Re: [keycloak-dev] Interesting example for trusted service to service communication with JWT
Only watched a bit of it, but it seems like a headache to maintain. As it's
completely decentralized how do you manage what service can access what
service. Imagine if you know one service that can access 100 other services
is compromised and you then have to remove it's public keys everywhere.
Having a centralized solution like Keycloak is much better. You have a
centralized point of controlling what services can access what services.
You have a single place where you need to protect the private key. You can
much more easily remove access to a compromised service.
On 24 August 2016 at 09:57, Thomas Darimont <thomas.darimont(a)googlemail.com>
wrote:
Hello,
just stumbled upon an (IMHO) interesting example for trusted service to
service
communication with JWT.
Microservices with Spring Boot and Java JSON Web Tokens (JJWT)
https://www.youtube.com/watch?v=saiwZzE5IYg
They use the JJWT (https://github.com/jwtk/jjwt) library and and
demonstrate how to use
the kid (Key ID) claim of JWT.
In order to establish trust between two services, public keys are
exchanged to verify
each others JWT token signatures.
So instead of using a shared public key (e.g. Realm public key in
Keycloak) they have a public key per service.
I wonder how this would look like with Keycloak.
Cheers,
Thomas
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
Attachments:
- attachment.html (text/html — 2.3 KB)