebenzisi - ezisetshenziselwa ukugcina idatha mayelana nezikhathi zomsebenzisi ezivumeleke ngesikhathi seseshini yesiphequluli somsebenzisi. Inqolobane kufanele icubungule izicelo ze-HTTP ezivela kumsebenzisi wokugcina kanye nohlelo lokusebenza.
I-Brute force Protection - isetshenziselwa ukulandelela idatha mayelana nokungena okuhlulekile.
Ukulayisha ukulinganisa
Isilinganisi somthwalo siyindawo eyodwa yokungena kukhiye wokhiye futhi kufanele sisekele izikhathi ezinamathelayo.
Amaseva ohlelo lokusebenza
Asetshenziselwa ukulawula ukusebenzisana kwezingxenye zodwa futhi angenziwa nge-virtual noma afakwe esitsheni kusetshenziswa amathuluzi e-automation akhona kanye nokukala okuguquguqukayo kwamathuluzi e-automation wengqalasizinda. Izimo ezivame kakhulu zokuthunyelwa ku-OpenShift, Kubernates, Rancher.
Lokhu kuqeda ingxenye yokuqala - ethiyori. Ochungechungeni lwezihloko ezilandelayo, izibonelo zokuhlanganiswa nabahlinzeki abahlukahlukene bokuhlonza nezibonelo zezilungiselelo kuzoxoxwa ngazo.
Source: www.habr.com