You're reading from Keycloak - Identity and Access Management for Modern Applications - Second Edition

Product type Book

Published in Jul 2023

Publisher Packt

ISBN-13 9781804616444

Pages 350 pages

Edition 2nd Edition

Languages

Concepts

Cybersecurity

Authors (2):

Stian Thorgersen

Pedro Igor Silva

View More author details

Table of Contents (18) Chapters

Preface

1. Getting Started with Keycloak

2. Securing Your First Application

3. Brief Introduction to Standards

4. Authenticating Users with OpenID Connect

5. Authorizing Access with OAuth 2.0

6. Securing Different Application Types

7. Integrating Applications with Keycloak

8. Authorization Strategies

9. Configuring Keycloak for Production

10. Managing Users

11. Authenticating Users

12. Managing Tokens and Sessions

13. Extending Keycloak

14. Securing Keycloak and Applications

15. Assessments

16. Other Books You May Enjoy

17. Index

Securing Keycloak and Applications

In this chapter, we will look at how to secure Keycloak for production environments. Then, we will look at how to secure the database, as well as how to secure cluster communication between Keycloak nodes. Finally, we will touch on some topics regarding how you can protect your own applications against threats.

After reading this chapter, you will have a good understanding of how to securely deploy Keycloak, including what is required to secure the database. Since this is a book about Keycloak and not about application security, you won’t become an expert on application security, but if this is a topic that’s new to you, you will have a basic understanding and an idea of how to learn more.

In this chapter, we’re going to cover the following main topics:

Securing Keycloak
Securing the database
Securing cluster communication
Securing applications

Securing Keycloak

In this section, we will look at some important aspects of securing the Keycloak server itself. We will start by looking at an example of a secure Keycloak deployment, as shown in the following diagram:

Figure 14.1: An example of a secure deployment

In this example, Keycloak and its database are isolated from users and applications with a Web Application Firewall (WAF), all network requests are encrypted, and the database is also encrypted.

Let’s look at this in a bit more detail, starting with why Transport Layer Security (TLS) is a requirement for any ingoing and outgoing traffic to Keycloak.

Encrypting communication to Keycloak

It is recommended to use end-to-end encryption for all communication to and from Keycloak. This means always using HTTPS, and never using HTTP. At the time of writing this book, the most recent security layer in HTTPS is TLS 1.3, so this is what you should use whenever possible. Most HTTP libraries will support...

Securing cluster communication

Keycloak embeds Infinispan, which is leveraged when you create a cluster of Keycloak nodes. More sensitive data such as signing keys or user information is not sent across the cluster, as this information is only kept in a local cache in each node with the only communication across the cluster being invalidation messages. It does store information about user sessions in the cluster, which are distributed across the cluster. Sessions themselves contain some information such as the session ID, the expiration date, and associated client sessions. Even if an attacker gains access to this information, they are limited in terms of what they can do with it, since accessing any session through Keycloak requires a token or cookie to be signed by Keycloak.

It would still be a good idea to secure cluster communication, at the very least with a firewall. For additional protection, you can enable authentication and/or encryption for cluster communication.

...

Securing user accounts

With regard to securing user accounts, you will want to protect against an attacker gaining access to the user account and also protect information about the user, including their password.

Preventing an attacker from accessing a user account is mostly about enabling strong authentication, and not just accepting a password as the means of authentication. If your users are relying on passwords, even in combination with a second factor, it is important that passwords are protected.

Passwords are protected by leveraging a strong password hashing algorithm, having a good password policy, and enabling brute-force protection for passwords. It is also important to educate users in terms of what is a strong password and that they should not reuse passwords with other services.

To configure a password policy, open the Keycloak administration console and select the realm you want to configure. Then, click on Authentication, then Policies, and select the Password...

Securing applications

Since more applications are being exposed on the internet, the number of attacks and data breaches is growing by the day. This means it is important to secure applications properly.

Up until recently, a common practice was to leverage firewalls and VPNs as the main layer of defense against attacks. Often, this was combined with questionable security within the boundaries of the enterprise environment. This is becoming less viable with more employees working from home or using their personal laptops or phones. More and more services are also being exposed to partners or the public. This is blurring the line of the enterprise network. The whole idea of trusting what is on the inside, but not what is on the outside, was also somewhat questionable as there are often ways for attackers to get inside the enterprise network, and it also provides less protection against an internal attack.

Essentially, something better is needed than just a firewall. Keycloak...

Summary

In this chapter, you learned about several important aspects of deploying Keycloak securely into production. You learned how important it is to secure the database that’s used by Keycloak, as well as communication between nodes. You also learned how important it is to protect user accounts from being compromised, as well as how important it is to keep information about your users secure. Finally, you got some insight into what it means to secure an application by focusing on web applications, as well as how to utilize OAuth 2.0 and OpenID Connect to secure your applications.

You should now have a good understanding of how to securely run Keycloak in production, as well as an idea of where you can start learning more about securing your applications.

This is the final chapter of this book. We hope you have enjoyed this book and have gained a good understanding of Keycloak and how you can utilize it to help secure your applications. While this book has not covered...