7:14 p.m.
I've also posted this question on stackoverflow. So if you want to you can
answer there so it'll be easier to find for anyone looking. Here it is:
https://stackoverflow.com/questions/55634962/keycloak-support-for-one-rea...
I'm building an ecosystem of applications on kubernetes with keycloak as
authentication/authorization provider. I am(or probably was) planning for
everything to be integrated with it via OpenId(OAuth2) and for user
credentials and other private information never to leave the keycloak
instance in an unencrypted form.
I was trying to implement the whole authentication scheme with the
following configurations in mind.
Realms
myservice: Realm containing the public and back-office users of my application.
All microservices that I have are authenticating users
against this realm.
master: Contains admins, keycloak administrators and other resources which
should not be ever exposed to the public or intranet users.
No microservice
ever performs authentication on this realm.
Domains
1. domain: account.myservice.com
access: public
cors: allow requests from app.myservice.com
config: kubernetes-ingress
exposes: configured themes to support login, registration, etc.. Endpoints
for public front-end application token validation
description: Only exposes access to a realm called "myservice" in keycloak.
No users from other realms can login or interact.
2. domain: account.internal.myservice.com
access: intranet/admins
cors: allow requests from back-office.internal.myservice.com
config: kubernetes-ingress
exposes: configured themes to support login, registration, etc.. Endpoints
for back-end front-end application token validation
description: Exposes all the realms and provides access to keycloak
administrative UI.
3. domain: keycloak (keycloak.default.svc.cluster.local)
access: cluster-internal
cors: none
config: kubernetes service, visible only inside the cluster
exposes: endpoints for back-end application token validation
description: Only exposes realm "myservice" and is used for other
services to
validate user tokens and similar stuff.
I did come across a number of issues when trying to implement the above
configuration scheme. If I do SSL termination inside Keycloak I won't be
able to configure the different domains via a reverse proxy or similar
approach which, in turn, means that Keycloak should provide a feature to
listen on a separate SSL encrypted port and only make one realm available
there. Which it does not. So do I want something weird here? Are the best
practices different from what I want?
--
Best Regards,
Yervand