Difference between revisions of "WISE-PaaS/Single Sign-On(SSO)"

Revision as of 07:20, 16 January 2017

Single Sign-On (SSO) is part of Advantech WISE-PaaS cloud solution and  plays an important role in the interoperability of Internet identity. It provides a central login mechanism.

OpenID Connect utilizes Keycloak which is an open source identity and access management for modern applications and services.

API Protocol Flow

WISE-PaaS/Single Sign-On use the OAuth 2.0 protocol for authentication and authorization.

• User/Resource owner : Who authorizes others to access Protected Resource. If the role is human, it means the end-user.
• Application/Client/Browse : An application ,client or a browser page represents the Resource Owner to access the Protected Resource.
• Authorize Server : The server issues the Access Token after user are authenticated. (WISE-PaaS/Single Sign-On server)
• Resource Server : The server hosting Protected Resource accept requests according to Access Token.

Here is a more detailed explanation of the steps in the diagram:

1. The application requests authorization to access service resources from the user
2. If the user authorized the request, the application receives an authorization grant
3. The application requests an access token from the authorization server (API) by presenting authentication of its own identity, and the authorization grant
4. If the application identity is authenticated and the authorization grant is valid, the authorization server (API) issues an access token to the application. Authorization is complete.
5. The application requests the resource from the resource server (API) and presents the access token for authentication
6. If the access token is valid, the resource server (API) serves the resource to the application

​

Features Overview

WISE-PaaS/Single Sign-On(SSO) which base on keycloak has the following features.

• Single-Sign On : Login once to multiple applications

• Standard Protocols : OpenID Connect, OAuth 2.0 and SAML 2.0

• Centralized Management : For admins and users

• Adapters : Secure applications and services easily

• High Performance : Lightweight, fast and scalable

• Clustering : For scalability and availability

• Themes : Customize look and feel

• Extensible : Customize through code

• Password Policies : Customize password policies

Components

[Please describe]

• OpenID Connect Server
• OpenID Connect Client
• OAuth 2.0 Server
• OAuth 2.0 Client

Implementation

WISE-PaaS provides a complete service for Single Sign-On. There are tree sections for developer to implement.

1. Settings on Authorization Server
2. Application for end user
3. Verify Access Token on Resource Server

Add the jwt decode for your access token. Here is a Java client sample code.

• Maven Dependency

<code data-lang="xml"><dependencies>
    <dependency>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-client</artifactId>
        <version>${KEYCLOAK_VERSION}</version>
    </dependency>
</dependencies></code>

• Obtaining User Entitlements

<code data-lang="java">// create a new instance based on the configuration defined in keycloak-authz.json
AuthzClient authzClient = AuthzClient.create();

// obtain an Entitlement API Token to get access to the Entitlement API.
// this token is an access token issued to a client on behalf of an user
// with a scope = kc_entitlement
String eat = getEntitlementAPIToken(authzClient);

// send the entitlement request to the server to
// obtain an RPT with all permissions granted to the user
EntitlementResponse response = authzClient.entitlement(eat)
    .getAll("hello-world-authz-service");
String rpt = response.getRpt();

System.out.println("You got a RPT: " + rpt);

// now you can use the RPT to access protected resources on the resource server</code>

Document

• WISE-PaaS/Single_Sign-On(SSO)_server_setting
• Application(Client)_Sample_code_(json)
• Application(Client)_Sample_code_(HTML)
• Resource_Server_jwt_Sample_code