Thank you for the introduction of what come to delegating the tools of Authentic and the
users to kick-look.
My name is Alex Andrews, and I'm a principal software engineer at Rathead.
I'm also one of the maintenance of the kick-look project working on a full-time and upstream,
and then heavy to be here at the first and I don't see any access management there from
thanks for having me here.
So I'll take a little introduction of what you can do with an identity and access management,
what problems it will solve for you, especially if you're taking a developer's perspective
to it.
So I start with a motivation, some practical authentication, by example, all the other
things that you will need, maybe you didn't think of in the first place, and then
standards everywhere, how they help you to get users authenticated in your environment.
So motivation, why do we do this?
Authentication is for answering questions, who are you, still, there's a lot of questions
around it, and like the question is not, you don't only want to use, you don't only want
users to lock in, but you sometimes want to take the step before that, you want to figure
out if the user already locked in before I asked them to lock in.
Like imagine you have a landing page, you want to show some marketing content, people
visiting your home page and you want to figure out are they locked in, and only then
eventually have a login button somewhere.
There have been these diagrams of the authentication code flow that I showed here on the
right, I borrowed that from the progress project, but this talk will be about how to put
that to work from application perspective developers view, and how can I benefit from all
the features that are in key-cloke, that might have some places, extend the specification
a bit, but then will save you a lot of work as an application developer.
And the things that you can do with an identity management system is like you can check
is the user already locked in, you can register any users, you have a forgot password flow
you can change the password, you can manage account, I used still locked in, you have
kind of four second factors, all of that is in that shift box that you get with, okay,
these are the actors, a little bit more about key-cloke, it's fully open source, fully
open source, and the means of there is no core and non-core and whatnot, it's fully open
source, there's nothing we hide from you here, it's part of the cloud-native computing
foundation incubating project since April 2023, it's a patchy two license, it has up to
date 26,000 GitHub stars, and if you like this product, please give us another GitHub
stars, and we would love to see that.
All right, so the four you actually figure out is the user already locked in, you want to
figure out something about your open-body provider, there's this issue or you're around
that you normally as an application developer, put somewhere in the configuration of the
application, you put the part at the end, dot well dash known slash open ID dash configuration,
and you will get back a JSON, well everything is JSON nowadays, exactly in the summer, so
the issue is then a URL usually, and then there are lots of endpoints in here, there's also
aization endpoint that will be used, most of the time there's a token endpoint, so the
good news is all the different IDPs out there, they will use different URLs, but they
will all have this well known open-body configuration endpoint, and he will just need
to configure one URL in your clients, and they will discover all the other URLs that
are there, from your open-body provider, and what we've seen in a second, they will also
discover what features that open-body provider actually supports, and now we get
back to the actual first question, we want to figure out is the user already locked in,
and what we can then do, we take this authorization endpoint that has been by accident actually
also the first endpoint that was listed there, and we direct the user to it, and we
pass one parameter there saying prompt not, prompt not means don't show any login screen
to the user, and when it then comes back, with a redirect back to your application, it
tells you login required, and so I know yes, users not locked in, I show the general
marketing screen, whatnot, advertising product, and then have a login button, here you
can login if you then you're ready to login.
Then you can say then again, it's the same principle also for the, when you want to register
a new user, it's again building a URL where you redirect the user to, it's again the authorization
endpoint, but then there's a specific spec called the open-body connect prompt create,
it's part of the spec, so somebody said let's put the create in here, instead of,
so like the time before we had prompt equals not, and then it's the or was flow just here from
code flow, it's just the, yeah, taking the developers spec effectively here again, so I get back
a URL in a redirection that depends the session state and the code, that I need in the next step,
and then I sent some of the code and some other parameters to the token endpoint, the token endpoint
retrieved by this well known open-body connect URL, it's again one of these URLs, and I
can back get back this ID token and access token in the refresh token, right.
So this is actually the most, well, there's some cryptography evolved maybe in some place
if you need to pick things stuff, hopefully in your environment, your, you will have an open-body
connect library that will take care of all that, but usually I'd say this open-body connect
libraries allow you to specify if you want to put prompt lock in, prompt none, or prompt create
whatever in there, and then all the cryptography, all the other things around that will be handled
by your open-body connect libraries. Now then there's the question, okay, use a lock
in, great, that worked, now I want to get notified that the user is still locked in, so what
I can do. So there's another URL, again, in this JSON that we saw in the beginning,
that's a check session I frame, that's another part of the open-body connect, let's say,
a bunch of standards in the way, so I can put an I frame in my web page and put the session
and take the URL of the I frame, take the session state that I retrieve received as a
redirect at some point, and send a JavaScript user JavaScript send message to the I frame,
and then I receive a message back saying, yes, sessions still valid, that's fine, or it's no longer
valid, and then I need to do something else. I can then choose to just say, you know,
a log in, maybe show the login button, or redirect the user to maybe enforce a reloading.
Yeah, behind the scenes, key log is then using cookies in the browser, and let's see how
this third party cookies handled, evolves in the future, sets to load out, and how
like when I refresh the page, you will see there's a redirect happening, and so I guess
required, of course, I'm not logged in yet, I can then choose to log in, and then there's
a prompt create in here, if I would look at the URL on the log form, let's not do that,
but you see that the server info shows the server info show in the beginning, and there's
no login button because the prompt create is missing, so at the moment this key log
is not logged in and content, and instead I can now log in as an admin to my key
log instance, and say yes, I want to allow user registration here, and what then happens
is the user info is the server info is updated, now the create method is here, if I go back
to the start screen of an application with my application parses, this JSON, and now I can
actually register, I click on register, and now finally, I can log in as register, so use
a demo demo, this some secret password, and I'm registered here, and now I see finally
all the other things that can do as a logged in user in this time, so this is now,
yeah, as a thing about login, and I'd say this is all with open mic on extended, you can do that by then and you open mic
connect endpoint, and makes your life a lot easier, and maybe at some point also enable features like
a forgot password, I talked about that earlier, and when I then log out the possibility
to change this ACR values in the way to force a step of authentication for a specific application
or what you can do in KQL26.1, you can tell it to enforce for specific application at the minimum level
of authentication is used, so basically saying whenever I log into, let's say,
profaner, I don't need a second factor, whenever I go to the where I transfer my money,
I need to have a second factor authentication, and you configure that centrally in your KQL
and down me to bother about any configuration you do on the side of your applications.
Also, I say probably any IDP will come stable, have a method to update the user data,
that's how users can manage that themselves, so has KQL26, so there's a count console I can go to,
and the thing is I can redirect to the URL, tell it's where the, well,
better redirect comes from, so KQL will then show here what you see in the upper right corner,
the short URL where to get back to the application, so at some point you probably need to
see this a bit, that it makes your CI, and then I can go back to my application,
that's fine, and in the account console, as I said, I have lots of functionality here
to manage my own data, but I can also have a link in here, update profile where I
do it, where I, to the only first and last name because I didn't allow them to change the email address,
but I can change that I can do an update password here or cancel it again, or I can do an update email,
where then send out an email, maybe confirm that as well.
So all this functionality is then available as modular pieces as part of the login theme,
so once you're updated login theme to look as your CI, you're basically good to use that as well.
Something that you can also do is, depending on the application that you want to use here,
let's see if the time for the demo is enough here.
I can choose which application, well, what's which data has been carried for for specific applications,
so I can go here to my test realm, let's see if I'm fast enough.
To my user profile, I probably can create a new attribute being like an address.
It's only there when the specific scope is requested, it's a required field, when the scope is requested.
There it is, say, it's the user candidate, the user can view it and the admin can do the same,
so it's there. So I added now a new required field address, and if the demo goes with me,
if I just refresh the page, you know, if I login again, yeah, it's, I need to login with demo demo,
and now it's not asking, because yes, I didn't click on xx scope address, yeah.
Well, it goes as before, and that's a good thing, and if I now login with the scope address, the address is required fields.
So an application can really choose which, well, maybe in a different context, you can really choose,
when I go from one part of the application to another part of the application, which data I want to have,
which hopes I want to add, and now I need to put in some demo address, and once I put in the scope,
it's going to be asked by the user when they log in, and I will go to the user info,
and then the address is, okay, I didn't use the right field here, but then we would show here as an address,
in the user info, but only then, because the scope has been requested for it.
So, yeah, so I'd say standard textbook here, so there's a lot of authentication and user management functionality,
so just a link, like a web-like link away to your IDP, or kick-up if you choose to choose that one.
So the open IDConnect library in your environment usually does the heavy lifting,
but you can usually choose which parameters to pass, the extra parameters to pass,
which kind of prompt to choose, maybe put in this case the action, if you want to have this modular account console functionality,
and then all these standards and all the understanding, what is there, how to detect,
which functionality open, when you connect provider support by looking into this well-known endpoint,
that's a very a gold-mine right thing.
Right, there's a lot of heavy features and kick-load, kick-up, try them out, so these are the links.
To kick-load and serve the features, if you want to have a look at the previous features,
we currently have the currently working on the authentication.
The token exchange to find your end user-atamin commissions, that's something we currently working on,
and hopefully have it fully supported soon.
Open-Modiconex Core is a good place to start.
The demo code I showed you is there, and the JavaScript library I used on the clients had to do this demo,
with the panel open, my client, full credit to them.
They did a good job to do the good photography, and I was able to put in the prompt parameters,
and the case the action parameters as I needed to.
Thanks for that.
Thank you.
So, I'll send the icon to question from Matrix.
The question says it's from Breton,
and he would like to authenticate not human services users on his application,
for instance, for monitoring or reporting.
So, no browser, no fancy UI.
So, what did we possibly go to of law at it to kick lock, and what are the protocols that are there for it?
Yeah, we had this device authentication zone early, and that's, in the previous target,
it's been shown, so we can prompt a URL that you can click on and then completely authentication.
But then it's only, like, if this client is acting on a user's behalf, so it locks in as it uses.
The other thing you can do is we can register every of your monitoring of IoT device as a client,
and then each client will have its own client ID, client secret,
and there's a checkbox called Service Account, and then the client does a flow-fold client credential,
going to come up with taken.
So, if I was to go to this client here, and some of you can have a Service Account as a public client,
it's not available for public clients, but for confidential clients, you'll have a Service Account,
and you can have, like, as many devices as you have, the same number of clients who set up,
and they can authenticate, get their tokens, and for return monitoring data as an example we had there.
Yeah, sure.
So, thanks for the talk.
We have our users correctly on O0.
Is there an easy way? Easy.
Not so easy, but at least is there a way to transfer the users to, and that maybe you after,
if they get the data to you, but on the other hand, you can do Federation as an intermediate step,
so that you can Federation, you may be used to kick-load your users,
your application, connect only to kick-load, but not to all zero,
and eventually you don't do a migration then.
You can just talk about people who are very good, and then just do the editing.
Yes.
I'm not allowed to do that.
Sorry.
Yeah.
I want to apologize for that, because I'm, like, very kick-load new,
so this might be a very naive question.
But I've seen kick-load typically deployed in environments that serve the needs of organization,
where like, several hundred people groups, etc.
Permissions.
How, look, is there any evidence that it's deployed for a larger, like,
thousands, tens of thousands, hundreds of thousands?
What if, like, I want to create an app and have my customers,
which, potentially, is like, a lot of data.
Yeah.
So, when you size the kick-load instance, you size it, but a number of concurrent sessions
in a way, that are concurrently using it maybe within an hour.
So, and there are a lot of examples with hundreds, thousands of concurrent users out there.
And if you look through the web, you will see this all or this.
If you look at the kick-load specific URL, and when you're looking at public companies,
you will see that they use kick-load now and then for public facing applications.
Yeah.
And some, I say, German entertainment companies, using it.
I know about that one.
Good. I think we are at the end of the time.
I'm happy to take more questions outside. I also have stickers and postcards for those who want one.
Cool.