[keycloak-dev] Interesting example for trusted service to service communication with JWT

[Stian Thorgersen]

Only watched a bit of it, but it seems like a headache to maintain. As it's
completely decentralized how do you manage what service can access what
service. Imagine if you know one service that can access 100 other services
is compromised and you then have to remove it's public keys everywhere.

Having a centralized solution like Keycloak is much better. You have a
centralized point of controlling what services can access what services.
You have a single place where you need to protect the private key. You can
much more easily remove access to a compromised service.

On 24 August 2016 at 09:57, Thomas Darimont <thomas.darimont at googlemail.com>
wrote:

> Hello,
>
> just stumbled upon an (IMHO) interesting example for trusted service to
> service
> communication with JWT.
>
> Microservices with Spring Boot and Java JSON Web Tokens (JJWT)
> https://www.youtube.com/watch?v=saiwZzE5IYg
>
> They use the JJWT (https://github.com/jwtk/jjwt) library and and
> demonstrate how to use
> the kid (Key ID) claim of JWT.
> In order to establish trust between two services, public keys are
> exchanged to verify
> each others JWT token signatures.
> So instead of using a shared public key (e.g. Realm public key in
> Keycloak) they have a public key per service.
>
> I wonder how this would look like with Keycloak.
>
> Cheers,
> Thomas
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-dev/attachments/20160829/af5c5bb7/attachment.html