Flow T\u00fcr\u00fc<\/th>\n	A\u00e7\u0131klama<\/th>\n	Kullan\u0131ld\u0131\u011f\u0131 Yerler<\/th>\n	G\u00fcnl\u00fck Hayattan \u00d6rnekler<\/th>\n	Keycloak Kar\u015f\u0131l\u0131\u011f\u0131<\/th>\n<\/tr>\n
Browser Flow<\/td>\n	\n Taray\u0131c\u0131 (browser) tabanl\u0131 etkile\u015fimli giri\u015f ak\u0131\u015flar\u0131.\n <\/td>\n	\n \u25aa\ufe0fWeb uygulamalar\u0131 login ekranlar\u0131 \n \u25aa\ufe0fSSO (Single Sign-On) senaryolar\u0131 \n \u25aa\ufe0fMFA \/ OTP \/ Captcha gibi etkile\u015fimli ad\u0131mlar \n \u25aa\ufe0fIdentity Provider (Google, Azure AD, e-Devlet) ile login durumlar\u0131\n <\/td>\n	\n \u25aa\ufe0f\u0130nteraktif Vergi Dairesi’ne e-Devlet \u00fczerinden login olma. \n \u25aa\ufe0fMHRS’ye e-Devlet \u00fczerinden giri\u015f yapma.\n <\/td>\n	browser<\/td>\n<\/tr>\n
Direct Grant Flow<\/td>\n	\n Kullan\u0131c\u0131 ad\u0131 ve \u015fifre ile do\u011frudan token alma.<\/p>\n Sessiz \u00e7al\u0131\u015f\u0131r. Arka planda token \u00fcretir ve taray\u0131c\u0131ya gerek yoktur!<\/p>\n \u26a0\ufe0fG\u00fcvenlik riski daha y\u00fcksektir! Modern OAuth d\u00fcnyas\u0131nda pek \u00f6nerilmemektedir!\n <\/td>\n	\n \u25aa\ufe0fRedirect olmadan token al\u0131naca\u011f\u0131 durumlar \n \u25aa\ufe0fAPI, backend ve script tabanl\u0131 login durumlar\u0131 \n \u25aa\ufe0fPublic \/ Confidential client’lar\u0131 \n \u25aa\ufe0fMFA ve OTP olmaks\u0131z\u0131n do\u011frulama durumlar\u0131\n <\/td>\n	\n Mobil uygulamas\u0131n\u0131n kullan\u0131c\u0131 ad\u0131 ve \u015fifreyi do\u011frudan bankan\u0131n sistemine g\u00f6nderip arka planda do\u011frulamas\u0131 ve token almas\u0131.\n <\/td>\n	direct grant<\/td>\n<\/tr>\n
Client Auth Flow<\/td>\n	\n Client’\u0131n kendisini do\u011frulamas\u0131.<\/p>\n Kullan\u0131c\u0131 yoktur. Dolay\u0131s\u0131yla do\u011frulanan kullan\u0131c\u0131 de\u011fil uygulaman\u0131n ta kendisidir.\n <\/td>\n	\n \u25aa\ufe0fClient’\u0131n kendini do\u011frulamak zorunda oldu\u011fu durumlar \n \u25aa\ufe0fMachine-to-Machine (M2M) senaryolar\u0131 \n \u25aa\ufe0fConfidential client’lar \n \u25aa\ufe0fRefresh token\n <\/td>\n	\n Bir bankan\u0131n muhasebe sisteminin, \u00e7al\u0131\u015fan olmaks\u0131z\u0131n, kendi kurum kimli\u011fiyle Gelir \u0130daresi sistemine ba\u011flan\u0131p otomatik bildirim g\u00f6ndermesi.\n <\/td>\n	clients<\/td>\n<\/tr>\n
Registration Flow<\/td>\n	\n Kullan\u0131c\u0131 kay\u0131t s\u00fcreci ad\u0131mlar\u0131.<\/p>\n Yeni kullan\u0131c\u0131 kay\u0131t olurken hangi ad\u0131mlar izlenecek onu belirler.\n <\/td>\n	\n \u25aa\ufe0fRegistration endpoint \n \u25aa\ufe0fE-posta do\u011frulamas\u0131 gereken kay\u0131t i\u015flemleri \n \u25aa\ufe0fKay\u0131t s\u0131ras\u0131nda ek kontrol veya kural oldu\u011fu durumlar \n \u25aa\ufe0fIdP sonraki ek kay\u0131t gerekti\u011fi durumlar\n <\/td>\n	\n Bir belediyenin e-hizmet portal\u0131ndan ilk kez hesap olu\u015fturup e-posta do\u011frulamas\u0131 yaparak sisteme kay\u0131t olunmas\u0131.\n <\/td>\n	registration<\/td>\n<\/tr>\n
Reset Credentials Flow<\/td>\n	\n \u015eifre veya kimlik bilgisi s\u0131f\u0131rlama.\n <\/td>\n	\n Yeni \u015fifre belirleme s\u00fcre\u00e7leri\n <\/td>\n	\n \u015eifremi unuttum ak\u0131\u015f\u0131.\n <\/td>\n	reset credentials<\/td>\n<\/tr>\n
First Broker Login Flow<\/td>\n	\n Harici IdP sonras\u0131 ilk giri\u015f s\u00fcreci.<\/p>\n Google, Azure AD, e-Devlet vs. gibi harici bir Identity Provider’dan ilk kez gelen kullan\u0131c\u0131 i\u00e7in \u00e7al\u0131\u015f\u0131r.<\/p>\n \ud83d\udcccFederation \/ Broker senaryolar\u0131n\u0131n kalbidir.\n <\/td>\n	\n \u25aa\ufe0fHarici Identity Provider’dan d\u00f6n\u00fc\u015f yap\u0131ld\u0131\u011f\u0131 durumlar \n \u25aa\ufe0fIdP’den gelen bilgiler yeterli olmad\u0131\u011f\u0131 durumlar \n \u25aa\ufe0fIdP login sonras\u0131 politika uygulanaca\u011f\u0131 durumlar\n <\/td>\n	\n \u25aa\ufe0fBir vatanda\u015f\u0131n bir belediyenin e-hizmet portal\u0131na ilk kez e-Devlet ile giri\u015f yapmas\u0131 ve sistemin bu ki\u015fiyi o anda kendi kay\u0131tlar\u0131na eklemesi. \n \u25aa\ufe0fBir \u00f6\u011frencinin \u00fcniversite sistemine ilk kez e-Devlet\/Y\u00d6K do\u011frulamas\u0131yla girip otomatik \u00f6\u011frenci hesab\u0131n\u0131 a\u00e7mas\u0131.\n <\/td>\n	first broker login<\/td>\n<\/tr>\n
Conditional Flow\u2019lar<\/td>\n	\n Ko\u015fula ba\u011fl\u0131 authentication ak\u0131\u015flar\u0131.<\/p>\n E\u011fer \u015fu \u015fart sa\u011flan\u0131yorsa, \u015fu ad\u0131m\u0131 \u00e7al\u0131\u015ft\u0131r mant\u0131\u011f\u0131nda ak\u0131\u015f sa\u011flar.\n <\/td>\n	\n \u25aa\ufe0fAuthentication Flow i\u00e7inde ko\u015ful de\u011ferlendirmesi gereken her yer \n \u25aa\ufe0fKullan\u0131c\u0131ya g\u00f6re farkl\u0131 ad\u0131mlar \u00e7al\u0131\u015ft\u0131r\u0131laca\u011f\u0131 durumlar \n \u25aa\ufe0fOrtama \/ ba\u011flama g\u00f6re karar verilen senaryolar\u0131 \n \u25aa\ufe0fRisk bazl\u0131 do\u011frulama senaryolar\u0131nda \n \u25aa\ufe0fAyn\u0131 flow i\u00e7inde farkl\u0131 login yollar\u0131 sunulacaksa\n <\/td>\n	\n Role veya IP\u2019ye g\u00f6re ek do\u011frulama.\n <\/td>\n	<\/td>\n<\/tr>\n<\/table>\n <\/span>Execution Nedir?<\/span><\/h4>\n Authentication Flow, i\u00e7erisinde ad\u0131mlardan olu\u015fan bir ak\u0131\u015ftan ibarettir ve her bir ad\u0131m \u00f6nceden; \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmayaca\u011f\u0131, ba\u015far\u0131s\u0131z olursa ne olaca\u011f\u0131, alternatif olup olmad\u0131\u011f\u0131 vs. gibi durumlara kar\u015f\u0131n hali haz\u0131rda tan\u0131mlanm\u0131\u015f davran\u0131\u015fa sahiptir. \u0130\u015fte bizler bu do\u011frulama kurallar\u0131n\u0131n oldu\u011fu ad\u0131mlar\u0131n her birine Execution diyoruz.<\/p>\n Execution, authentication s\u0131ras\u0131nda \u00e7al\u0131\u015fan tek bir do\u011frulama kural\u0131d\u0131r. Flow ise execution’lar\u0131n s\u0131ral\u0131 \u00e7al\u0131\u015ft\u0131\u011f\u0131 bir yap\u0131d\u0131r.<\/em><\/p><\/blockquote>\n <\/span>Execution Type’lar<\/span><\/h5>\n Execution’lar sergiledikleri davran\u0131\u015flar\u0131n t\u00fcr\u00fcne g\u00f6re required, alternative, optional ve conditional olmak \u00fczere d\u00f6rde ayr\u0131lmaktad\u0131rlar. \u015eimdi gelin bu execution tiplerini tek tek masaya yat\u0131ral\u0131m;<\/p>\n \n REQUIRED<\/em><\/strong> \nRequired olarak tan\u0131mlanm\u0131\u015f olan ad\u0131m, ad\u0131 \u00fczerinde, mutlaka \u00e7al\u0131\u015fmal\u0131 ve ba\u015far\u0131l\u0131 olmal\u0131. Genellikle username ve password do\u011frulama s\u00fcre\u00e7lerinde veyahut zorunlu OTP kullan\u0131lan senaryolarda tercih edilir.\n<\/li>\n ALTERNATIVE<\/em><\/strong> \nAyn\u0131 seviyede birden fazla execution’\u0131n oldu\u011fu senaryoyu ifade etmektedir. Aralar\u0131nda ‘veya’ mant\u0131\u011f\u0131 s\u00f6z konusudur. Ad\u0131 \u00fczerinde \ud83d\ude42 alternatif… Haliyle bir tanesinin ba\u015far\u0131l\u0131 olmas\u0131 flow’un devam etmesi i\u00e7in yeterlidir.\n<\/li>\n OPTIONAL<\/em><\/strong> \nBu execution ba\u015far\u0131l\u0131 olsa da olmasa da \u00e7al\u0131\u015facak ancak flow’u engellemeyecektir. Yani opsiyoneldir. Buna en g\u00fczel \u00f6rne\u011fi ‘Remember-me’yi verebiliriz \ud83d\ude09 Olsa da ak\u0131\u015f devam edecek, olmasa da…\n<\/li>\n CONDITIONAL<\/em><\/strong> \nBu execution ise \u015farta g\u00f6re i\u015flevsellik g\u00f6sterecektir. Yani bir do\u011frulamadan ziyade, karar mekanizmas\u0131 gibi davran\u0131\u015f sergilemektedir. Misal olarak; kullan\u0131c\u0131n\u0131n OTP’si aktif mi?, client public mi? IP trusted m\u0131? vs. gibi \u015fartlar \u00f6rnek g\u00f6sterilebilir.\n<\/li>\n<\/ul>\n \u015eimdi bu execution’lar\u0131 ak\u0131llarda daha da netle\u015ftirebilmek i\u00e7in Keycloak \u00e7er\u00e7evesinde Browser Authentication Flow<\/em>‘u ad\u0131m ad\u0131m (execution execution) teoride par\u00e7alayal\u0131m ve b\u00f6ylece s\u00fcre\u00e7te yap\u0131y\u0131 g\u00f6zlemlemeye \u00e7al\u0131\u015fal\u0131m.<\/p>\n <\/span>Browser Authentication Flow’u Execution’lar\u0131na B\u00f6lelim<\/span><\/h5>\n Browser flow, yukar\u0131daki sat\u0131rlarda inceledi\u011fimiz \u00fczere taray\u0131c\u0131dan gelen login’ler i\u00e7in \u00e7al\u0131\u015fan bir ak\u0131\u015ft\u0131r. \u015eimdi bu flow’un \u00fcst seviye \u015femas\u0131n\u0131 \u00e7\u0131kar\u0131rsak e\u011fer;<\/p>\n \nBrowser Flow \n\u251c\u2500 Cookie \n\u251c\u2500 Kerberos (opsiyonel) \n\u2514\u2500 Username Password Form \n \u251c\u2500 Username Password \n \u2514\u2500 Conditional OTP \n \u2514\u2500 OTP Form\n<\/div>\n G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere Browser flow, yukar\u0131daki execution’lar ile seyretmektedir. \u015eimdi gelin tek tek, hangi execution ne yap\u0131yor, neden var, ba\u015far\u0131s\u0131z olursa ne olur incelemeye ba\u015flayal\u0131m…<\/p>\n \n 1\ufe0f\u20e3Cookie<\/em><\/strong> \nType : ALTERNATIVE<\/span><\/p>\n Ne yapar?<\/u><\/em><\/p>\n \n Taray\u0131c\u0131da \u00f6nceden ge\u00e7erli bir Keycloak oturumu (SSO cookie) var m\u0131 kontrol eder.<\/li>\n Varsa hi\u00e7 kullan\u0131c\u0131 \u015fifre sormadan login ba\u015far\u0131l\u0131 say\u0131l\u0131r.<\/li>\n<\/ul>\n Neden ALTERNATIVE’dir?<\/u><\/em> \n\u00c7\u00fcnk\u00fc cookie varsa e\u011fer i\u015f bitmekte, yoksa di\u011fer alternatiflere ge\u00e7ilmektedir.<\/p>\n Bu ad\u0131m ba\u015far\u0131s\u0131z olsa bile login bitmeyecektir!\n<\/li>\n 2\ufe0f\u20e3 Kerberos (SPNEGO)<\/em><\/strong> \nType : ALTERNATIVE<\/span><\/p>\n Ne yapar?<\/u><\/em> \nKurumsal ortamda (AD \/ Kerberos) taray\u0131c\u0131 domain’e login mi diye bakar.<\/p>\n \u00c7o\u011fu sistemde disable edilmektedir.\n<\/li>\n 3\ufe0f\u20e3 Username Password Form<\/em><\/strong> \n\u0130\u015fin klasik login k\u0131sm\u0131 burada ba\u015flamaktad\u0131r! Esas\u0131nda bu bir execution de\u011fildir! SUB-FLOW’dur! Yani alt\u0131nda a\u015fa\u011f\u0131daki execution’lar mevcuttur;<\/p>\n \nUsername Password Form \n \u251c\u2500 Username Password \n \u2514\u2500 Conditional OTP \n \u2514\u2500 OTP Form\n<\/div>\n \n 3\ufe0f\u20e3.1\ufe0f\u20e3 Username Password<\/em><\/strong> \nType : REQUIRED<\/span><\/p>\n Ne yapar?<\/u><\/em><\/p>\n \n Kullan\u0131c\u0131 var m\u0131?<\/li>\n \u015eifre do\u011fru mu?<\/li>\n Hesap kilitli mi?<\/li>\n Credential ge\u00e7erli mi?<\/li>\n<\/ul>\n kontrol eder.\n<\/li>\n 3\ufe0f\u20e3.2\ufe0f\u20e3 Conditional OTP<\/em><\/strong> \nType : CONDITIONAL<\/span><\/p>\n Bu ad\u0131m do\u011frudan do\u011frulama yapmamakta sadece karar vermektedir.<\/p>\n \u015eart \u015fudur: Kullan\u0131c\u0131n\u0131n OTP’si aktif mi? E\u011fer bu \u015fart false ise kullan\u0131c\u0131n\u0131n OTP’si pasif oldu\u011fu anla\u015f\u0131lacak ve dolay\u0131s\u0131yla herhangi bir alt ad\u0131m devreye girmeyecektir. Yok e\u011fer \u015fart true ise i\u015fte o taktirde OTP Form execution’\u0131 devreye girecektir.<\/p>\n \n 3\ufe0f\u20e3.2\ufe0f\u20e3.1\ufe0f\u20e3 OTP Form<\/em><\/strong> \nType : REQUIRED<\/span><\/p>\n Ne yapar?<\/u><\/em><\/p>\n \n Kullan\u0131c\u0131dan OTP ister.<\/li>\n Yanl\u0131\u015fsa login biter!<\/li>\n Do\u011fruysa devam eder.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n Peki bu flow ne zaman authentication’\u0131 bitirecek?<\/strong> \nAsl\u0131nda a\u015fikar… Ak\u0131\u015fta; Cookie veya Kerberos veya Username Password (+ gerekirse OTP) ba\u015far\u0131l\u0131 oldu\u011fu taktirde authentication ba\u015far\u0131l\u0131 kabul edilecek, token \u00fcretilecek ve session olu\u015fturulacakt\u0131r.<\/p>\n T\u00fcm ak\u0131\u015f\u0131 tek par\u00e7a halinde seyredebilmek i\u00e7in buyurun;<\/p>\n \nBrowser Flow \n \u251c\u2500 Cookie (ALTERNATIVE) \n \u2502 \u2514\u2500 SUCCESS \u2192 LOGIN OK \n \u2502 \n \u251c\u2500 Kerberos (ALTERNATIVE) \n \u2502 \u2514\u2500 SUCCESS \u2192 LOGIN OK \n \u2502 \n \u2514\u2500 Username Password Form (ALTERNATIVE) \n \u251c\u2500 Username Password (REQUIRED) \n \u2502 \u2514\u2500 FAIL \u2192 LOGIN FAIL \n \u2502 \n \u2514\u2500 Conditional OTP \n \u251c\u2500 OTP aktif mi? \n \u2502 \n \u251c\u2500 NO \u2192 DEVAM \n \u2514\u2500 YES \n \u2514\u2500 OTP Form (REQUIRED) \n \u2514\u2500 FAIL \u2192 LOGIN FAIL\n<\/div>\n Evet… Bu \u00f6rnek sayesinde execution’lar\u0131n daha anla\u015f\u0131l\u0131r oldu\u011funu d\u00fc\u015f\u00fcn\u00fcyorum.<\/p>\n Nihai olarak;<\/p>\n Bu i\u00e7eri\u011fimizde, Keycloak’daki Authentication Flow yap\u0131s\u0131n\u0131 teorik olarak tam teferruatl\u0131 incelemi\u015f bulunuyoruz. Bundan sonraki i\u00e7eriklerimizde bu makalede de\u011ferlendirdi\u011fimiz her bir ak\u0131\u015fa ayr\u0131 ayr\u0131 odaklanacak ve Asp.NET Core \u00fczerinden m\u00fcmk\u00fcn mertebe pratiksel olarak \u00f6rneklendirmeye \u00e7al\u0131\u015f\u0131yor olaca\u011f\u0131z. O halde heyecanla sonraki yaz\u0131larda g\u00f6r\u00fc\u015fmek \u00fczere diyelim ve i\u00e7eri\u011fimizi burada nihayetlendirelim…<\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n","protected":false},"excerpt":{"rendered":" Merhaba, Modern kimlik ve eri\u015fim y\u00f6netimi (IAM) \u00e7\u00f6z\u00fcmlerinde kullan\u0131c\u0131y\u0131 do\u011frulamak art\u0131k tek ba\u015f\u0131na yeterli de\u011fildir. Do\u011frulaman\u0131n hangi ba\u011flamda, hangi ad\u0131mlarla ve hangi ko\u015fullara ba\u011fl\u0131 olarak ger\u00e7ekle\u015fti\u011fi en az sonucun kendisi kadar kritik arz etmektedir....<\/p>\n","protected":false},"author":1,"featured_media":28235,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5206,5554],"tags":[100,2759,5614,5620,5625,5615,5627,5617,5631,5616,1454,5624,5630,5626,5621,5622,5623,5555,5628,5629,5618,5619],"class_list":["post-28363","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-net","category-keycloak","tag-identity","tag-authentication","tag-authentication-flow","tag-authentication-nedir","tag-broker","tag-browser-flow","tag-client-auth-flow","tag-conditional-flow","tag-conditional-flowlar","tag-direct-grant-flow","tag-execution","tag-federation","tag-first-broker-login","tag-identity-brokering","tag-identity-nedir","tag-identity-provider","tag-idp","tag-keycloak","tag-registration-flow","tag-reset-credentials","tag-service-provider-interface","tag-spi"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=28363"}],"version-history":[{"count":17,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28363\/revisions"}],"predecessor-version":[{"id":28384,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28363\/revisions\/28384"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/28235"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=28363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=28363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=28363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

<\/div>\n

Merhaba,
\n
\nModern kimlik ve eri\u015fim y\u00f6netimi (IAM) \u00e7\u00f6z\u00fcmlerinde kullan\u0131c\u0131y\u0131 do\u011frulamak art\u0131k tek ba\u015f\u0131na yeterli de\u011fildir. Do\u011frulaman\u0131n hangi ba\u011flamda, hangi ad\u0131mlarla ve hangi ko\u015fullara ba\u011fl\u0131 olarak ger\u00e7ekle\u015fti\u011fi en az sonucun kendisi kadar kritik arz etmektedir. Keycloak’\u0131n en g\u00fc\u00e7l\u00fc bile\u015fenlerinden biri olan Authentication Flow<\/em> yap\u0131s\u0131, tam da bu noktada devreye girerek kimlik do\u011frulama s\u00fcrecini esnek, ko\u015fullu ve geni\u015fletilebilir bir mimariye d\u00f6n\u00fc\u015ft\u00fcrmektedir. Bizler bu i\u00e7eri\u011fimizde; Authentication Flow<\/em> kavram\u0131n\u0131n neyi ifade etti\u011finden ba\u015flayarak Browser Flow<\/em> ile Direct Grant Flow<\/em> aras\u0131ndaki temel farklara de\u011finecek, bir flow’un yap\u0131 ta\u015flar\u0131n\u0131 olu\u015fturan Execution<\/em>‘lar\u0131n nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 de\u011ferlendirecek ve Conditional Flow<\/em> mant\u0131\u011f\u0131yla dinamik do\u011frulama senaryolar\u0131n\u0131n nas\u0131l kurguland\u0131\u011f\u0131n\u0131 inceleyece\u011fiz. B\u00f6ylece nihai olarak Keycloak’\u0131n sundu\u011fu Service Provider Interface (SPI)<\/em> mekanizmas\u0131 ile tamamen \u00f6zel authentication flow’lar\u0131n nas\u0131l geli\u015ftirilebilece\u011fini teoride derinlemesine ele alm\u0131\u015f ve sonraki i\u00e7eriklerde deneyimleyece\u011fimiz pratik dokunu\u015flara bir zemin haz\u0131rlam\u0131\u015f olaca\u011f\u0131z. O halde haz\u0131rsan\u0131z ba\u015flayal\u0131m…<\/p>\n

\n
\n
Ba\u015fl\u0131klar<\/p>\nToggle<\/span>
Authentication Nedir?<\/a><\/li>
Identity Nedir?<\/a>
Peki Identity Provider (IdP) nedir?<\/a><\/li>
Identity’de ‘Federation’ ve ‘Broker’ Ne Demektir?<\/a><\/li><\/ul><\/li>
Authentication Flow Nedir?<\/a><\/li>
Keycloak’ta Flow T\u00fcrleri Nelerdir?<\/a><\/li>
Execution Nedir?<\/a>
Execution Type’lar<\/a><\/li>
Browser Authentication Flow’u Execution’lar\u0131na B\u00f6lelim<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n
<\/span>Authentication Nedir?<\/span><\/h4>\n
Authentication, “bu kullan\u0131c\u0131 ger\u00e7ekten s\u00f6yledi\u011fi ki\u015fi mi?” sorusuna verilen cevapt\u0131r…<\/em><\/p><\/blockquote>\n
Yolda y\u00fcr\u00fcyorsun… Polis durdurdu: Kimli\u011fini ver<\/em> dedi… Burada kimlik, bir do\u011frulama arac\u0131yken, polisin yapt\u0131\u011f\u0131 ise authentication’d\u0131r. Benzer mant\u0131kla, bankamati\u011fe kart\u0131 soktun ve \u015fifreyi girdin… Banka diyor ki: Bu kart ve bu \u015fifre… evet bu sensin…<\/em> Bu da bir authentication durumudur. Yaz\u0131l\u0131m d\u00fcnyas\u0131nda da authentication ayn\u0131 mant\u0131kla seyretmektedir. Bilgisayar; senin y\u00fcz\u00fcn\u00fc bilmez, sesini tan\u0131maz. Haliyle bir API’yi kullanabilmen i\u00e7in senden bir do\u011frulama kan\u0131t\u0131 ister. Bu kan\u0131t; kullan\u0131c\u0131 ad\u0131 + \u015fifre olabilir, telefona gelen kod olabilir, Google hesab\u0131n olabilir, parmak izi yahut herhangi bir sertifika olabilir… Evet, bunlar\u0131n her biri yaz\u0131l\u0131m a\u00e7\u0131s\u0131ndan birer authentication davran\u0131\u015flar\u0131d\u0131r. Sadece hangi y\u00f6ntemle do\u011frulaman\u0131n yap\u0131laca\u011f\u0131 Authentication Flow<\/em> ile belirlenir…<\/p>\n
Yani bir yaz\u0131l\u0131m a\u00e7\u0131s\u0131ndan authentication, ama\u00e7 olarak kullan\u0131c\u0131 do\u011frulamak olsa da, s\u00fcre\u00e7 olarak; kullan\u0131c\u0131n\u0131n hangi y\u00f6ntemle do\u011fruland\u0131\u011f\u0131n\u0131, bu do\u011frulama s\u00fcrecinde hangi ad\u0131mlar\u0131n (\u015fifre mi, OTP mi, SMS mi, captcha m\u0131 vs.) izlendi\u011fini ve bu ad\u0131mlar\u0131n hangi s\u0131rayla ve hangi \u015fartlarla \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 belirleyen bir ak\u0131\u015fa (flow) ya da bir ba\u015fka deyi\u015fle davran\u0131\u015fa sahip olan bir s\u00fcre\u00e7tir.<\/p>\n
<\/span>Identity Nedir?<\/span><\/h4>\n
Identity, “bu herif kim?” sorusunun cevab\u0131d\u0131r…<\/em><\/p><\/blockquote>\n
Identity, sistemin tan\u0131d\u0131\u011f\u0131 bir kullan\u0131c\u0131n\u0131n kim oldu\u011funu ifade eder. Ama dikkat ediniz!!! Hen\u00fcz do\u011frulanm\u0131\u015f olmay\u0131 de\u011fil, tan\u0131ml\u0131 olmay\u0131 ifade etmektedir. Bir identity’nin ger\u00e7ekten o kullan\u0131c\u0131 olup olmamas\u0131n\u0131n do\u011frulanma s\u00fcreci ise authentication’d\u0131r.<\/p>\n
Davran\u0131\u015fsal olarak authentication, identity’den \u00f6nce de\u011fil mi?<\/strong>
\nDavran\u0131\u015fsal olarak evet, authentication identity’den \u00f6nce gibi g\u00f6r\u00fcn\u00fcr, ancak kavramsal olarak identity daha \u00f6nceliklidir!<\/p>\n
Burada ak\u0131\u015fa bakmakta fayda vard\u0131r… \u015e\u00f6yle ki;<\/p>\n
\n
Kullan\u0131c\u0131 gelir<\/li>\n
Kullan\u0131c\u0131 ad\u0131 ve \u015fifreyi g\u00f6nderir<\/li>\n
Sistem do\u011frular<\/li>\n
Sonra ‘bu X ki\u015fisiymi\u015f’ der<\/li>\n<\/ol>\n
Bu ak\u0131\u015f insana \u00f6nce authentication oldu, sonra identity bulundu hissiyat\u0131 verecektir. Ama bu sadece alg\u0131sald\u0131r. Halbuki identity zaten vard\u0131r! \u00c7\u00fcnk\u00fc authentication bir identity olu\u015fturmamakta, icat etmemektedir. Sadece verilen credential bilgileri do\u011frultusunda mevcut bir identity ile e\u015fle\u015ftirme sa\u011flamaktad\u0131r.<\/p>\n
Yani bat\u0131ni boyutta ger\u00e7ek = Credential \u2192 Identity lookup \u2192 Do\u011frulama \u2192 Kabul<\/em> mant\u0131\u011f\u0131nda seyretmektedir.<\/p>\n
Authentication, identity’nin varl\u0131\u011f\u0131n\u0131 varsayarak \u00e7al\u0131\u015f\u0131r.<\/em><\/p><\/blockquote>\n
Bunu daha da netle\u015ftirebilmek i\u00e7in \u015f\u00f6yle g\u00fczel bir \u00f6rnek verebiliriz :<\/p>\n
\n
Kullan\u0131c\u0131 username ve password’\u00fc girer<\/li>\n
Keycloak \u015funu yapar:\n
\n
“Bu username’e kar\u015f\u0131l\u0131k gelen identity var m\u0131?” diye sorar<\/li>\n
Varsa \u015fifreyi do\u011frular<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Haliyle esas buyken bizler s\u00fcreci d\u0131\u015far\u0131dan sanki; kullan\u0131c\u0131n\u0131n kendini kan\u0131tlama \u00e7al\u0131\u015fmas\u0131 (authentication) neticesinde, sistemin sonucu identity olarak a\u00e7\u0131klamas\u0131 olarak alg\u0131l\u0131yoruz. Yani yan\u0131l\u0131yoruz \ud83d\ude42<\/p>\n
<\/span>Peki Identity Provider (IdP) nedir?<\/span><\/h5>\n
Kullan\u0131c\u0131y\u0131 tan\u0131tan yerin ta kendisidir. Yani ilgili kullan\u0131c\u0131n\u0131n kimli\u011fini kim onayl\u0131yorsa o identity provider’d\u0131r. \u00d6rnek olarak; Google hesab\u0131yla bir sisteme giriyorsan\u0131z e\u011fer o noktada Google identity provider’\u0131 kullan\u0131yorsunuz demektir, yok e\u011fer \u015firket i\u00e7i Active Directory ile ya da LDAP sayesinde giri\u015fte bulunuyorsan\u0131z identity provider’\u0131n\u0131z bunlard\u0131r demektir.<\/p>\n
Ee peki ba\u015fka bir Keycloak sistemi \u00fczerinden do\u011frulama yap\u0131labilir mi?<\/strong><\/p>\n
Evet, bir sistem Keycloak kullans\u0131n ya da kullanmas\u0131n ba\u015fka bir Keycloak kullanan sistem \u00fczerinden giri\u015fe izin verebilir. \u0130\u015fte bu taktirde o sistemde de identity provider Keycloak olacakt\u0131r.<\/p>\n
Yani identity provider;<\/p>\n
\n
Kullan\u0131c\u0131 kimli\u011fini do\u011frular.<\/li>\n
Do\u011frulama ba\u015far\u0131l\u0131ysa bu kimli\u011fi temsil eden bir \u00e7\u0131kt\u0131 \u00fcretir. Bu \u00e7\u0131kt\u0131 genelde JWT, SAML Assertion gibi token ya da do\u011frulanm\u0131\u015f identity claim’leri olabilir.<\/li>\n
Bu \u00e7\u0131kt\u0131y\u0131 ba\u015fka sistemlerin g\u00fcvenle kullanmas\u0131n\u0131 sa\u011flar.<\/li>\n<\/ul>\n
Identity Provider (IdP), authentication sorumlulu\u011funu \u00fcstlenen ve bu i\u015flem neticesinde bir identity \u00fcretip bunu ba\u015fkalar\u0131na kan\u0131tlanabilir bir \u015fekilde sunan sistemdir.<\/em><\/p><\/blockquote>\n
Keycloak, Azure Active Directory (Azure AD \/ Entra ID), Google, Facebook, GitHub vs. yayg\u0131n olarak kullan\u0131lan identity provider \u00f6rnekleridir…<\/p>\n
<\/span>Identity’de ‘Federation’ ve ‘Broker’ Ne Demektir?<\/span><\/h5>\n
Identity d\u00fcnyas\u0131nda tek bir kimlik kayna\u011f\u0131na ba\u011fl\u0131 kalmamak gibi bir problem vard\u0131r. Federation ve Broker, bu problemi iki farkl\u0131 mimari yakla\u015f\u0131m\u0131yla \u00e7\u00f6zmektedir.<\/p>\n
\n
Federation (Kimlik Federasyonu) Nedir?<\/strong><\/em>
\n
Federation, farkl\u0131 organizasyonlar \/ domain’ler aras\u0131nda kimlik payla\u015f\u0131m\u0131n\u0131 m\u00fcmk\u00fcn k\u0131lmak i\u00e7indir…<\/em><\/p><\/blockquote>\n
Keycloak’un kullan\u0131c\u0131y\u0131 kendi veritaban\u0131nda tutmad\u0131\u011f\u0131 do\u011frudan harici bir user store \u00fczerinden do\u011frulad\u0131\u011f\u0131 senaryolarda kullan\u0131l\u0131r. Bu mimaride Keycloak, kimlik do\u011frulama sorumlulu\u011funu d\u0131\u015f sisteme devreder ve kullan\u0131c\u0131 bilgileri harici sistemde authoritative kabul edilir.<\/p>\n
LDAP, Active Directory ve Kerberos tipik federation kaynaklar\u0131d\u0131r.<\/p>\n
Ak\u0131\u015f mant\u0131\u011f\u0131<\/u><\/p>\n
\n
Kullan\u0131c\u0131 kullan\u0131c\u0131 ad\u0131 ve \u015fifre g\u00f6nderir<\/li>\n
Keycloak bu bilgileri LDAP veya Active Directory’e iletir<\/li>\n
Do\u011frulama ger\u00e7ekle\u015ftirilir<\/li>\n
Keycloak bir token \u00fcretir<\/li>\n<\/ol>\n
Dikkat ederseniz burada, kimlik do\u011frulama yetkisi Keycloak’ta de\u011fil, d\u0131\u015f sistemdedir, ancak token yine Keycloak taraf\u0131ndan \u00fcretilmektedir.<\/p>\n
Kritik nokta \u015fudur ki; bu senaryoda Keycloak bir identity provider olarak de\u011fil de identity gateway \/ proxy gibi davran\u0131\u015f sergilemektedir.\n<\/li>\n
Broker (Identity Brokering) Nedir?<\/strong><\/em>
\nKeycloak’un kendi kullan\u0131c\u0131 havuzuna sahip oldu\u011fu ama kullan\u0131c\u0131y\u0131 ba\u015fka bir IdP’ye y\u00f6nlendirerek do\u011frulatt\u0131\u011f\u0131 senaryolar i\u00e7in uygun olan bir mimaridir.<\/p>\n
Google, Azure AD, GitHub ya da ba\u015fka bir Keycloak vs. bizler i\u00e7in g\u00fcncel birer broker kaynaklar\u0131d\u0131r…<\/p>\n
Ak\u0131\u015f mant\u0131\u011f\u0131<\/u><\/p>\n
\n
Kullan\u0131c\u0131 login ister<\/li>\n
Keycloak:\n
\n
“Bu kullan\u0131c\u0131y\u0131 ben do\u011frulamayaca\u011f\u0131m” der<\/li>\n
Ve harici IdP’ye y\u00f6nlendirir<\/li>\n<\/ul>\n<\/li>\n
Harici IdP:\n
\n
Kullan\u0131c\u0131y\u0131 do\u011frular<\/li>\n
Bir assertion \/ id_token d\u00f6ner<\/li>\n<\/ul>\n<\/li>\n
Keycloak:\n
\n
Bu sonucu kabul eder<\/li>\n
Kendi realm’inde kullan\u0131c\u0131y\u0131 olu\u015fturur ve e\u015fler<\/li>\n
Kendi token’\u0131n\u0131 \u00fcretir<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
Evet, bu yakla\u015f\u0131mda da dikkat ederseniz kimlik ba\u015fka IdP’de do\u011frulan\u0131rken; token olu\u015fturma ise Keycloak taraf\u0131ndan ger\u00e7ekle\u015ftirilmektedir.\n<\/li>\n<\/ul>\n
<\/span>Authentication Flow Nedir?<\/span><\/h4>\n
Authentication Flow, sisteme girmek isteyen bir kullan\u0131c\u0131n\u0131n ger\u00e7ekten kim oldu\u011funu kan\u0131tlamas\u0131 i\u00e7in izlenen ad\u0131mlar zinciridir…<\/em><\/p><\/blockquote>\n
Authentication Flow, bir kullan\u0131c\u0131 kimli\u011finin do\u011frulanmas\u0131 i\u00e7in hangi ad\u0131mlar\u0131n, hangi s\u0131rayla ve hangi ko\u015fularda \u00e7al\u0131\u015faca\u011f\u0131n\u0131 tan\u0131mlayan ak\u0131\u015ft\u0131r.<\/p>\n
Authentication Flow neyi \u00e7\u00f6zer?<\/strong>
\nAuthentication Flow esas\u0131nda \u015fu sorular\u0131n cevab\u0131n\u0131 belirler;<\/p>\n
\n
Kimlik do\u011frulama nas\u0131l ba\u015flayacak?<\/li>\n
Hangi kontroller yap\u0131lacak?<\/li>\n
Hangi s\u0131rayla yap\u0131lacak?<\/li>\n
Bir ad\u0131m ba\u015far\u0131s\u0131z olursa ne olacak?<\/li>\n
Ko\u015fula ba\u011fl\u0131 (conditional) ad\u0131mlar olacak m\u0131?<\/li>\n<\/ul>\n
Yani anlayaca\u011f\u0131n\u0131z, kullan\u0131c\u0131 authentication olurken sistem taraf\u0131ndan “\u015fifre mi soray\u0131m, OTP mi isteyeyim, cihaz g\u00fcvenilir mi de\u011fil mi ona m\u0131 bakay\u0131m, captcha m\u0131 koyay\u0131m, ne halt edeyim?”<\/em> tarz\u0131 durumlar\u0131n hepsi flow’un konusudur.<\/p>\n
Teoride olaya bakt\u0131\u011f\u0131m\u0131zda authentication flow, bir state machine<\/a> gibi davran\u0131\u015f sergileme durumudur. \u00c7\u00fcnk\u00fc, ak\u0131\u015f s\u00fcrecinin her bir ad\u0131m\u0131 bir execution’d\u0131r (yani do\u011frulama kural\u0131d\u0131r)<\/span> ve her execution; required, alternative, optional ve conditional olabilmektedir. Bunlar\u0131 yaz\u0131m\u0131z\u0131n sonraki sat\u0131rlar\u0131nda masaya yat\u0131racak olsak da \u015fimdilik buradan anlamam\u0131z gereken, her ad\u0131m\u0131n zorunlulu\u011fu ve davran\u0131\u015f\u0131 \u00f6nceden belirli olmas\u0131d\u0131r.<\/p>\n
<\/span>Keycloak’ta Flow T\u00fcrleri Nelerdir?<\/span><\/h4>\n\n\n\n\n\n\n\n\n\n
Flow T\u00fcr\u00fc<\/th>\n A\u00e7\u0131klama<\/th>\n Kullan\u0131ld\u0131\u011f\u0131 Yerler<\/th>\n G\u00fcnl\u00fck Hayattan \u00d6rnekler<\/th>\n Keycloak Kar\u015f\u0131l\u0131\u011f\u0131<\/th>\n<\/tr>\n
Browser Flow<\/td>\n \n Taray\u0131c\u0131 (browser) tabanl\u0131 etkile\u015fimli giri\u015f ak\u0131\u015flar\u0131.\n <\/td>\n \n \u25aa\ufe0fWeb uygulamalar\u0131 login ekranlar\u0131
\n \u25aa\ufe0fSSO (Single Sign-On) senaryolar\u0131
\n \u25aa\ufe0fMFA \/ OTP \/ Captcha gibi etkile\u015fimli ad\u0131mlar
\n \u25aa\ufe0fIdentity Provider (Google, Azure AD, e-Devlet) ile login durumlar\u0131\n <\/td>\n \n \u25aa\ufe0f\u0130nteraktif Vergi Dairesi’ne e-Devlet \u00fczerinden login olma.
\n \u25aa\ufe0fMHRS’ye e-Devlet \u00fczerinden giri\u015f yapma.\n <\/td>\n browser<\/td>\n<\/tr>\n
Direct Grant Flow<\/td>\n \n Kullan\u0131c\u0131 ad\u0131 ve \u015fifre ile do\u011frudan token alma.<\/p>\n
Sessiz \u00e7al\u0131\u015f\u0131r. Arka planda token \u00fcretir ve taray\u0131c\u0131ya gerek yoktur!<\/p>\n
\u26a0\ufe0fG\u00fcvenlik riski daha y\u00fcksektir! Modern OAuth d\u00fcnyas\u0131nda pek \u00f6nerilmemektedir!\n <\/td>\n
\n \u25aa\ufe0fRedirect olmadan token al\u0131naca\u011f\u0131 durumlar
\n \u25aa\ufe0fAPI, backend ve script tabanl\u0131 login durumlar\u0131
\n \u25aa\ufe0fPublic \/ Confidential client’lar\u0131
\n \u25aa\ufe0fMFA ve OTP olmaks\u0131z\u0131n do\u011frulama durumlar\u0131\n <\/td>\n \n Mobil uygulamas\u0131n\u0131n kullan\u0131c\u0131 ad\u0131 ve \u015fifreyi do\u011frudan bankan\u0131n sistemine g\u00f6nderip arka planda do\u011frulamas\u0131 ve token almas\u0131.\n <\/td>\n direct grant<\/td>\n<\/tr>\n
Client Auth Flow<\/td>\n \n Client’\u0131n kendisini do\u011frulamas\u0131.<\/p>\n
Kullan\u0131c\u0131 yoktur. Dolay\u0131s\u0131yla do\u011frulanan kullan\u0131c\u0131 de\u011fil uygulaman\u0131n ta kendisidir.\n <\/td>\n
\n \u25aa\ufe0fClient’\u0131n kendini do\u011frulamak zorunda oldu\u011fu durumlar
\n \u25aa\ufe0fMachine-to-Machine (M2M) senaryolar\u0131
\n \u25aa\ufe0fConfidential client’lar
\n \u25aa\ufe0fRefresh token\n <\/td>\n \n Bir bankan\u0131n muhasebe sisteminin, \u00e7al\u0131\u015fan olmaks\u0131z\u0131n, kendi kurum kimli\u011fiyle Gelir \u0130daresi sistemine ba\u011flan\u0131p otomatik bildirim g\u00f6ndermesi.\n <\/td>\n clients<\/td>\n<\/tr>\n
Registration Flow<\/td>\n \n Kullan\u0131c\u0131 kay\u0131t s\u00fcreci ad\u0131mlar\u0131.<\/p>\n
Yeni kullan\u0131c\u0131 kay\u0131t olurken hangi ad\u0131mlar izlenecek onu belirler.\n <\/td>\n
\n \u25aa\ufe0fRegistration endpoint
\n \u25aa\ufe0fE-posta do\u011frulamas\u0131 gereken kay\u0131t i\u015flemleri
\n \u25aa\ufe0fKay\u0131t s\u0131ras\u0131nda ek kontrol veya kural oldu\u011fu durumlar
\n \u25aa\ufe0fIdP sonraki ek kay\u0131t gerekti\u011fi durumlar\n <\/td>\n \n Bir belediyenin e-hizmet portal\u0131ndan ilk kez hesap olu\u015fturup e-posta do\u011frulamas\u0131 yaparak sisteme kay\u0131t olunmas\u0131.\n <\/td>\n registration<\/td>\n<\/tr>\n
Reset Credentials Flow<\/td>\n \n \u015eifre veya kimlik bilgisi s\u0131f\u0131rlama.\n <\/td>\n \n Yeni \u015fifre belirleme s\u00fcre\u00e7leri\n <\/td>\n \n \u015eifremi unuttum ak\u0131\u015f\u0131.\n <\/td>\n reset credentials<\/td>\n<\/tr>\n
First Broker Login Flow<\/td>\n \n Harici IdP sonras\u0131 ilk giri\u015f s\u00fcreci.<\/p>\n
Google, Azure AD, e-Devlet vs. gibi harici bir Identity Provider’dan ilk kez gelen kullan\u0131c\u0131 i\u00e7in \u00e7al\u0131\u015f\u0131r.<\/p>\n
\ud83d\udcccFederation \/ Broker senaryolar\u0131n\u0131n kalbidir.\n <\/td>\n
\n \u25aa\ufe0fHarici Identity Provider’dan d\u00f6n\u00fc\u015f yap\u0131ld\u0131\u011f\u0131 durumlar
\n \u25aa\ufe0fIdP’den gelen bilgiler yeterli olmad\u0131\u011f\u0131 durumlar
\n \u25aa\ufe0fIdP login sonras\u0131 politika uygulanaca\u011f\u0131 durumlar\n <\/td>\n \n \u25aa\ufe0fBir vatanda\u015f\u0131n bir belediyenin e-hizmet portal\u0131na ilk kez e-Devlet ile giri\u015f yapmas\u0131 ve sistemin bu ki\u015fiyi o anda kendi kay\u0131tlar\u0131na eklemesi.
\n \u25aa\ufe0fBir \u00f6\u011frencinin \u00fcniversite sistemine ilk kez e-Devlet\/Y\u00d6K do\u011frulamas\u0131yla girip otomatik \u00f6\u011frenci hesab\u0131n\u0131 a\u00e7mas\u0131.\n <\/td>\n first broker login<\/td>\n<\/tr>\n
Conditional Flow\u2019lar<\/td>\n \n Ko\u015fula ba\u011fl\u0131 authentication ak\u0131\u015flar\u0131.<\/p>\n
E\u011fer \u015fu \u015fart sa\u011flan\u0131yorsa, \u015fu ad\u0131m\u0131 \u00e7al\u0131\u015ft\u0131r mant\u0131\u011f\u0131nda ak\u0131\u015f sa\u011flar.\n <\/td>\n
\n \u25aa\ufe0fAuthentication Flow i\u00e7inde ko\u015ful de\u011ferlendirmesi gereken her yer
\n \u25aa\ufe0fKullan\u0131c\u0131ya g\u00f6re farkl\u0131 ad\u0131mlar \u00e7al\u0131\u015ft\u0131r\u0131laca\u011f\u0131 durumlar
\n \u25aa\ufe0fOrtama \/ ba\u011flama g\u00f6re karar verilen senaryolar\u0131
\n \u25aa\ufe0fRisk bazl\u0131 do\u011frulama senaryolar\u0131nda
\n \u25aa\ufe0fAyn\u0131 flow i\u00e7inde farkl\u0131 login yollar\u0131 sunulacaksa\n <\/td>\n \n Role veya IP\u2019ye g\u00f6re ek do\u011frulama.\n <\/td>\n <\/td>\n<\/tr>\n<\/table>\n
<\/span>Execution Nedir?<\/span><\/h4>\n
Authentication Flow, i\u00e7erisinde ad\u0131mlardan olu\u015fan bir ak\u0131\u015ftan ibarettir ve her bir ad\u0131m \u00f6nceden; \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmayaca\u011f\u0131, ba\u015far\u0131s\u0131z olursa ne olaca\u011f\u0131, alternatif olup olmad\u0131\u011f\u0131 vs. gibi durumlara kar\u015f\u0131n hali haz\u0131rda tan\u0131mlanm\u0131\u015f davran\u0131\u015fa sahiptir. \u0130\u015fte bizler bu do\u011frulama kurallar\u0131n\u0131n oldu\u011fu ad\u0131mlar\u0131n her birine Execution diyoruz.<\/p>\n
Execution, authentication s\u0131ras\u0131nda \u00e7al\u0131\u015fan tek bir do\u011frulama kural\u0131d\u0131r. Flow ise execution’lar\u0131n s\u0131ral\u0131 \u00e7al\u0131\u015ft\u0131\u011f\u0131 bir yap\u0131d\u0131r.<\/em><\/p><\/blockquote>\n
<\/span>Execution Type’lar<\/span><\/h5>\n
Execution’lar sergiledikleri davran\u0131\u015flar\u0131n t\u00fcr\u00fcne g\u00f6re required, alternative, optional ve conditional olmak \u00fczere d\u00f6rde ayr\u0131lmaktad\u0131rlar. \u015eimdi gelin bu execution tiplerini tek tek masaya yat\u0131ral\u0131m;<\/p>\n
\n
REQUIRED<\/em><\/strong>
\nRequired olarak tan\u0131mlanm\u0131\u015f olan ad\u0131m, ad\u0131 \u00fczerinde, mutlaka \u00e7al\u0131\u015fmal\u0131 ve ba\u015far\u0131l\u0131 olmal\u0131. Genellikle username ve password do\u011frulama s\u00fcre\u00e7lerinde veyahut zorunlu OTP kullan\u0131lan senaryolarda tercih edilir.\n<\/li>\n
ALTERNATIVE<\/em><\/strong>
\nAyn\u0131 seviyede birden fazla execution’\u0131n oldu\u011fu senaryoyu ifade etmektedir. Aralar\u0131nda ‘veya’ mant\u0131\u011f\u0131 s\u00f6z konusudur. Ad\u0131 \u00fczerinde \ud83d\ude42 alternatif… Haliyle bir tanesinin ba\u015far\u0131l\u0131 olmas\u0131 flow’un devam etmesi i\u00e7in yeterlidir.\n<\/li>\n
OPTIONAL<\/em><\/strong>
\nBu execution ba\u015far\u0131l\u0131 olsa da olmasa da \u00e7al\u0131\u015facak ancak flow’u engellemeyecektir. Yani opsiyoneldir. Buna en g\u00fczel \u00f6rne\u011fi ‘Remember-me’yi verebiliriz \ud83d\ude09 Olsa da ak\u0131\u015f devam edecek, olmasa da…\n<\/li>\n
CONDITIONAL<\/em><\/strong>
\nBu execution ise \u015farta g\u00f6re i\u015flevsellik g\u00f6sterecektir. Yani bir do\u011frulamadan ziyade, karar mekanizmas\u0131 gibi davran\u0131\u015f sergilemektedir. Misal olarak; kullan\u0131c\u0131n\u0131n OTP’si aktif mi?, client public mi? IP trusted m\u0131? vs. gibi \u015fartlar \u00f6rnek g\u00f6sterilebilir.\n<\/li>\n<\/ul>\n
\u015eimdi bu execution’lar\u0131 ak\u0131llarda daha da netle\u015ftirebilmek i\u00e7in Keycloak \u00e7er\u00e7evesinde Browser Authentication Flow<\/em>‘u ad\u0131m ad\u0131m (execution execution) teoride par\u00e7alayal\u0131m ve b\u00f6ylece s\u00fcre\u00e7te yap\u0131y\u0131 g\u00f6zlemlemeye \u00e7al\u0131\u015fal\u0131m.<\/p>\n
<\/span>Browser Authentication Flow’u Execution’lar\u0131na B\u00f6lelim<\/span><\/h5>\n
Browser flow, yukar\u0131daki sat\u0131rlarda inceledi\u011fimiz \u00fczere taray\u0131c\u0131dan gelen login’ler i\u00e7in \u00e7al\u0131\u015fan bir ak\u0131\u015ft\u0131r. \u015eimdi bu flow’un \u00fcst seviye \u015femas\u0131n\u0131 \u00e7\u0131kar\u0131rsak e\u011fer;<\/p>\n
\nBrowser Flow
\n\u251c\u2500 Cookie
\n\u251c\u2500 Kerberos (opsiyonel)
\n\u2514\u2500 Username Password Form
\n \u251c\u2500 Username Password
\n \u2514\u2500 Conditional OTP
\n \u2514\u2500 OTP Form\n<\/div>\n
G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere Browser flow, yukar\u0131daki execution’lar ile seyretmektedir. \u015eimdi gelin tek tek, hangi execution ne yap\u0131yor, neden var, ba\u015far\u0131s\u0131z olursa ne olur incelemeye ba\u015flayal\u0131m…<\/p>\n
\n
1\ufe0f\u20e3Cookie<\/em><\/strong>
\nType : ALTERNATIVE<\/span><\/p>\n
Ne yapar?<\/u><\/em><\/p>\n
\n
Taray\u0131c\u0131da \u00f6nceden ge\u00e7erli bir Keycloak oturumu (SSO cookie) var m\u0131 kontrol eder.<\/li>\n
Varsa hi\u00e7 kullan\u0131c\u0131 \u015fifre sormadan login ba\u015far\u0131l\u0131 say\u0131l\u0131r.<\/li>\n<\/ul>\n
Neden ALTERNATIVE’dir?<\/u><\/em>
\n\u00c7\u00fcnk\u00fc cookie varsa e\u011fer i\u015f bitmekte, yoksa di\u011fer alternatiflere ge\u00e7ilmektedir.<\/p>\n
Bu ad\u0131m ba\u015far\u0131s\u0131z olsa bile login bitmeyecektir!\n<\/li>\n
2\ufe0f\u20e3 Kerberos (SPNEGO)<\/em><\/strong>
\nType : ALTERNATIVE<\/span><\/p>\n
Ne yapar?<\/u><\/em>
\nKurumsal ortamda (AD \/ Kerberos) taray\u0131c\u0131 domain’e login mi diye bakar.<\/p>\n
\u00c7o\u011fu sistemde disable edilmektedir.\n<\/li>\n
3\ufe0f\u20e3 Username Password Form<\/em><\/strong>
\n\u0130\u015fin klasik login k\u0131sm\u0131 burada ba\u015flamaktad\u0131r! Esas\u0131nda bu bir execution de\u011fildir! SUB-FLOW’dur! Yani alt\u0131nda a\u015fa\u011f\u0131daki execution’lar mevcuttur;<\/p>\n
\nUsername Password Form
\n \u251c\u2500 Username Password
\n \u2514\u2500 Conditional OTP
\n \u2514\u2500 OTP Form\n<\/div>\n
\n
3\ufe0f\u20e3.1\ufe0f\u20e3 Username Password<\/em><\/strong>
\nType : REQUIRED<\/span><\/p>\n
Ne yapar?<\/u><\/em><\/p>\n
\n
Kullan\u0131c\u0131 var m\u0131?<\/li>\n
\u015eifre do\u011fru mu?<\/li>\n
Hesap kilitli mi?<\/li>\n
Credential ge\u00e7erli mi?<\/li>\n<\/ul>\n
kontrol eder.\n<\/li>\n
3\ufe0f\u20e3.2\ufe0f\u20e3 Conditional OTP<\/em><\/strong>
\nType : CONDITIONAL<\/span><\/p>\n
Bu ad\u0131m do\u011frudan do\u011frulama yapmamakta sadece karar vermektedir.<\/p>\n
\u015eart \u015fudur: Kullan\u0131c\u0131n\u0131n OTP’si aktif mi? E\u011fer bu \u015fart false ise kullan\u0131c\u0131n\u0131n OTP’si pasif oldu\u011fu anla\u015f\u0131lacak ve dolay\u0131s\u0131yla herhangi bir alt ad\u0131m devreye girmeyecektir. Yok e\u011fer \u015fart true ise i\u015fte o taktirde OTP Form execution’\u0131 devreye girecektir.<\/p>\n
\n
3\ufe0f\u20e3.2\ufe0f\u20e3.1\ufe0f\u20e3 OTP Form<\/em><\/strong>
\nType : REQUIRED<\/span><\/p>\n
Ne yapar?<\/u><\/em><\/p>\n
\n
Kullan\u0131c\u0131dan OTP ister.<\/li>\n
Yanl\u0131\u015fsa login biter!<\/li>\n
Do\u011fruysa devam eder.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Peki bu flow ne zaman authentication’\u0131 bitirecek?<\/strong>
\nAsl\u0131nda a\u015fikar… Ak\u0131\u015fta; Cookie veya Kerberos veya Username Password (+ gerekirse OTP) ba\u015far\u0131l\u0131 oldu\u011fu taktirde authentication ba\u015far\u0131l\u0131 kabul edilecek, token \u00fcretilecek ve session olu\u015fturulacakt\u0131r.<\/p>\n
T\u00fcm ak\u0131\u015f\u0131 tek par\u00e7a halinde seyredebilmek i\u00e7in buyurun;<\/p>\n
\nBrowser Flow
\n \u251c\u2500 Cookie (ALTERNATIVE)
\n \u2502 \u2514\u2500 SUCCESS \u2192 LOGIN OK
\n \u2502
\n \u251c\u2500 Kerberos (ALTERNATIVE)
\n \u2502 \u2514\u2500 SUCCESS \u2192 LOGIN OK
\n \u2502
\n \u2514\u2500 Username Password Form (ALTERNATIVE)
\n \u251c\u2500 Username Password (REQUIRED)
\n \u2502 \u2514\u2500 FAIL \u2192 LOGIN FAIL
\n \u2502
\n \u2514\u2500 Conditional OTP
\n \u251c\u2500 OTP aktif mi?
\n \u2502
\n \u251c\u2500 NO \u2192 DEVAM
\n \u2514\u2500 YES
\n \u2514\u2500 OTP Form (REQUIRED)
\n \u2514\u2500 FAIL \u2192 LOGIN FAIL\n<\/div>\n
Evet… Bu \u00f6rnek sayesinde execution’lar\u0131n daha anla\u015f\u0131l\u0131r oldu\u011funu d\u00fc\u015f\u00fcn\u00fcyorum.<\/p>\n
Nihai olarak;<\/p>\n
Bu i\u00e7eri\u011fimizde, Keycloak’daki Authentication Flow yap\u0131s\u0131n\u0131 teorik olarak tam teferruatl\u0131 incelemi\u015f bulunuyoruz. Bundan sonraki i\u00e7eriklerimizde bu makalede de\u011ferlendirdi\u011fimiz her bir ak\u0131\u015fa ayr\u0131 ayr\u0131 odaklanacak ve Asp.NET Core \u00fczerinden m\u00fcmk\u00fcn mertebe pratiksel olarak \u00f6rneklendirmeye \u00e7al\u0131\u015f\u0131yor olaca\u011f\u0131z. O halde heyecanla sonraki yaz\u0131larda g\u00f6r\u00fc\u015fmek \u00fczere diyelim ve i\u00e7eri\u011fimizi burada nihayetlendirelim…<\/p>\n
\u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle…
\n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n","protected":false},"excerpt":{"rendered":"
Merhaba, Modern kimlik ve eri\u015fim y\u00f6netimi (IAM) \u00e7\u00f6z\u00fcmlerinde kullan\u0131c\u0131y\u0131 do\u011frulamak art\u0131k tek ba\u015f\u0131na yeterli de\u011fildir. Do\u011frulaman\u0131n hangi ba\u011flamda, hangi ad\u0131mlarla ve hangi ko\u015fullara ba\u011fl\u0131 olarak ger\u00e7ekle\u015fti\u011fi en az sonucun kendisi kadar kritik arz etmektedir....<\/p>\n","protected":false},"author":1,"featured_media":28235,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5206,5554],"tags":[100,2759,5614,5620,5625,5615,5627,5617,5631,5616,1454,5624,5630,5626,5621,5622,5623,5555,5628,5629,5618,5619],"class_list":["post-28363","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-net","category-keycloak","tag-identity","tag-authentication","tag-authentication-flow","tag-authentication-nedir","tag-broker","tag-browser-flow","tag-client-auth-flow","tag-conditional-flow","tag-conditional-flowlar","tag-direct-grant-flow","tag-execution","tag-federation","tag-first-broker-login","tag-identity-brokering","tag-identity-nedir","tag-identity-provider","tag-idp","tag-keycloak","tag-registration-flow","tag-reset-credentials","tag-service-provider-interface","tag-spi"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=28363"}],"version-history":[{"count":17,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28363\/revisions"}],"predecessor-version":[{"id":28384,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28363\/revisions\/28384"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/28235"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=28363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=28363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=28363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}