Repository navigation
Replies: 4 comments 4 replies
|
Is there a gateway in your microservice backend? |
|
Yes, there is a java gateway. But we plan to replace it in future, because we think a nginx gateway should be more performant. |
|
Request to the Keycloak to get the public JWS info.
|
|
HI @Tockra
Based on your initial question, you could add the KC roles into the JWT and then the API Gateway or API will validate the token and extract the claim "roles" for applying the access control rules. There is a limit in the HTTP Header size, so, try not to put too much information inside the JWT. |
|
About 2. I have two question:
If I understand you correct, there will be never a check against keycloak and only be client site validation. Or when is it not recommended to do it locally. |
|
My answers below:
Yes, because the token is a JWT and the approach that you are following is protecting an API with OAuth2.
Each approach has its pros and cons, life is hard 😄. This is why is critical to know in advance how critical the app / api is in order to define which is the best approach to follow. |
|
Okay, thank you for your answeres. But won't be there a bottle neck in the whole cluster (in PEP), if there will be (often) be a request to the keycloak instance to get all roles and build them into a jwt token ? |
|
As I was saying at the beginning, it's impossible to answer those questions in advance without having requirements, number of identities, roles, integrated apps, architecture design, performance tests, etc. You have differents approach in the authz architecture scenario, each one has their pro and cons. My recommendation is there is no fixed path to follow, you can adapt the API protection guidelines based on your requirements. Nevertheless, I recommend you to follow the standards like OAuth 2.0, UMA, etc. |
Uh oh!
There was an error while loading. Please reload this page.
Hi,
I'm looking for a tutorial / guide, which explains how to use keycloak in a microservice architecture with oauth2 (frontend single page application + microservice backend).
I'm pretty sure that there is a possibility to validate an token and get the Roles from the token without talking to keycloak.
The question is, if this is recommended. Or should every microservice get an keycloak-client with credential and check the roles through an request to keycloak?
Further how/when/where should the whole system check the valid state of the users token?
I looked for documentation about this topic, but I didn't found something helpful :(
T
All reactions