Security is a complex part of software development. And usually implementing it in our applications we met with these simple but tricky challenges: build secure and user-friendly registration and authentication flow, protect data, prevent unauthorized access. All of this cost a lot of development effort. But why we need to start developing it each time from scratch? You can assign this task to identity and access management solutions. Join this talk, to find out, how to less than in hour get production ready authentication flow, login and registration forms, Single-Sign-On and separate storage for user data. Learn about the box solutions we have nowadays. Real cases of usage, cons and pros of this approach.

1. The lazy programmer`s
way to secure application
Lev Maltsev
JEEConf 2019

2. • 8+ years in software development
• Companies:
Credit Europe Bank NL
EPAM
• Technologies:
Java, SQL, Spring, JPA, JMS, JS
L E V M A LT S E V
2
LEAD DEVELOPER, EPAM

3. AGENDA
W H Y W E A R E H E R E ?
A R C H I T E C T U R E O V E R V I E W
D E M O
B O X S O L U T I O N S
S U M M A R Y
Q A & L I N K S
3

4. WHAT PROBLEM WE WANT TO SOLVE?
4

5. Identity management, also known as identity and access
management (IAM) is a discipline that "enables the right
individuals to access the right resources at the right times and for
the right reasons"
5

6. End user motivations
• Let me in
• Recognize me
• Protect my data
6

7. Business goals
• Security: Authentication & authorization mechanism,
TFA, Federation
• Cloud & microservices friendly
• Profile data reporting
• Easy integration of new clients, SSO, Social login
• General Data Protection Regulation adapted
• Fast time-to-market
7

8. Project overview
8

9. SOLUTION
9

10. Hight Level Solution Diagram
10
Website
Mobile app
Partner website
User
SSO
IDP
openrestricted
Access
Management
Multi-factor
authentication
Customer
storage
Service
secured
External
Services
Identity
Management
Console

11. Keycloak
11
• Centralized User
management
• Flexible Authentication &
Authorization
• Single Sign-on &
Social login
• Open source
https://www.keycloak.org/index.html

12. Single Sign On
12
SSO is an umbrella term for any time a user can login to multiple applications while only authenticating once.
• One credentials per multiply services
• Shared user identity across different
resources
• Centralized set of access privileges

13. Federated identity. Protocols
13
Federated identity is the means of linking a
person's electronic identity and attributes,
stored across multiple distinct identity
management systems.
Protocols:
SAML 2.0
Xml
More mature
More complex
Open ID Connect / OAuth 2
Json
Simple
Bearer token

14. JSON Web Tokens JWT
14
A JSON Web Token (JWT) is a JSON object that is defined in RFC 7519 as a safe way to represent a set of information
between two parties. The token is composed of a header, a payload, and a signature.

15. DEMO
15

16. SAAS SOLUTIONS
16

17. Key Features
• Hosted on vendor side
• Support
• Administration console
• UI builder for Auth related elements on your web pages/apps
• Reporting functionality
• Consent management
• REST API
• Various SDK
• Social networks integration

18. SUMMARY
18

19. Tasty things
• Significantly reduce of development effort
• Security outsourcing
• Unify security approach
• OOTB features
19

20. Before you dive in this
• Costs
• Hard to integrate with legacy systems
• Customizable, but some extras are not possible at all
• Sometimes works not as expected
• Hard to move from one solution to another
20

21. Q&A

22. Thank you and good luck
• https://en.wikipedia.org/wiki/Identity_management
• https://www.keycloak.org/
• Customer IAM Whiteboard: https://www.youtube.com/watch?v=ora2c5TlKOY
• https://www.pingidentity.com/en/company/blog/2017/08/22/part_2_the_value_that_only_ciam_can_deliver.html
• https://www.janrain.com/resources/industry-research/forrester-wavetm-customer-identity-and-access-management-q2-2017
• https://manage.auth0.com/#/applications/EFS5r4jqiOuD4GjeIYw07092AbvNuHUj/quickstart
• https://jwt.io/