Securing Keycloak and Applications

In this chapter, we will look at how to secure Keycloak for production environments. Then, we will look at how to secure the database, as well as how to secure cluster communication between Keycloak nodes. Finally, we will touch on some topics regarding how you can protect your own applications against threats.

After reading this chapter, you will have a good understanding of how to securely deploy Keycloak, including what is required to secure the database. Since this is a book about Keycloak and not about application security, you won’t become an expert on application security, but if this is a topic that’s new to you, you will have a basic understanding and an idea of how to learn more.

In this chapter, we’re going to cover the following main topics:

• Securing Keycloak
• Securing the database
• Securing cluster communication
• Securing applications

Securing Keycloak

In this section, we will look at some important aspects of securing the Keycloak server itself. We will start by looking at an example of a secure Keycloak deployment, as shown in the following diagram:

Figure 14.1: An example of a secure deployment

In this example, Keycloak and its database are isolated from users and applications with a Web Application Firewall (WAF), all network requests are encrypted, and the database is also encrypted.

Let’s look at this in a bit more detail, starting with why Transport Layer Security (TLS) is a requirement for any ingoing and outgoing traffic to Keycloak.

Encrypting communication to Keycloak

It is recommended to use end-to-end encryption for all communication to and from Keycloak. This means always using HTTPS, and never using HTTP. At the time of writing this book, the most recent security layer in HTTPS is TLS 1.3, so this is what you should use whenever possible. Most HTTP libraries will support...

Securing cluster communication

Keycloak embeds Infinispan, which is leveraged when you create a cluster of Keycloak nodes. More sensitive data such as signing keys or user information is not sent across the cluster, as this information is only kept in a local cache in each node with the only communication across the cluster being invalidation messages. It does store information about user sessions in the cluster, which are distributed across the cluster. Sessions themselves contain some information such as the session ID, the expiration date, and associated client sessions. Even if an attacker gains access to this information, they are limited in terms of what they can do with it, since accessing any session through Keycloak requires a token or cookie to be signed by Keycloak.

It would still be a good idea to secure cluster communication, at the very least with a firewall. For additional protection, you can enable authentication and/or encryption for cluster communication.

...

Securing user accounts

With regard to securing user accounts, you will want to protect against an attacker gaining access to the user account and also protect information about the user, including their password.

Preventing an attacker from accessing a user account is mostly about enabling strong authentication, and not just accepting a password as the means of authentication. If your users are relying on passwords, even in combination with a second factor, it is important that passwords are protected.

Passwords are protected by leveraging a strong password hashing algorithm, having a good password policy, and enabling brute-force protection for passwords. It is also important to educate users in terms of what is a strong password and that they should not reuse passwords with other services.

To configure a password policy, open the Keycloak administration console and select the realm you want to configure. Then, click on Authentication, then Policies, and select the Password...

Securing applications

Since more applications are being exposed on the internet, the number of attacks and data breaches is growing by the day. This means it is important to secure applications properly.

Up until recently, a common practice was to leverage firewalls and VPNs as the main layer of defense against attacks. Often, this was combined with questionable security within the boundaries of the enterprise environment. This is becoming less viable with more employees working from home or using their personal laptops or phones. More and more services are also being exposed to partners or the public. This is blurring the line of the enterprise network. The whole idea of trusting what is on the inside, but not what is on the outside, was also somewhat questionable as there are often ways for attackers to get inside the enterprise network, and it also provides less protection against an internal attack.

Essentially, something better is needed than just a firewall. Keycloak...

Summary

In this chapter, you learned about several important aspects of deploying Keycloak securely into production. You learned how important it is to secure the database that’s used by Keycloak, as well as communication between nodes. You also learned how important it is to protect user accounts from being compromised, as well as how important it is to keep information about your users secure. Finally, you got some insight into what it means to secure an application by focusing on web applications, as well as how to utilize OAuth 2.0 and OpenID Connect to secure your applications.

You should now have a good understanding of how to securely run Keycloak in production, as well as an idea of where you can start learning more about securing your applications.

This is the final chapter of this book. We hope you have enjoyed this book and have gained a good understanding of Keycloak and how you can utilize it to help secure your applications. While this book has not covered...

Questions

1. Why is it important to regularly update Keycloak?
2. Why is it especially important to protect the database that’s used by Keycloak?
3. Is it sufficient to use a WAF to protect web applications?

Further reading

Please refer to the following links for more information on the topics that were covered in this chapter:

• OWASP Top 10: https://owasp.org/www-project-top-ten/
• OWASP Cheat Sheet Series: https://cheatsheetseries.owasp.org/index.html
• OAuth 2.0 for Mobile and Native Apps: https://tools.ietf.org/html/rfc8252
• OAuth 2.0 for Browser-Based Apps: https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps
• OAuth 2.0 Threat Model and Security Considerations: https://tools.ietf.org/html/rfc6819
• OAuth 2.0 Security Best Current Practice: https://tools.ietf.org/html/draft-ietf-oauth-security-topics
• OAuth 2.1: https://tools.ietf.org/html/draft-parecki-oauth-v2-1

Join our community on Discord

Join our community’s Discord space for discussions with the authors and other readers:

https://packt.link/SecNet