Hey! My name is Artem Ivlev, and I am engaged in the architecture of identification of clients of VTB Bank. Our task is to answer the question of who uses our banking service: mobile or Internet banking, voice assistant, or just one of the many offices. There are many tools for this - and I want to tell you about the formation of one of them.
Prologue
It's 2019, the bank's ecosystem is growing by leaps and bounds, and more and more we need a single entry point for customers and an identification provider. And there is only a directory of accounts and separate solutions of different teams for authentication.
We did not yet have requirements for how everything should look. At the same time, we immediately started talking about the authentication of individuals not only in the online bank, but also on the resources of partners. The same button "Enter through VTB".
This is how the entrance through VTB will look like
From this it followed that we needed to take the most universal solution and start using it. In the process of using, we could figure out what we exactly need, what functions are missing, etc.
Choosing which way to go
Having searched the Internet, smoked Gartner's magic squares, they began to look at open source solutions with support in Russia:
• WSO2 Identity Server
• Keycloak
• OpenAM
WSO2 , . .
WSO2 Identity Server
2019 .
(, ) —
, OAuth 2 ID- JWT, . , JWT — :
1. (HEADER) , , .
2. (PAYLOAD) — — , , .
3. (SIGNATURE) , , .
JSON Web Token (JWT)
— , . Base64.
ID- JWT : , . — . API Gateway, .
, X , , «» .
— API Gateway. , , Redis TimeToLive.
, , ? - . , , , .
«»
, « ""» (() « »). (HttpOnly, SameSite, Secure) UUID. UUID , , CRC32, — JWT. . , , . , « — » .
,
. , , , , , -, , (, push, - ).
. , , WSO2 IS, , , API SPA.
, JSP. -, API .
- , .
- API/oauth2/token — .
- grant_type, /oauth2/token, .
. - — . , — grant type. , .
, ,
, , — - , « » . WSO2 IS .
. PostgreSQL Redis. .
:)
, , . — . ( , - ) .
— , . — .
active-active active-passive, PostgreSQL Redis. - .
— WSO2 IS. . Redis, JWT refresh-.
? SSO
WSO2 IS, , , , , .
-. . . «», « » , , . .
« »
, , , «» . . , , « » (, « », ). — .
, . . ? WSO2 IS?
, , , , — , . , — .
: SSO, .
: ? , Tarantool Data Grid?