The future of authentication - Codrin Chirica This lighting talk will show how Alfresco is addressing the issues that are at the moment regarding authentication on our platform and what are the plans for the future. Please be aware that this is subject to change even thought we try to follow the roadmap, sometimes priorities change.

1. The Future of
Authentication
Codrin Chirica
codrin.chirica@ness.com

2. Learn. Connect. Collaborate.
Agenda
• Authentication until now
• Authentication now
• Authentication in the future

3. Learn. Connect. Collaborate.
Authentication until now
PROBLEM:
• No common, coherent identity management among Alfresco products

4. Learn. Connect. Collaborate.
Authentication until now
• A challenge for customers to
configure
• ACS and APS need to be kept
in-sync with the central user
directory (e.g. LDAP sync)

5. Learn. Connect. Collaborate.
Authentication now
SOLUTION:
• Alfresco Identity Service (AIS)
– What is AIS ?
1

6. Learn. Connect. Collaborate.
Authentication now
• Identity Service leverages the open source identity and access management
project Keycloak
• https://www.keycloak.org/
• Alfresco theme for login

7. Learn. Connect. Collaborate.
Authentication now
• It provides proof of identity, in the form of a standard token (JWT),
understood by:
– ACS REST APIs (v1) and CMIS
– APS REST APIs
– AGS REST API (v1)
– ADF

8. Learn. Connect. Collaborate.
Authentication now
• How to deploy ?
– The deployment artifact is the alfresco-identity-service Helm Chart
https://github.com/Alfresco/charts/blob/master/stable/alfresco-identity-service-
1.0.0.tgz
– Deployed, by default, as part of the alfresco-infrastructure Helm Chart
https://github.com/Alfresco/charts/blob/master/stable/alfresco-infrastructure-3.0.0.tgz
– To deploy, simply run …
helm install alfresco-stable/alfresco-infrastructure --version 3.0.0

9. Learn. Connect. Collaborate.
Authentication now
• What gets
deployed ?
2

10. Learn. Connect. Collaborate.
Authentication now
• Standalone Distribution
– Download the Identity Service zip
– Unzip it and run the script:

11. Learn. Connect. Collaborate.
Authentication now
• Useful resources:
– Identity Service in GitHub
https://github.com/Alfresco/alfresco-identity-service
• Issues
– https://issues.alfresco.com/jira/projects/MNT/
• (component Alfresco Identity Service)
– https://issues.alfresco.com/jira/projects/AUTH/
• (component Alfresco Identity Service)

12. Learn. Connect. Collaborate.
Authentication in the future
• Roadmap for Alfresco Identity Service 2.0
– Digital Workspace
– Desktop Sync
– Google Docs
– Office Docs

13. Learn. Connect. Collaborate.
Authentication in the future
3
• Problem solved ?!

14. Learn. Connect. Collaborate.
Authentication in the future
• All authentication is done
through AIS
• ACS does not perform any OTHER
authentication

15. Learn. Connect. Collaborate.
Authentication in the future
• All requests sent to ACS must
carry a JWT in the header
• ACS validates the token

16. Learn. Connect. Collaborate.
Authentication in the future
• User queries public
API Gateway
• Group queries and
group membership will
be delegated to AIS

17. Learn. Connect. Collaborate.
Authentication in the future
• Custom authentication ?!
4

18. Learn. Connect. Collaborate.
Authentication in the future
• The Identity Service must accommodate user name changes

19. Learn. Connect. Collaborate.
Authentication in the future
• DEPRECATE:
– User profiles in ACS will be deprecated (but not removed)
– The authentication chain will be deprecated (but still maintained)

20. Learn. Connect. Collaborate.
Authentication in the future
• Conclusions:
– If you have a new project, don't start and write your own authentication
chain subsystem, go to Alfresco Identity Service

21. Learn. Connect. Collaborate.
Authentication in the future
• Conclusions:
– If you have an extension to the authentication chain, then you can use
it but be informed that this will go away at some point in the future.

22. The Future of
Authentication
Codrin Chirica
codrin.chirica@ness.com