Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Zero trust architecture with Keycloak
Search
Posedio
PRO
June 12, 2024
Programming
0
91
Zero trust architecture with Keycloak
Posedio
PRO
June 12, 2024
Tweet
Share
More Decks by Posedio
See All by Posedio
The Future of Data Sharing
posedio
PRO
0
39
Is your spring boot application in Kubernetes secure?
posedio
PRO
0
46
Site Reliability Engineering: Getting C-Level Support
posedio
PRO
0
12
Controlling Data in Gaia-X
posedio
PRO
0
13
The REWE Data Platform
posedio
PRO
0
29
Key Insights from Using Kafka in Large-Scale Projects
posedio
PRO
0
59
We tried to sell a cake for 1 Billion Euro... then build a data mesh
posedio
PRO
0
13
Handling round-the-clock availability
posedio
PRO
0
18
Choosing the Right Tool
posedio
PRO
0
15
Other Decks in Programming
See All in Programming
Делим тесты между QA и разработчиком
mariyasaygina
0
530
推しの夫に恋のGPS「ときメーター」#M5Stack #IoT #M5JPTour2024
riyu
0
230
Taking LLMs out of the black box: A practical guide to human-in-the-loop distillation
inesmontani
PRO
3
1.2k
RemixとCloudflare Stack におけるFile Upload
ossamoon
1
120
フロントエンドの現在地とこれから
koba04
10
4.4k
NEWTにおけるiOS18対応の進め方
ryu1sazae
0
230
VS Code extension: ドラッグ&ドロップでファイルを並び替える
ttrace
0
160
Cloud Adoption Frameworkにみる組織とクラウド導入戦略(縮小版)
tomokusaba
1
180
データサイエンスのフルサイクル開発を実現する機械学習パイプライン
xcnkx
2
500
全方位強化 Python 服務可觀測性:以 FastAPI 和 Grafana Stack 為例
blueswen
1
380
Modern Functional Fluent CFML REST by Luis Majano
ortus24
0
140
[KR] Server Driven Compose With Firebase
skydoves
2
180
Featured
See All Featured
Optimizing for Happiness
mojombo
375
69k
VelocityConf: Rendering Performance Case Studies
addyosmani
324
23k
Gamification - CAS2011
davidbonilla
80
5k
Learning to Love Humans: Emotional Interface Design
aarron
272
40k
Designing Experiences People Love
moore
138
23k
Why You Should Never Use an ORM
jnunemaker
PRO
53
9k
Building Adaptive Systems
keathley
38
2.1k
Reflections from 52 weeks, 52 projects
jeffersonlam
346
20k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
131
32k
Practical Orchestrator
shlominoach
186
10k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
225
22k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
7
280
Transcript
None
WHAT’S IN IT FOR ME 1. Conventional vs. zero trust
architecture 2. User identity vs. machine identity 3. Platform example vs. application example 4.What should I use in my project?
3 HI • Damjan Gjurovski • Software all-rounder J •
Set up Keycloak and zero trust in a large developer platform, worked on some Keycloak plugins
CONVENTIONAL VS. ZERO TRUST ARCHITECTURE 1
5 PERIMETER- BASED SECURITY • Network perimeter • DMZ and
internal zone • Trust those inside the zone • Check all entry points
6 ZERO TRUST • Push security controls down • Always
verify authentication and authorization • Follow the principle of least privilege
7 THE ROOT OF TRUST PROBLEM • Turtles all the
way down • Who compiles the compiler https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf
USER IDENTITY VS. MACHINE IDENTITY 2
9 USER IDENTITY • User accounts • Groups, roles, permissions
bound to work roles • Least privilege according to current task/role https://gist.github.com/angelo-v/e0208a18d455e2e6ea3c40ad637aac53
10 MACHINE IDENTITY • Service accounts • Groups and permissions
bound to use-case, type or network perimeter • Least privilege is difficult
PLATFORM EXAMPLE VS. APPLICATION EXAMPLE 3
12 THE PLATFORM • Keycloak • JWTs • Identity federation
• Istio • OAuth proxy • OPA • Vault • Kubernetes • GCP
13 PLATFORM
14 THE APPLICATION • Keycloak • OPA • Vault •
Kubernetes
WHAT SHOULD I USE IN MY PROJECT 4
16 THIS IS THE WAY • Use Keycloak J •
Use zero trust • Reconsider JWTs • Prioritize user identities
17 WANT TO KEEP THE DISCUSSION GOING? MESSAGE ME ON
LINKEDIN!