Diyelim ki, login ekran\u0131nda Google, GitHub ve Azure AD se\u00e7enekleri olan myapp.com domaininde bir uygulamam\u0131z olsun ve kullan\u0131c\u0131 Google \u00fczerinden login olmaya \u00e7al\u0131\u015fs\u0131n… S\u00fcre\u00e7 \u015f\u00f6yle cereyan edecektir:<\/p>\n

Her \u015feyden \u00f6nce Keycloak -bu kullan\u0131c\u0131 bende var m\u0131?-<\/em> sorusunu soracakt\u0131r… ve ald\u0131\u011f\u0131 cevaba g\u00f6re a\u015fa\u011f\u0131daki iki durum s\u00f6z konusu olacakt\u0131r.<\/p>\n

\n
\n Durum 1 \u2014 Kullan\u0131c\u0131 YOK (\u0130lk Giri\u015f)<\/span><\/p>\n
\n Bu senaryoda sistem, First Broker Login Flow<\/strong> s\u00fcrecini ba\u015flatacakt\u0131r ve kullan\u0131c\u0131n\u0131n sistemdeki durumuna g\u00f6re a\u015fa\u011f\u0131daki kararlar\u0131 verecektir:\n <\/p>\n
\n
Yeni kullan\u0131c\u0131 olu\u015fturulsun mu?<\/li>\n
Mevcut bir kullan\u0131c\u0131yla e\u015fle\u015ftirilsin mi?<\/li>\n
Email do\u011frulamas\u0131 gerekli mi?<\/li>\n
Kullan\u0131c\u0131dan ek bilgi istenmeli mi?<\/li>\n
Hesap linking i\u015flemi yap\u0131ls\u0131n m\u0131?<\/li>\n<\/ul><\/div>\n
\n Durum 2 \u2014 Kullan\u0131c\u0131 VAR<\/span><\/p>\n
\n Bu durumda First Broker Login Flow<\/strong> \u00e7al\u0131\u015fmayacak, bunun yerine Post Broker Login Flow<\/strong> devreye girecek ve kullan\u0131c\u0131 do\u011frudan giri\u015f yapacakt\u0131r.\n <\/p>\n<\/p><\/div>\n<\/div>\n
<\/span>First Broker Login Flow’un Amac\u0131 Nedir?<\/span><\/h4>\n
Keycloak’da first broker login flow, bir kullan\u0131c\u0131 harici bir kimlik sa\u011flay\u0131c\u0131dan ilk kez giri\u015f yapt\u0131\u011f\u0131nda devreye giren \u00f6zel bir kimlik do\u011frulama s\u00fcrecidir ve as\u0131l amac\u0131 bu harici kimli\u011fi Keycloak i\u00e7indeki yerel kullan\u0131c\u0131 hesaplar\u0131yla g\u00fcvenli ve tutarl\u0131 bir \u015fekilde ili\u015fkilendirmektir.<\/p>\n
Misal olarak kullan\u0131c\u0131, Google veya GitHub hesab\u0131yla giri\u015f yapt\u0131\u011f\u0131nda, Keycloak \u00f6nce bu kullan\u0131c\u0131n\u0131n sistemde zaten kay\u0131tl\u0131 olup olmad\u0131\u011f\u0131n\u0131 kontrol eder, e\u011fer ayn\u0131 e-posta adresiyle manuel olu\u015fturulmu\u015f bir hesap varsa kullan\u0131c\u0131dan bu hesaplar\u0131 birle\u015ftirmesi istenir. B\u00f6ylece ayn\u0131 ki\u015finin farkl\u0131 giri\u015f y\u00f6ntemleriyle birden fazla hesap olu\u015fturmas\u0131n\u0131n \u00f6n\u00fcne ge\u00e7ilmi\u015f olur. Yok e\u011fer kullan\u0131c\u0131 tamamen yeni ise o taktirde profil bilgileri g\u00f6zden ge\u00e7irilerek do\u011frudan yeni bir kullan\u0131c\u0131 kayd\u0131 olu\u015fturulur.<\/p>\n
Bu ak\u0131\u015f ayn\u0131 zamanda kurulu\u015flar\u0131n g\u00fcvenlik politikalar\u0131na uygun olarak ek do\u011frulama ad\u0131mlar\u0131 eklemesine de olanak tan\u0131maktad\u0131r. \u00d6rnek vermemiz gerekirse e\u011fer; ilk harici giri\u015fte iki fakt\u00f6rl\u00fc kimlik do\u011frulama veya e-posta do\u011frulamas\u0131 zorunlu k\u0131l\u0131nabilir.<\/p>\n
First broker login flow, bu ve bunlara benzer davran\u0131\u015flar\u0131 sergilememizi sa\u011flayarak \u00f6zellikle birden fazla ba\u011f\u0131ms\u0131z kimlik ve eri\u015fim y\u00f6netimi gerektiren federasyonel senaryolarda kullan\u0131c\u0131 deneyimini d\u00fczg\u00fcn bir \u015fekilde y\u00f6netmek, veri b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc korumak ve hesap ele ge\u00e7irme gibi g\u00fcvenlik risklerini minimize etmek i\u00e7in kritik \u00f6neme sahip bir mekanizmad\u0131r.<\/p>\n
<\/span>First Broker Login Flow’un \u0130\u00e7 Yap\u0131s\u0131<\/span><\/h4>\n
First broker login flow’un i\u00e7 yap\u0131s\u0131ndaki ak\u0131\u015f mant\u0131\u011f\u0131 a\u015fa\u011f\u0131daki gibidir:<\/p>\n
\nFirst Broker Login Flow
\n\u2502
\n\u251c\u2500\u2500 Review Profile
\n\u2502 \u2514\u2500\u2500 External IdP’den gelen kullan\u0131c\u0131 bilgilerinin g\u00f6zden ge\u00e7irilmesini sa\u011flar.
\n\u2502 (email, username, firstName, lastName)
\n\u2502 Eksik veya yanl\u0131\u015f bilgi varsa kullan\u0131c\u0131 d\u00fczeltir.
\n\u2502
\n\u251c\u2500\u2500 User creation or linking
\n\u2502 \u2502
\n\u2502 \u251c\u2500\u2500 Create User If Unique
\n\u2502 \u2502 \u2514\u2500\u2500 Keycloak’ta ayn\u0131 email veya username yoksa:
\n\u2502 \u2502 \u2192 Yeni bir Keycloak user olu\u015fturur.
\n\u2502 \u2502
\n\u2502 \u2514\u2500\u2500 Handle Existing Account
\n\u2502 \u2502
\n\u2502 \u251c\u2500\u2500 Confirm link existing account
\n\u2502 \u2502 \u2514\u2500\u2500 Ayn\u0131 email ile mevcut user varsa:
\n\u2502 \u2502 \u2192 Bu external identity mevcut hesaba ba\u011flans\u0131n m\u0131 diye sorar.
\n\u2502 \u2502
\n\u2502 \u2514\u2500\u2500 Account verification options
\n\u2502 \u2502
\n\u2502 \u251c\u2500\u2500 Verify existing account by Email
\n\u2502 \u2502 \u2514\u2500\u2500 Kullan\u0131c\u0131n\u0131n email adresine do\u011frulama maili g\u00f6nderir.
\n\u2502 \u2502 \u2192 Email sahibi ger\u00e7ekten bu kullan\u0131c\u0131 m\u0131 do\u011frulan\u0131r.
\n\u2502 \u2502
\n\u2502 \u2514\u2500\u2500 Verify Existing Account by Re-authentication
\n\u2502 \u2502
\n\u2502 \u2514\u2500\u2500 Username Password Form for identity provider reauthentication
\n\u2502 \u2514\u2500\u2500 Kullan\u0131c\u0131dan mevcut Keycloak hesab\u0131n\u0131n:
\n\u2502 \u2192 username
\n\u2502 \u2192 password
\n\u2502 girmesi istenir.
\n\u2502 Ama\u00e7: Hesap ger\u00e7ekten bu kullan\u0131c\u0131ya m\u0131 ait do\u011frulamak.
\n\u2502
\n\u2514\u2500\u2500 First broker login – Conditional 2FA
\n \u2502
\n \u251c\u2500\u2500 Condition \u2013 user configured
\n \u2502 \u2514\u2500\u2500 Kullan\u0131c\u0131n\u0131n 2FA yap\u0131land\u0131rmas\u0131 var m\u0131 kontrol eder.
\n \u2502
\n \u251c\u2500\u2500 Condition \u2013 credential
\n \u2502 \u2514\u2500\u2500 Kullan\u0131c\u0131n\u0131n OTP \/ WebAuthn credential’\u0131 var m\u0131 kontrol eder.
\n \u2502
\n \u251c\u2500\u2500 OTP Form
\n \u2502 \u2514\u2500\u2500 E\u011fer kullan\u0131c\u0131 OTP kullan\u0131yorsa:
\n \u2502 \u2192 Google Authenticator vb. kod ister.
\n \u2502
\n \u251c\u2500\u2500 WebAuthn Authenticator
\n \u2502 \u2514\u2500\u2500 E\u011fer kullan\u0131c\u0131 WebAuthn kullan\u0131yorsa:
\n \u2502 \u2192 Security key \/ biometrik do\u011frulama ister.
\n \u2502
\n \u2514\u2500\u2500 Recovery Authentication Code Form
\n \u2514\u2500\u2500 E\u011fer kullan\u0131c\u0131 recovery code kullan\u0131yorsa:
\n \u2192 recovery code girmesini ister.\n<\/div>\n
Dikkat ederseniz, her ad\u0131m\u0131n kendine has bir mimari g\u00f6revi mevcuttur. Her ne kadar yukar\u0131daki \u015fema gerekli a\u00e7\u0131klamalar\u0131 veriyor olsa da bizler a\u015fa\u011f\u0131da t\u00fcm ad\u0131mlar\u0131 k\u0131saca izah edelim:<\/p>\n
\n
Review Profile<\/em><\/strong> : External identity bilgisini normalize etmektedir.<\/li>\n
Create User If Unique<\/em><\/strong> : Yeni internal user olu\u015fturmaktad\u0131r.<\/li>\n
Handle Existing Account<\/em><\/strong> : External identity’yi existing user’a ba\u011flamaktad\u0131r.<\/li>\n
Verify existing account<\/em><\/strong> : Account takeover sald\u0131r\u0131s\u0131n\u0131 \u00f6nlemektedir.<\/li>\n
Re-authentication<\/em><\/strong> : Ger\u00e7ek kullan\u0131c\u0131 do\u011frulamas\u0131 yapmaktad\u0131r.<\/li>\n
Conditional 2FA<\/em><\/strong> : Ek g\u00fcvenlik katman\u0131 eklemektedir.<\/li>\n<\/ul>\n
<\/span>First Broker Login Flow’u Kullan\u0131rken Nelere Dikkat Edilmelidir?<\/span><\/h4>\n
First broker login flow, external identity<\/code> \u2192 internal user mapping<\/code> s\u00fcreci s\u00f6z konusu oldu\u011fundan Keycloak’ta en \u00e7ok yanl\u0131\u015f yap\u0131land\u0131r\u0131lan ve en \u00e7ok g\u00fcvenlik a\u00e7\u0131\u011f\u0131 olu\u015fturabilen flow’lardan birisidir. Ki yanl\u0131\u015f yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131 taktirde, kullan\u0131c\u0131 hesaplar\u0131n\u0131n ele ge\u00e7irilmesi s\u00f6z konusu olabilir! Bu a\u00e7\u0131dan olay\u0131 de\u011ferlendirdi\u011fimizde bu ak\u0131\u015fa dair dikkat edilmesi gereken kritik noktalar\u0131 ele almakta fayda g\u00f6rmekteyim:<\/p>\n
\n\n\n Account Takeover nedir?<\/em><\/strong> \nAccount takeover (ATO), bir sald\u0131rgan\u0131n bir kullan\u0131c\u0131 hesab\u0131na yetkisi olmad\u0131\u011f\u0131 halde eri\u015fim elde etmesi ve o kullan\u0131c\u0131 gibi hareket edebilmesidir. Yani sald\u0131rgan, ger\u00e7ek kullan\u0131c\u0131n\u0131n hesab\u0131n\u0131 ele ge\u00e7irir ve sistem a\u00e7\u0131s\u0131ndan art\u0131k ‘o ki\u015fi’ olarak kabul edilir.<\/p>\n\u00d6rne\u011fin; Keycloak’da ali@gmail.com<\/code> email’ine sahip bir kullan\u0131c\u0131n\u0131n zaten var oldu\u011funu d\u00fc\u015f\u00fcnelim. E\u011fer sald\u0131rgan ayn\u0131 email adresiyle bir Google hesab\u0131 olu\u015fturur ve Keycloak, hi\u00e7bir ek do\u011frulama yapmadan bu Google hesab\u0131n\u0131 mevcut Keycloak hesab\u0131na otomatik olarak link ederse, sald\u0131rgan ger\u00e7ek kullan\u0131c\u0131n\u0131n \u015fifresini bilmeden o hesaba eri\u015febilmi\u015f olacakt\u0131r. \u0130\u015fte bu durum account takeover olarak adland\u0131r\u0131lmaktad\u0131r.<\/p>\n Genel olarak account takeover \u015fu y\u00f6ntemlerle ger\u00e7ekle\u015ftirilir:<\/p>\n \n\u00c7al\u0131nm\u0131\u015f \u015fifreleri kullan\u0131lmas\u0131 (data breach sonras\u0131)<\/li>\n Phishing (sahte login sayfas\u0131yla \u015fifrenin \u00e7al\u0131nmas\u0131)<\/li>\n Zay\u0131f ve tekrar kullan\u0131lan \u015fifreler<\/li>\n Email adresinin ele ge\u00e7irilmesi yahut eri\u015fimin sa\u011flanmas\u0131<\/li>\n Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f authentication ve identity linking<\/li>\n<\/ul>\n<\/div>\nAccount Takeover riskine dikkat edilmelidir!<\/em><\/strong> \nKeycloak’ta first broker login flow s\u0131ras\u0131nda ‘ba\u011flant\u0131’ sa\u011flamak (ya da link etmek), Google gibi external bir Identity Provider’dan gelen kullan\u0131c\u0131 ile Keycloak’da zaten var olan bir kullan\u0131c\u0131 hesab\u0131n\u0131n ayn\u0131 ki\u015fiye ait olup olmad\u0131\u011f\u0131n\u0131n do\u011frulan\u0131p, ayn\u0131 ki\u015fi oldu\u011fu kan\u0131tland\u0131\u011f\u0131 taktirde bu iki kimli\u011fi birbirine ba\u011flama i\u015flemidir. Yani kullan\u0131c\u0131 daha \u00f6nce Keycloak’ta email ve \u015fifre ile olu\u015fturulmu\u015f bir hesaba sahipse ve sonradan Google ile login olmaya \u00e7al\u0131\u015f\u0131yorsa, Keycloak bu Google hesab\u0131n\u0131 otomatik olarak o mevcut hesaba ba\u011flamamaktad\u0131r! Bunun yerine kullan\u0131c\u0131dan email do\u011frulamas\u0131 yapmas\u0131n\u0131 veya mevcut hesab\u0131n\u0131n \u015fifresini girmesini isteyerek ger\u00e7ekten hesap sahibi oldu\u011funu kan\u0131tlamas\u0131n\u0131 istemektedir. Bu s\u00fcre\u00e7 neticesinde Google kimli\u011fi ile Keycloak’taki kullan\u0131c\u0131 hesab\u0131 aras\u0131nda kal\u0131c\u0131 bir ili\u015fki (federated identity mapping) olu\u015fturulmu\u015f olacakt\u0131r ve b\u00f6ylece, kullan\u0131c\u0131 bundan b\u00f6yle hem Google ile hem de normal Keycloak login bilgileriyle ayn\u0131 hesaba g\u00fcvenli \u015fekilde eri\u015febilme imkan\u0131 elde etmi\u015f olacakt\u0131r.<\/p>\n Peki bunun account takeover ile alakas\u0131 nedir?<\/em> diye sorarsan\u0131z; \nE\u011fer ki Keycloak, external identity provider’dan gelen bir kullan\u0131c\u0131y\u0131 s\u0131rf mail adresi ayn\u0131 diye hi\u00e7bir ek do\u011frulama yapmadan mevcut bir Keycloak hesab\u0131na otomatik olarak ba\u011flarsa, k\u00f6t\u00fc niyetli bir ki\u015fi kurban\u0131n email adresini kullanarak kendi harici hesab\u0131n\u0131 (\u00f6rne\u011fin Google) olu\u015fturup o email ile login olabilir ve Keycloak da bunu ger\u00e7ek kullan\u0131c\u0131 sanarak kurban\u0131n mevcut hesab\u0131na ba\u011flayabilir. Bu durumda sald\u0131rgan, kurban\u0131n Keycloak hesab\u0131na \u015fifre bilmeden eri\u015fmi\u015f ve hesab\u0131 ele ge\u00e7irmi\u015f olur. First broker login flow i\u00e7indeki ‘Confirm Link Existing Account’<\/em>, ‘Verify Existing Account by Email’<\/em> ve ‘Re-authenticaiton’<\/em> gibi ad\u0131mlar\u0131n temel gayesi de tam olarak bu durumu engellemektir. Keycloak, external kimlik ile mevcut hesab\u0131 linklemeden \u00f6nce kullan\u0131c\u0131dan email do\u011frulamas\u0131 veya mevcut hesap \u015fifresini isteyerek external identity’yi ba\u011flamaya \u00e7al\u0131\u015fan ki\u015finin ger\u00e7ekten o hesab\u0131n sahibi olup olmad\u0131\u011f\u0131n\u0131 kan\u0131tlamas\u0131n\u0131 isteyerek bir g\u00fcvenlik \u00f6nlemi olu\u015fturur.\n<\/li>\n Email verified claim’ine k\u00f6r\u00fc k\u00f6r\u00fcne g\u00fcvenmemelidir!<\/em><\/strong> \nBaz\u0131 identity provider’lar kullan\u0131c\u0131 bilgilerini g\u00f6nderirken email adresinin do\u011frulanm\u0131\u015f oldu\u011funu ifade eden email_verified = true<\/code> claim’ini de g\u00f6nderirler. Evet, o email adresi do\u011frulanm\u0131\u015f olabilir ancak bizler k\u00f6r\u00fc k\u00f6r\u00fcne bu bilgiye g\u00fcvenmemeliyiz. \u00c7\u00fcnk\u00fc bu de\u011fer yanl\u0131\u015f, eksik veya k\u00f6t\u00fc niyetli olacak \u015fekilde aktif olarak i\u015faretlenmi\u015f olabilir ve esas\u0131nda email adresinin ger\u00e7ek sahibi olmayan ki\u015fi, do\u011frulanm\u0131\u015f gibi kabul edilerek kullan\u0131c\u0131 hesab\u0131na eri\u015febilir ve b\u00f6ylece account takeover riski s\u00f6z konusu olabilir. Bu nedenle en g\u00fcvenli yakla\u015f\u0131m, external provider’\u0131n g\u00f6nderdi\u011fi email_verified<\/code> bilgisine tamamen g\u00fcvenmek yerine, Keycloak’un kendi ‘Verify Email’<\/em> mekanizmas\u0131n\u0131n kullan\u0131lmas\u0131d\u0131r.\n<\/li>\n “Automatically link existing accounts” ayar\u0131na dikkat edilmelidir!<\/em><\/strong> \nKeycloak’ta identity provider yap\u0131land\u0131rmas\u0131nda bulunan ‘Automatically link existing accounts’<\/em> veya benzer \u015fekilde \u00e7al\u0131\u015fan ‘Trust Email’<\/em> ayarlar\u0131 aktif edilirse, external identity provider’dan gelen kullan\u0131c\u0131n\u0131n email adresi, Keycloak’ta zaten var olan bir kullan\u0131c\u0131yla e\u015fle\u015fti\u011fi anda Keycloak bu iki hesab\u0131 hi\u00e7bir ek do\u011frulama yapmadan otomatik olarak birbirine ba\u011flama davran\u0131\u015f\u0131 sergileyerek istemeden ciddi bir g\u00fcvenlik riski durumu yarat\u0131labilir. \u00c7\u00fcnk\u00fc, sald\u0131rgan kurban\u0131n email adresini kullanarak kendi external hesab\u0131n\u0131 olu\u015fturup sisteme giri\u015f yaparsa, Keycloak bunu ger\u00e7ek kullan\u0131c\u0131 sanarak mevcut hesaba otomatik olarak ba\u011flayabilir ve b\u00f6ylece sald\u0131rgan o hesab\u0131 ele ge\u00e7irebilir. Yani yukar\u0131daki sat\u0131rlarda bass bass vurgulad\u0131\u011f\u0131m\u0131z account takeover durumu bu ayarlar neticesinde yine cereyan edebilir. Bu riski \u00f6nlemek i\u00e7in otomatik ba\u011flama yerine first broker login flow i\u00e7inde yer alan ‘Confirm Link Existing Account’ gibi ad\u0131mlar aktif tutulmal\u0131 ve b\u00f6ylece external hesab\u0131 mevcut hesaba ba\u011flamadan \u00f6nce kullan\u0131c\u0131dan \u015fifresini girmesi veya emailini do\u011frulamas\u0131 istenmelidir.<\/em>\n<\/li>\n “Create User If Unique” execution’\u0131 kritiktir! Dikkat edilmeli!<\/em><\/strong> \nKeycloak’taki ‘Create User If Unique’<\/em> execution’\u0131, external identity provider’dan gelen kullan\u0131c\u0131 bilgilerine bakarak Keycloak’ta ayn\u0131 email veya username’e sahip bir kullan\u0131c\u0131 olup olmad\u0131\u011f\u0131n\u0131 kontrol etmekte ve e\u011fer b\u00f6yle bir kullan\u0131c\u0131 yoksa otomatik olarak yeni bir kullan\u0131c\u0131 olu\u015fturmaktad\u0131r.<\/p>\nAncak burada dikkat edilmesi gereken \u00f6nemli bir husus vard\u0131r, o da, identity provider’dan gelen username bilgisinin her daim g\u00fcvenilir veya benzersiz olmayabilece\u011fidir. \u00c7\u00fcnk\u00fc kimi provider’lar username g\u00f6ndermezken, kimileri ise \u00e7ak\u0131\u015fabilecek de\u011ferler g\u00f6nderebilir… Ee bu da yanl\u0131\u015f kullan\u0131c\u0131 olu\u015fturulmas\u0131na veya \u00e7ak\u0131\u015fmalara neden olabilir. Bu riski \u00f6nlemek i\u00e7in identity provider mapper yap\u0131land\u0131rmas\u0131nda username alan\u0131n\u0131n email veya email prefix gibi sistemde benzersiz olacak bir de\u011ferden t\u00fcretilmesi \u00f6nerilmektedir. B\u00f6ylece her external kullan\u0131c\u0131 Keycloak i\u00e7inde do\u011fru ve benzersiz bir kullan\u0131c\u0131 olarak olu\u015fturulur ve kimlik e\u015fle\u015ftirme s\u00fcreci g\u00fcvenli ve tutarl\u0131 bir \u015fekilde ger\u00e7ekle\u015ftirilmi\u015f olur.\n<\/li>\n Username’in bo\u015f gelmesi durumuna dikkat edilmelidir!<\/em><\/strong> \nBaz\u0131 identity provider’lar (\u00f6zellikle Google) kullan\u0131c\u0131ya ait email bilgisini g\u00f6nderirken ayr\u0131 bir username alan\u0131 g\u00f6ndermeyebilir ve bu durumda Keycloak yeni kullan\u0131c\u0131 olu\u015ftururken kullanaca\u011f\u0131 username de\u011ferini otomatik olarak belirleyemez! E\u011fer b\u00f6yle bir senaryoda first broker login flow i\u00e7erisindeki ‘Review Profile’<\/em> execution’\u0131 aktif de\u011filse, Keycloak eksik bilgi nedeniyle hatal\u0131 kullan\u0131c\u0131 olu\u015fturabilir veya beklenmedik bir username atayarak ileride kimlik e\u015fle\u015ftirme ve kullan\u0131c\u0131 y\u00f6netimi a\u00e7\u0131s\u0131ndan kimi sorunlara temel atabilir. Bu nedenle ‘Review Profile’<\/em> ad\u0131m\u0131 aktif tutuldu\u011funda Keycloak, external provider’dan gelen bilgileri kullan\u0131c\u0131ya g\u00f6sterir ve eksik olan username alan\u0131n\u0131n kullan\u0131c\u0131 taraf\u0131ndan doldurulmas\u0131n\u0131 sa\u011flar. B\u00f6ylece olu\u015fturlan kullan\u0131c\u0131 kayd\u0131 do\u011fru, tutarl\u0131 ve sistemle uyumlu bir hale gelmi\u015f olacakt\u0131r.\n<\/li>\n Duplicate user creation riskine dikkat edilmelidir!<\/em><\/strong> \nKeycloak’ta identity provider entegrasyonu s\u0131ras\u0131nda mapper yap\u0131land\u0131rmas\u0131 yanl\u0131\u015f yap\u0131l\u0131rsa, ayn\u0131 email adresine sahip external kullan\u0131c\u0131y\u0131 her login oldu\u011funda mevcut kullan\u0131c\u0131yla e\u015fle\u015ftirmek yerine yeni bir kullan\u0131c\u0131 olarak olu\u015fturabilir ve bu durum sistemde ayn\u0131 email adresine sahip birden fazla kullan\u0131c\u0131 kayd\u0131n\u0131n olu\u015fmas\u0131na, yani duplicate user problemine yol a\u00e7abilir. Bu hem g\u00fcvenlik hem de kimlik y\u00f6netimi a\u00e7\u0131s\u0131ndan ciddi sorunlar do\u011furabilir \u00e7\u00fcnk\u00fc ayn\u0131 ki\u015fiye ait birden fazla hesap demek, do\u011fru kimlik e\u015fle\u015ftirmesi yap\u0131lamayacak demektir. Bu riski \u00f6nlemek i\u00e7in realm ayarlar\u0131ndan ‘Email unique’<\/em> se\u00e7ene\u011fi aktif hale getirilerek, Keycloak’da ayn\u0131 email adresiyle birden fazla kullan\u0131c\u0131n\u0131n olu\u015fturulmas\u0131 engellenebilir ve kimlik b\u00fct\u00fcnl\u00fc\u011f\u00fc korunabilir.\n<\/li>\n Domain restriction kullan\u0131lmas\u0131 \u00f6nerilmektedir!<\/em><\/strong> \nEnterprise sistemlerde genellikle sadece belirli bir kuruma ait kullan\u0131c\u0131lar\u0131n giri\u015f yapmas\u0131na izin verilmesi gerekmekte ve bu nedenle external identity provider’dan gelen kullan\u0131c\u0131lar\u0131n email adreslerinin belirli bir domain’e ait olup olmad\u0131\u011f\u0131 kontrol edilmesi gerekmektedir.<\/p>\nBu kontrol yap\u0131lmad\u0131\u011f\u0131 taktirde herhangi bir ki\u015fi kendi ki\u015fisel email adresiyle external provider \u00fczerinden login olabilir ve sistemde yetkisiz eri\u015fim elde edebilir. Haliyle bu durum ciddi bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 olu\u015fturacakt\u0131r. Bu riski \u00f6nlemek i\u00e7in first broker login flow i\u00e7ine eklenecek bir kontrol mekanizmas\u0131 veya custom authenticator ile kullan\u0131c\u0131n\u0131n email adresinin izin verilen domain ile bitip bitmedi\u011fi do\u011frulanmal\u0131 ve sadece belirlenen domain’e ait kullan\u0131c\u0131lar\u0131n sisteme giri\u015f yapmas\u0131na izin verilerek sistemin yaln\u0131zca yetkili organizasyon kullan\u0131c\u0131lar\u0131na a\u00e7\u0131k olmas\u0131 sa\u011flanmal\u0131d\u0131r.\n<\/li>\n Identity Provider spoofing riskine dikkat edilmelidir!<\/em><\/strong> \nBir sistemde birden fazla identity provider tan\u0131ml\u0131ysa e\u011fer ayn\u0131 emailin farkl\u0131 provider’lar \u00fczerinden gelebilme ihtimali s\u00f6z konusudur. Ancak bu email adresi ayn\u0131 olsa dahi bu kimliklerin ger\u00e7ekte ayn\u0131 ki\u015fiye ait oldu\u011funun ise ilk etapta bir garantisi olmayacakt\u0131r. Keycloak, bu iki kimli\u011fi sadece email adresleri ayn\u0131 diye otomatik olarak ayn\u0131 kullan\u0131c\u0131 hesab\u0131na ba\u011flarsa, yine burada account takeover zaafiyeti s\u00f6z konusu olabilir. Bu nedenle, first broker login flow i\u00e7indeki ‘Configrm Link Existing Account’<\/em> ad\u0131m\u0131 olduk\u00e7a kritik \u00f6neme sahiptir. \u00c7\u00fcnk\u00fc Keycloak, external identity’yi mevcut hesaba ba\u011flamadan \u00f6nce kullan\u0131c\u0131dan ek do\u011frulama yapmas\u0131n\u0131 isteyecek ve b\u00f6ylece farkl\u0131 identity provider’lardan gelen kimliklerin ger\u00e7ekten ayn\u0131 kullan\u0131c\u0131ya ait olup olmad\u0131\u011f\u0131 g\u00fcvenli \u015fekilde do\u011frulam\u0131\u015f olacakt\u0131r.\n<\/li>\n Mapper’lar\u0131n do\u011fru yap\u0131land\u0131r\u0131lmas\u0131 kritik arz etmektedir!<\/em><\/strong> \nKeycloak’ta identity provider entegrasyonu s\u0131ras\u0131nda mapper’lar, external provider’dan gelen kullan\u0131c\u0131 bilgilerinin Keycloak i\u00e7indeki kullan\u0131c\u0131 alanlar\u0131na nas\u0131l aktar\u0131laca\u011f\u0131n\u0131 belirlemektedir. Bu yap\u0131land\u0131rman\u0131n do\u011fru yap\u0131lmas\u0131 kritik \u00f6neme sahiptir \u00e7\u00fcnk\u00fc email, username, firstName, lastName ve emailVerified gibi alanlar do\u011fru \u015fekilde e\u015fle\u015ftirilmezse Keycloak kullan\u0131c\u0131n\u0131n kimli\u011fini do\u011fru \u015fekilde tan\u0131mlayamaz, bu da her login’de yeni kullan\u0131c\u0131 olu\u015fturulmas\u0131na, mevcut kullan\u0131c\u0131yla e\u015fle\u015ftirme yap\u0131lamamas\u0131na veya g\u00fcvenlik do\u011frulamalar\u0131n\u0131n hatal\u0131 \u00e7al\u0131\u015fmas\u0131na neden olabilir.<\/p>\n\u00d6zellikle email alan\u0131 en kritik aland\u0131r, \u00e7\u00fcnk\u00fc Keycloak \u00e7o\u011fu durumda kullan\u0131c\u0131 e\u015fle\u015ftirmesini email \u00fczerinden yapar ve email yanl\u0131\u015f map edilirse ayn\u0131 kullan\u0131c\u0131 i\u00e7in birden fazla hesap olu\u015fabilir veya yanl\u0131\u015f kullan\u0131c\u0131ya eri\u015fim sa\u011flanabilir, bu nedenle identity provider mapper’lar\u0131n\u0131n dikkatli ve do\u011fru \u015fekilde yap\u0131land\u0131r\u0131lmas\u0131, hem kimlik b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc hem de g\u00fcvenli\u011fi sa\u011flamak a\u00e7\u0131s\u0131ndan elzemdir!\n<\/li>\n Test ve prod ortamlar\u0131n\u0131n flow’lar\u0131n\u0131n farkl\u0131 olmas\u0131na \u00f6zen g\u00f6sterilmelidir!<\/em><\/strong> \nTest ortamlar\u0131nda genellikle geli\u015ftirme ve entegrasyon s\u00fcre\u00e7lerini h\u0131zland\u0131rmak amac\u0131yla external identity provider’dan gelen kullan\u0131c\u0131lar\u0131n otomatik olarak sisteme dahil edilmesine izin verilir. Bu nedenle first broker login flow i\u00e7inde ‘Create User If Unique’<\/em> gibi ad\u0131mlar aktif tutularak yeni kullan\u0131c\u0131lar\u0131n herhangi bir ek onaya gerek kalmadan otomatik olarak olu\u015fturulmas\u0131 test s\u00fcre\u00e7lerinde m\u00fcmk\u00fcnd\u00fcr.<\/p>\nAncak production ortam\u0131nda ayn\u0131 yakla\u015f\u0131m ciddi g\u00fcvenlik riskleri do\u011furabilece\u011finden, her external kullan\u0131c\u0131n\u0131n otomatik olarak sisteme eri\u015fim kazanmas\u0131 yerine, yaln\u0131zca belirli bir domain’e ait kullan\u0131c\u0131lar\u0131n kabul edilmesi veya yeni kullan\u0131c\u0131lar\u0131n admin onay\u0131ndan ge\u00e7tikten sonra aktif edilmesi gibi daha k\u0131s\u0131tlay\u0131c\u0131 ve kontroll\u00fc mekanizmalar\u0131n uygulanmas\u0131 daha uygundur. B\u00f6ylece sistem yaln\u0131zca yetkili ve do\u011frulanm\u0131\u015f kullan\u0131c\u0131lar\u0131n eri\u015fimine a\u00e7\u0131k tutulur ve yetkisiz ki\u015filerin sisteme dahil olmas\u0131 da engellenmi\u015f olur.\n<\/li>\n<\/ol>\n <\/span>13 Kritik Soru \/ 13 Kritik Cevap<\/span><\/h4>\n\u015eimdi \u00e7o\u011fu kritik incelemelerde yapt\u0131\u011f\u0131m\u0131z gibi bu i\u00e7eri\u011fimizde de first broker login flow’a dair akla gelen gelmeyen t\u00fcm sorular\u0131 kendimizce sorup cevapland\u0131ral\u0131m ve b\u00f6ylece konuya dair olabilecek t\u00fcm k\u0131r\u0131nt\u0131lar\u0131 toparlayal\u0131m…<\/p>\n \nSoru 1 | First Broker Login Flow tam olarak ne zaman tetiklenir?<\/span><\/summary>\nSadece \u015fu iki ko\u015ful ayn\u0131 anda sa\u011flan\u0131rsa tetiklenir:<\/p>\n \nKullan\u0131c\u0131 Google, Azure AD yahut ba\u015fka bir Keycloak vs. gibi external identity provider ile login oluyorsa<\/li>\n Keycloak’ta bu external identity ile e\u015fle\u015fmi\u015f bir user hen\u00fcz yoksa<\/li>\n<\/ol>\nUnutmay\u0131n! E\u011fer kullan\u0131c\u0131 daha \u00f6nceden link edilmi\u015fse (yani mevcut bir kullan\u0131c\u0131yla ba\u011flant\u0131lanm\u0131\u015fsa) bu flow \u00e7al\u0131\u015fmayacakt\u0131r. \n<\/details>\n \nSoru 2 | First Broker Login Flow’un temel amac\u0131 nedir?<\/span><\/summary>\nExternal identity ile Keycloak’da ki internal user aras\u0131nda mapping olu\u015fturmakt\u0131r.<\/p>\n \nExternal identity: \nGoogle \u2192 sub=123456<\/p>\nInternal identity: \nKeycloak \u2192 userId=abcd-xyz<\/p>\n Mapping olu\u015fturulur: \nGoogle(sub=123456) \u2194 Keycloak(userId=abcd-xyz)\n<\/p><\/div>\n<\/details>\n \nSoru 3 | Bu flow her login s\u00fcrecinde \u00e7al\u0131\u015f\u0131r m\u0131?<\/span><\/summary>\nHay\u0131r! Yaln\u0131zca ilk login’de \u00e7al\u0131\u015facakt\u0131r. Sonraki login’lerde ise Post Broker Login Flow<\/em><\/strong> \u00e7al\u0131\u015facakt\u0131r. \n<\/details>\n \nSoru 4 | Keycloak external user’\u0131 nas\u0131l tan\u0131r?<\/span><\/summary>\nKeycloak \u015fu bilgiyi kullan\u0131r:<\/p>\n \nidentity_provider + external_user_id (genelde sub claim)\n<\/div>\nMisal olarak: <\/p>\n \nidentity_provider = google \nexternal_user_id = 123456789\n<\/div>\nBu verileri Keycloak internal tabloda \u015fu formatta saklar:<\/p>\n \nFEDERATED_IDENTITY<\/p>\nuser_id \nidentity_provider \nexternal_user_id\n<\/p><\/div>\n<\/details>\n \nSoru 5 | “Create User If Unique” execution ne yapar?<\/span><\/summary>\nExternal identity’den gelen email veya username bilgileri benzersiz mi kontrol eder. E\u011fer benzersizse yeni bir user olu\u015fturur, yok de\u011filse “Handle Existing Account” execution’\u0131 devreye girer ve bu external kimli\u011fin mevcut hesaba g\u00fcvenli \u015fekilde ba\u011flanmas\u0131n\u0131 y\u00f6netir. \n<\/details>\n \nSoru 6 | Confirm Link Existing Account neden kritiktir?<\/span><\/summary>\nAccount takeover sald\u0131r\u0131s\u0131n\u0131 \u00f6nledi\u011fi i\u00e7in kritiktir! \n<\/details>\n \nSoru 7 | “Verify Email” execution neden \u00f6nemlidir?<\/span><\/summary>\nExternal IdP’dan gelen email her daim g\u00fcvenilir olmayabilir, ki baz\u0131 IdP’ler email_verified = true<\/code> claim’ini yanl\u0131\u015f g\u00f6nderebilmektedirler. “Verify Email” execution email do\u011frulamas\u0131n\u0131 sa\u011flayarak g\u00fcvence sa\u011flamaktad\u0131r. \n<\/details>\n \nSoru 8 | First Broker Login Flow’da user creation’\u0131 engelleyebilir miyiz?<\/span><\/summary>\nEvet, external identity geldi\u011fi taktirde yeni bir kullan\u0131c\u0131 olu\u015fturulmas\u0131n\u0131 istersek engelleyebiliriz. Bunun i\u00e7in “Create User If Unique” exeecution’\u0131n\u0131n kald\u0131r\u0131lmas\u0131 yahut DISABLED edilmesi yeterli olacakt\u0131r. B\u00f6ylece yeni bir user olu\u015fturulmayacak yaln\u0131zca mevcut user’lar login olabilecektir, ki bu davran\u0131\u015f enterprise sistemlerde olduk\u00e7a yayg\u0131nd\u0131r. \n<\/details>\n \nSoru 9 | External identity ile existing user nas\u0131l e\u015fle\u015ftirilir?<\/span><\/summary>\nExternal identity ile existing user aras\u0131ndaki e\u015fle\u015ftirme Keycloak’da \u015fu s\u0131rayla cereyan etmektedir:<\/p>\n \nFederated identity mapping<\/li>\n email match<\/li>\n username match<\/li>\n<\/ol>\nE\u011fer match s\u00f6z konusuysa “Handle Existing Account” execution devreye girecek ve gerekli external identity ile mevcut user aras\u0131nda ba\u011flant\u0131 sa\u011flanacakt\u0131r.<\/p>\n<\/details>\n \nSoru 10 | First Broker Login Flow ile Post Broker Login Flow fark\u0131 nedir?<\/span><\/summary>\n\n\n\n\n\n\n\n\nFirst Broker Login Flow<\/th>\n Post Broker Login Flow<\/th>\n<\/tr>\n<\/thead>\n ilk login’de \u00e7al\u0131\u015f\u0131r<\/td>\n sonraki loginlerde \u00e7al\u0131\u015f\u0131r<\/td>\n<\/tr>\n user creation yap\u0131labilir<\/td>\n yap\u0131lmaz<\/td>\n<\/tr>\n account linking yap\u0131l\u0131r<\/td>\n yap\u0131lmaz<\/td>\n<\/tr>\n mapping olu\u015fturulur<\/td>\n mapping zaten vard\u0131r<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/details>\n\nSoru 11 | First Broker Login Flow security boundary(g\u00fcvenlik s\u0131n\u0131r\u0131) midir?<\/span><\/summary>\nEvet, ne de olsa bu flow external identity’nin internal identity olarak aktar\u0131lmas\u0131n\u0131 sa\u011flamaktad\u0131r. Yani bir ge\u00e7i\u015f noktas\u0131d\u0131r. Dolay\u0131s\u0131yla en kritik g\u00fcvenlik s\u0131n\u0131rlar\u0131ndan birisidir. \n<\/details>\n \nSoru 12 | Bu flow olmadan Identity Federation \u00e7al\u0131\u015f\u0131r m\u0131?<\/span><\/summary>\nIdentity federation demek, external identity ile internal user’\u0131 e\u015fle\u015ftirmek demektir. Dolay\u0131s\u0131yla bu e\u015fle\u015ftirme yap\u0131lmad\u0131\u011f\u0131 s\u00fcrece login tamamlanmayacakt\u0131r. First broker login flow, bu e\u015fle\u015ftirmenin ilk kez olu\u015fturuldu\u011fu yerdir. Haliyle bu flow olmaks\u0131z\u0131n identity federation \u00e7al\u0131\u015fmayacakt\u0131r! \n<\/details>\n \nSoru 13 | External identity mapping silinirse ne olur?<\/span><\/summary>\nKullan\u0131c\u0131 external IdP ile login oldu\u011funda first broker login flow tekrar \u00e7al\u0131\u015facakt\u0131r. \n<\/details>\n <\/span>Keycloak’da First Broker Login Flow Yap\u0131land\u0131rmas\u0131n\u0131 \u0130nceleyelim<\/span><\/h4>\n\u015eimdi Keycloak’da first broker login flow yap\u0131land\u0131rmas\u0131n\u0131 incelemeye ge\u00e7ebiliriz. Tabi bunun i\u00e7in \u00f6ncelikle yap\u0131lmas\u0131 gereken esas\u0131nda en az bir tane olacak \u015fekilde external identity provider ayarlamakt\u0131r. Mesela bizler bu i\u00e7eri\u011fimizde yaln\u0131zca Google \u00fczerinden \u00f6rneklendirmede bulunuyor olsak da sizler GitHub, Azure AD vs.’ide s\u00fcrece dahil edebilir ve \u00e7al\u0131\u015fman\u0131z\u0131 daha da zenginle\u015ftirebilirsiniz.<\/p>\n <\/span>1. External Identity Provider’\u0131n Yap\u0131land\u0131r\u0131lmas\u0131 (Google)<\/span><\/h5>\n\u0130lk olarak external identity provider’\u0131m\u0131z olan Google’\u0131 Google Cloud Console<\/a><\/em> \u00fczerinden yap\u0131land\u0131rmaya ba\u015flayal\u0131m.<\/p>\n \n1 Ad\u0131m<\/u> (Yeni Proje Olu\u015fturma)<\/span><\/em> \nYapaca\u011f\u0131m\u0131z \u00e7al\u0131\u015fmayla ilgili yeni bir proje olu\u015ftural\u0131m. Tabi iste\u011finiz do\u011frultusunda mevcut olan projelerden birini de tercih edebilirsiniz.\n<\/li>\n2 Ad\u0131m<\/u> (OAuth Consent Screen’i Ayarlama)<\/span><\/em> \n<\/a>Google’\u0131n kullan\u0131c\u0131ya g\u00f6sterece\u011fi onay ekran\u0131n\u0131 yap\u0131land\u0131ral\u0131m. Bunun i\u00e7in Google Console’da yandaki g\u00f6rselde oldu\u011fu gibi OAuth Consent Screen<\/em>‘i aray\u0131p bulal\u0131m ve a\u00e7\u0131lan sayfada istenilen alanlar\u0131 uygun \u015fekilde doldurup ve audience k\u0131sm\u0131n\u0131 da external olacak \u015fekilde ayarlay\u0131p yap\u0131land\u0131rmay\u0131 sa\u011flayal\u0131m.<\/p>\nTabi burada yap\u0131lan i\u015flemlerin login ak\u0131\u015f\u0131n\u0131n teknik k\u0131sm\u0131yla ilgili olmad\u0131\u011f\u0131n\u0131, yaln\u0131zca client olu\u015fturmam\u0131z\u0131 sa\u011flayacak olan bir zemin haz\u0131rlad\u0131\u011f\u0131n\u0131 s\u00f6ylemekte fayda g\u00f6rmekteyim…\n<\/li>\n 3 Ad\u0131m<\/u> (OAuth Client Olu\u015fturma)<\/span><\/em> \n\u015eimdi ise Keycloak’da yapt\u0131\u011f\u0131m\u0131z gibi Google’da da uygulamam\u0131za kar\u015f\u0131l\u0131k gelecek bir client olu\u015fturmam\u0131z gerekmektedir. Ki Client ID<\/em> ve Client Secret<\/em> de\u011ferlerini elde edebilelim.<\/p>\nBunun i\u00e7in olu\u015fturdu\u011fumuz (ya da mevcut olan) projenin ana sayfas\u0131ndan ‘Create OAuth client’<\/em> butonuna t\u0131klayal\u0131m ve a\u00e7\u0131lan sayfay\u0131 a\u015fa\u011f\u0131daki g\u00f6rselde oldu\u011fu gibi doldural\u0131m:<\/a>Client’\u0131 olu\u015fturduktan sonra sistem bizlere Client ID ve Client Secret de\u011ferlerini verecektir. Bu de\u011ferleri Clients<\/em> men\u00fcs\u00fcnden ilgili client detaylar\u0131na gelerek g\u00f6rebilirsiniz…\n<\/li>\n<\/ul>\n <\/span>2. Internal Identity Provider’\u0131n Yap\u0131land\u0131r\u0131lmas\u0131 (Keycloak)<\/span><\/h5>\nEvet… \u015eimdi de olu\u015fturdu\u011fumuz bu Google client’\u0131, Client ID<\/em> ile Client Secret<\/em> de\u011ferleri \u00fczerinden Keycloak’la ili\u015fkilendirecek konfig\u00fcrasyonu ger\u00e7ekle\u015ftirelim ve b\u00f6ylece Google login yap\u0131land\u0131rmas\u0131n\u0131 tamamlayal\u0131m. Tabi bunun i\u00e7in Keycloak Dashboard’da Identity providers<\/code> sayfas\u0131 \u00fczerinden Google provider’\u0131na gelinmesi gerekmektedir.<\/a><\/a>Buradaki yap\u0131land\u0131rma ayarlar\u0131na g\u00f6z atarsak e\u011fer;<\/p>\n \nRedirect URI<\/em><\/strong> : Google login i\u015fleminden sonra kullan\u0131c\u0131y\u0131 geri g\u00f6nderece\u011fi adrestir. Bu adresin, bir \u00f6nceki external identity provider yap\u0131land\u0131rmas\u0131 s\u00fcrecindeki 3. ad\u0131mda Authorized redirect URIs<\/em> k\u0131sm\u0131nda kullan\u0131ld\u0131\u011f\u0131n\u0131 hat\u0131rlat\u0131r\u0131m…<\/li>\n Alias<\/em><\/strong> : Bu provider’\u0131n sistem i\u00e7indeki teknik ad\u0131d\u0131r. Google login butonuna verilen adreste URL’de \/broker\/google\/login<\/code> \u015feklinde g\u00f6r\u00fclmektedir.<\/li>\n Display Name<\/em><\/strong> : Login ekran\u0131nda kullan\u0131c\u0131ya g\u00f6z\u00fckecek isimdir. Bo\u015f kald\u0131\u011f\u0131 taktirde alias kullan\u0131lacakt\u0131r.<\/li>\n Display Order<\/em><\/strong> : Birden fazla provider’\u0131n oldu\u011fu senaryolarda login ekran\u0131nda hangi s\u0131rada g\u00f6z\u00fckece\u011fini belirler. S\u0131ralama say\u0131lar\u0131n b\u00fcy\u00fckl\u00fc\u011f\u00fcyle ters orant\u0131l\u0131d\u0131r.<\/li>\nPrompt<\/em><\/strong> : Google taraf\u0131nda login ekran\u0131n\u0131n hangi davran\u0131\u015fla y\u00f6nlendirme yap\u0131laca\u011f\u0131n\u0131 s\u00f6yler. Misal olarak;\n\nE\u011fer bo\u015f b\u0131rak\u0131rsan<\/code> : Kullan\u0131c\u0131 zaten Google’a login ise direkt devam edecektir, yok e\u011fer login de\u011filse login ekran\u0131n\u0131 g\u00f6sterecektir. Ayr\u0131ca daha \u00f6nce izin verilmi\u015fse tekrar sormayacakt\u0131r. Bu en normal ve \u00f6nerilen ayard\u0131r!<\/li>\n login<\/code> : Google’da kullan\u0131c\u0131 login olmu\u015f olsa bile tekrar \u015fifre soracakt\u0131r. Bir nevi force login<\/em>‘dir.<\/li>\n consent<\/code> : Kullan\u0131c\u0131 daha \u00f6nce izin vermi\u015f olsa bile izin ekran\u0131n\u0131 tekrar g\u00f6sterir. Yani her giri\u015fte onay ister!<\/li>\n none<\/code> : Bu ayar ise en kritik olan\u0131d\u0131r diyebiliriz. Kullan\u0131c\u0131dan hi\u00e7bir etkile\u015fim istemeden sessizce login ger\u00e7ekle\u015ftirir. <\/li>\n<\/ul>\n<\/li>\n Hosted Domain<\/em><\/strong> : Sadece belirli bir Google Workspace domain’ine izin vermek i\u00e7in kullan\u0131l\u0131r. \u00d6rne\u011fin yaln\u0131zca firma.com<\/code> uzant\u0131l\u0131 Google hesaplar\u0131 login olsun isteniyorsa bu alana firma.com<\/code> yaz\u0131lmal\u0131d\u0131r.<\/li>\n Use userIp param<\/em><\/strong> : Google’a kullan\u0131c\u0131n\u0131n IP bilgisini g\u00f6nderir. Genelde kapal\u0131 kal\u0131r, \u00e7o\u011fu senaryoda gerekmemektedir.<\/li>\nRequest refresh token<\/em><\/strong> : Google’dan refresh token talep eder.<\/li>\n<\/ul>\n\u015eimdi de provider yap\u0131land\u0131rmas\u0131n\u0131 daha da ciddi noktaya ta\u015f\u0131yal\u0131m ve scroll bar\u0131 sayfan\u0131n biraz a\u015fa\u011f\u0131s\u0131na indirerek Advanced settings k\u0131sm\u0131n\u0131 inceyelim.<\/p>\n<\/span>Advanced Settings<\/span><\/h6>\n<\/a><\/p>\n \nScopes<\/em><\/strong> : Google’dan hangi bilgilerin istendi\u011fini ifade eder. Varsay\u0131lan olarak genelde openid<\/code> email<\/code> profile<\/code> bilgileri istenmektedir.\nPeki buraya neler yazabiliriz?<\/u><\/em> \n\ud83d\udd39Google Calendar eri\u015fimi<\/p>\n \nopenid email profile https:\/\/www.googleapis.com\/auth\/calendar.readonly \n<\/strong>\n<\/div>\n\ud83d\udd39Google Drive eri\u015fimi<\/p>\n \nopenid email profile https:\/\/www.googleapis.com\/auth\/drive.readonly \n<\/strong>\n<\/div>\n\ud83d\udd39Gmail eri\u015fimi<\/p>\n \nopenid email profile https:\/\/www.googleapis.com\/auth\/gmail.readonly \n<\/strong>\n<\/div>\n<\/li>\n Store Tokens<\/em><\/strong> : Google’dan gelen access ve refresh token’lar\u0131n Keycloak i\u00e7inde saklanmas\u0131n\u0131 sa\u011flar.\nE\u011fer a\u00e7\u0131l\u0131rsa Google API’lerine Keycloak \u00fczerinden eri\u015fim sa\u011flanabilir, yok e\u011fer kapal\u0131ysa da sadece login i\u00e7in kullan\u0131l\u0131r.<\/li>\n Accepts prompt=none forward from client<\/em><\/strong> : E\u011fer bu ayar a\u00e7\u0131l\u0131rsa, client (ya da frontend) prompt=none<\/code> ayar\u0131n\u0131 Google’a y\u00f6nlendirecektir. \u0130leri seviye SSO senaryolar\u0131 i\u00e7in kullan\u0131lmaktad\u0131r.<\/li>\n Disable User Info<\/em><\/strong> : Google’dan ek olarak userinfo endpoint \u00e7a\u011fr\u0131s\u0131 yap\u0131lmas\u0131n\u0131 engeller. Default olarak kapal\u0131 olsa da a\u00e7\u0131ld\u0131\u011f\u0131 taktirde baz\u0131 claim’ler gelmeyebilir.<\/li>\n Trust Email \u26a0\ufe0f \u00d6NEML\u0130<\/em><\/strong> : Google’dan gelen email’in do\u011frulanm\u0131\u015f kabul edilip edilmeyece\u011fini yap\u0131land\u0131r\u0131r. Yani Google’\u0131n email_verified<\/code> claim’ine g\u00fcvenecektir. Kapal\u0131 oldu\u011fu taktirde ise Keycloak ayr\u0131ca email do\u011frulamas\u0131 isteyebilir.\nGoogle i\u00e7in genelde a\u00e7\u0131labilir ancak kurumsal g\u00fcvenlik gerektiren noktalarda kapal\u0131 kullan\u0131lmas\u0131 \u00f6nerilmektedir.<\/li>\n Account Linking Only<\/em><\/strong> : Bu provider’dan yeni bir kullan\u0131c\u0131n\u0131n olu\u015fturulup olu\u015fturulmayaca\u011f\u0131n\u0131 yap\u0131land\u0131rd\u0131\u011f\u0131m\u0131z ayard\u0131r. Yani aktifle\u015ftirilirse yaln\u0131zca mevcut hesaplara link ger\u00e7ekle\u015ftirilir ve yeni user creation s\u00fcreci engellenmi\u015f olur. \u00d6zellikle production s\u00fcre\u00e7lerinde g\u00fcvenlik i\u00e7in s\u0131k kullan\u0131lmaktad\u0131r.<\/li>\n Hide on Login Page<\/em><\/strong> : Login ekran\u0131nda Google ile giri\u015f butonu g\u00f6r\u00fcnmez ama URL ile yine de \u00e7a\u011fr\u0131labilir.<\/li>\n Show in Account Console<\/em><\/strong> : Kullan\u0131c\u0131 profil sayfas\u0131nda bu provider g\u00f6r\u00fcns\u00fcn m\u00fc?<\/li>\n Verify Essential Claim<\/em><\/strong> : OIDC ‘essential claim’ kontrol\u00fc yapar.<\/li>\n First Login Flow Override<\/em><\/strong> : Bu provider’dan ilk kez login olan kullan\u0131c\u0131 i\u00e7in hangi flow’un \u00e7al\u0131\u015fac\u011fa\u0131n\u0131 belirler.<\/li>\n Post Login Flow<\/em><\/strong> : Login ba\u015far\u0131yla tamamland\u0131ktan sonra ekstradan bir flow daha \u00e7al\u0131\u015ft\u0131rabilmemizi sa\u011flar.<\/li>\nSync Mode \u26a0\ufe0f \u00c7OK \u00d6NEML\u0130<\/em><\/strong> : Google’dan gelen kullan\u0131c\u0131 bilgilerinin nas\u0131l senkronize edilece\u011fini yap\u0131land\u0131r\u0131r.\n\nImport<\/code> : \u0130lk login’de sonradan de\u011fi\u015fmeyecek \u015fekilde import edilir.<\/li>\n Force<\/code> : Her login’de Google’daki de\u011fi\u015fiklikler g\u00fcncellenir.<\/li>\n Legacy<\/code> : Keycloak’un eski versiyonlar\u0131ndaki karma davran\u0131\u015f\u0131 korur. Yani ne tam olarak import ne de force davran\u0131\u015f\u0131 sergiler.<\/li>\n<\/ul>\n<\/li>\nCase-sensitive username<\/em><\/strong> : Username b\u00fcy\u00fck\/k\u00fc\u00e7\u00fck harf duyarl\u0131l\u0131\u011f\u0131n\u0131 yap\u0131land\u0131r\u0131r.<\/li>\n<\/ul>\n<\/span>Direkt Asp.NET Core Projesinden External Identity Provider \u0130le Login Yapma<\/span><\/h4>\n\u015eimdi de Asp.NET Core uygulamalar\u0131nda kullan\u0131c\u0131y\u0131 Keycloak’a y\u00f6nlendirmeksizin, Keycloak’daki Google login yap\u0131land\u0131rmas\u0131n\u0131 kullanarak direkt bir buton arac\u0131l\u0131\u011f\u0131yla Google \u00fczerinden giri\u015f nas\u0131l yap\u0131labilece\u011fini inceleyelim…<\/p>\nTabi \u00f6ncelikle bunun i\u00e7in Keycloak’da standard flow ak\u0131\u015f\u0131na sahip client authentication olarak yap\u0131land\u0131r\u0131lm\u0131\u015f a\u015fa\u011f\u0131daki ayarlarda application-client<\/code> isimli bir client olu\u015ftural\u0131m.<\/a>Ard\u0131ndan bu client’la ili\u015fkilendirilmi\u015f Asp.NET Core uygulamas\u0131n\u0131 a\u015fa\u011f\u0131daki gibi yap\u0131land\u0131ral\u0131m:<\/p>\n \n\r\nbuilder.Services.AddAuthentication(options =>\r\n{\r\n options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;\r\n options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;\r\n})\r\n .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>\r\n {\r\n options.LoginPath = "\/login";\r\n options.LogoutPath = "\/logout";\r\n })\r\n .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>\r\n {\r\n options.Authority = "http:\/\/127.0.0.1:8080\/realms\/master";\r\n options.ClientId = "application-client";\r\n options.ClientSecret = "xtiFpVpuOxNS3CoN2v78h7ay7ns06t9z";\r\n options.ResponseType = "code";\r\n\r\n options.SaveTokens = true;\r\n options.GetClaimsFromUserInfoEndpoint = true;\r\n options.RequireHttpsMetadata = false;\r\n\r\n options.Scope.Clear();\r\n options.Scope.Add("openid");\r\n options.Scope.Add("profile");\r\n options.Scope.Add("email");\r\n\r\n options.CallbackPath = "\/signin-oidc";\r\n\r\n options.PushedAuthorizationBehavior = PushedAuthorizationBehavior.Disable;\r\n\r\n options.TokenValidationParameters = new()\r\n {\r\n NameClaimType = JwtRegisteredClaimNames.PreferredUsername,\r\n };\r\n\r\n options.Events = new OpenIdConnectEvents\r\n {\r\n OnRedirectToIdentityProvider = context =>\r\n {\r\n if (context.Properties.Items.TryGetValue("kc_idp_hint", out var provider))\r\n {\r\n context.ProtocolMessage.SetParameter("kc_idp_hint", provider);\r\n }\r\n\r\n return Task.CompletedTask;\r\n }\r\n };\r\n });\r\n<\/pre>\n<\/div>\n\n Pushed Authorization Requests (PAR) nedir?<\/em><\/strong> \nKeycloak’da, authorization endpoint’ine uzun ve hassas parametrelerin URL \u00fczerinden gitmesini engelleyen daha g\u00fcvenli bir yetkilendirme ba\u015flatma mekanizmas\u0131d\u0131r.<\/p>\nStandart authorization flow’da client, kullan\u0131c\u0131y\u0131 \u015f\u00f6yle y\u00f6nlendirir:<\/p>\n\nGET \/authorize? \n client_id=webapp \n &redirect_uri=https:\/\/app.com\/callback \n &scope=openid profile email \n &state=abc \n &code_challenge=xyz\n<\/div>\nYani t\u00fcm parametreler URL query string i\u00e7inde gider. Bu yakla\u015f\u0131m, haddinden uzun URL yap\u0131s\u0131na sebep olabilece\u011fi gibi parametrelerin browser history’sinde g\u00f6z\u00fckmesine neden olabilir. Ayr\u0131ca proxy ve log sistemlerinde de parametreler kaydedilebilir ve bu tarz durumlardan kaynakl\u0131 manip\u00fclasyon riski s\u00f6z konusu olabilir.<\/p>\n PAR’da ise client authorization parametreleri \u00f6nce arka planda Keycloak’a post ile g\u00f6nderilir. Ard\u0131ndan kullan\u0131c\u0131 a\u015fa\u011f\u0131daki gibi k\u0131sa referansla y\u00f6nlendirilir:<\/p>\n\nGET \/auth?request_uri=urn:ietf:params:oauth:request_uri:abc123\n<\/div>\nB\u00f6ylece PAR sayesinde authorization iste\u011fi \u00f6nce server’a kaydedilip, ard\u0131ndan sadece referans\u0131 kullan\u0131larak g\u00fcvenli bir \u015fekilde login ba\u015flat\u0131lm\u0131\u015f olur.\n<\/p><\/div>\n Burada can al\u0131c\u0131 iki nokta mevcuttur.<\/p>\n Birincisi, 29. sat\u0131rdaki options.PushedAuthorizationBehavior = PushedAuthorizationBehavior.Disable<\/code> komutudur. Burada dikkat ederseniz Pushed Authorization Requests (PAR) yap\u0131land\u0131rmas\u0131n\u0131 disable olarak ayarlamaktay\u0131z. Bunun nedeni, Keycloak’un 26.x s\u00fcr\u00fcm\u00fcyle birlikte PAR’\u0131n varsay\u0131lan olarak zorunlu hale gelmi\u015f olmas\u0131d\u0131r. Ki bu zorunluluk neticesinde bir login y\u00f6nlendirme parametresi olan kc_idp_hint<\/code> Keycloak taraf\u0131ndan i\u015flenememektedir. O y\u00fczden PAR mekanizmas\u0131 bu noktada devre d\u0131\u015f\u0131 b\u0131rak\u0131lmaktad\u0131r.<\/p>\nkc_idp_hint<\/code>, Keycloak’a kullan\u0131c\u0131n hangi Identity Provider ile giri\u015f yapaca\u011f\u0131n\u0131 s\u00f6yleyen bir y\u00f6nlendirme parametresidir.<\/em><\/p><\/blockquote>\n \u0130kinci can al\u0131c\u0131 nokta ise 36 ile 47. sat\u0131r aral\u0131\u011f\u0131nda, olu\u015fturulan Keycloak’a y\u00f6nlendirme URL’ine kc_idp_hint<\/code> parametresinin eklenmesidir. Kullan\u0131c\u0131n\u0131n Keycloak login sayfas\u0131n\u0131 g\u00f6rmeksizin hangi Identity Provider (IdP) ile giri\u015f yapaca\u011f\u0131n\u0131 belirlememizi sa\u011flayan kc_idp_hint<\/code> parametresi, i\u015fte tam da bu noktada authorization flow URL’ine m\u00fcdahale ederek kullan\u0131c\u0131n\u0131n y\u00f6nlendirilece\u011fi URL’in Google login URL’i olaca\u011f\u0131n\u0131 ifade etmektedir. Burada dikkat ederseniz Keycloak’a y\u00f6nlendirme iste\u011fi olu\u015fturulmadan hemen \u00f6nce OpenIdConnectEvents<\/code> ile araya girilmekte ve y\u00f6nlendirmenin ba\u015flat\u0131ld\u0131\u011f\u0131 noktadan g\u00f6nderilen property’ler kontrol edilerek, i\u00e7erisinde kc_idp_hint<\/code> var m\u0131 yok mu de\u011ferlendirilmektedir. E\u011fer bu de\u011fer varsa olu\u015fturulacak y\u00f6nlendirme URL’ine eklenmekte ve Google login s\u00fcreci tam olarak konfig\u00fcre edilmektedir.<\/p>\n Asp.NET Core uygulamas\u0131n\u0131n yap\u0131land\u0131rmas\u0131n\u0131 bu \u015fekilde yapt\u0131ktan sonra geriye yaln\u0131zca a\u015fa\u011f\u0131daki gibi Google ile login yapmam\u0131z\u0131 sa\u011flayacak olan noktay\u0131, yani bir action’\u0131 olu\u015fturmak kalmaktad\u0131r:<\/p>\n\n\r\n.\r\n.\r\n.\r\n [HttpPost()]\r\n public IActionResult LoginWithGoogle(LoginViewModel model)\r\n {\r\n return Challenge(new AuthenticationProperties { RedirectUri = "\/", Items = { ["kc_idp_hint"] = "google" } }, OpenIdConnectDefaults.AuthenticationScheme);\r\n }\r\n.\r\n.\r\n.\r\n<\/pre>\n<\/div>\nBurada da dikkat ederseniz LoginWithGoogle<\/code> action metodunun i\u00e7erisinde Challenge<\/code> yap\u0131l\u0131rken AuthenticationProperties<\/code>‘e RedirectUri<\/em>‘nin yan\u0131nda bir de Items<\/em> eklemekte ve mevzu bahis olan kc_idp_hint<\/code> parametresi burada Dictionary olarak tan\u0131mlan\u0131p identity provider’\u0131n “google”<\/em> olaca\u011f\u0131 ifade edilmektedir.<\/p>\n Evet… Asp.NET Core ile Keycloak yap\u0131land\u0131rmal\u0131 Google ile login \u00e7al\u0131\u015fmas\u0131 bundan ibarettir. Daha fazla teknik detay i\u00e7in i\u00e7eri\u011fimizin sonundaki GitHub reposuna g\u00f6z atabilirsiniz.<\/p>\n<\/span>Direkt SPA’da External Identity Provider \u0130le Login Yapma<\/span><\/h4>\nBenzer mant\u0131kla bir SPA’de de Keycloak’da yap\u0131land\u0131r\u0131lm\u0131\u015f ve direkt Google login’e y\u00f6nlendiren bir butona ihtiyac\u0131m\u0131z olabilir. Bunun i\u00e7in yap\u0131lmas\u0131 gerekenler olduk\u00e7a basittir. \u015eimdi gelin bunu bir Angular uygulamas\u0131 \u00fczerinden k\u0131saca deneyimlemeye \u00e7al\u0131\u015fal\u0131m…<\/p>\n \u00d6ncelikle Keycloak’da standard flow ak\u0131\u015f\u0131na sahip a\u015fa\u011f\u0131daki g\u00f6rseldeki gibi yap\u0131land\u0131r\u0131lm\u0131\u015f angular-client<\/code> isimli bir client olu\u015ftural\u0131m:<\/a> \nArd\u0131ndan ilgili Angular projesine keycloak-js<\/a><\/code> k\u00fct\u00fcphanesini y\u00fckleyelim.<\/p>\n \n npm install keycloak-js \n<\/strong>\n<\/div>\nVe devam\u0131nda a\u015fa\u011f\u0131daki yap\u0131land\u0131rmaya sahip bir konfig\u00fcrasyon dosyas\u0131 olu\u015ftural\u0131m:<\/p>\n keycloak.configurations.ts<\/em>;<\/p>\n\n\r\nimport Keycloak from 'keycloak-js';\r\n\r\nconst keycloak = new Keycloak({\r\n url: 'http:\/\/127.0.0.1:8080',\r\n realm: 'master',\r\n clientId: 'angular-client'\r\n});\r\n\r\nexport default keycloak;\r\n<\/pre>\n<\/div>\nVe uygulama ayarlar\u0131n\u0131n yap\u0131ld\u0131\u011f\u0131 app.config.ts<\/em> dosyas\u0131nda da a\u015fa\u011f\u0131daki yap\u0131land\u0131rmada bulunal\u0131m:<\/p>\n\n\r\n.\r\n.\r\n.\r\nimport keycloak from '.\/configurations\/keycloak.configurations';\r\n\r\nexport const appConfig: ApplicationConfig = {\r\n providers: [\r\n provideBrowserGlobalErrorListeners(),\r\n provideRouter(routes),\r\n provideAppInitializer(() => {\r\n keycloak.init({\r\n onLoad: 'check-sso',\r\n pkceMethod: 'S256',\r\n checkLoginIframe: false\r\n })\r\n })\r\n ]\r\n};\r\n<\/pre>\n<\/div>\nEvet, art\u0131k uygulamam\u0131z belirtilen Keycloak sunucusunda yap\u0131land\u0131r\u0131lm\u0131\u015f olan Google ile login s\u00fcrecine olduk\u00e7a haz\u0131r. Bunu test edebilmek i\u00e7in a\u015fa\u011f\u0131daki gibi basit bir component tasarlamam\u0131z yeterli olacakt\u0131r:<\/p>\n\n\r\nimport keycloak from '.\/configurations\/keycloak.configurations';\r\n\r\n@Component({\r\n selector: 'app-root',\r\n imports: [RouterOutlet],\r\n template: `\r\n <button (click)="loginWithGoogle()">Google ile giri\u015f<\/button>\r\n `\r\n})\r\nexport class App {\r\n async loginWithGoogle() {\r\n await keycloak.login({\r\n idpHint: 'google',\r\n redirectUri: window.location.origin\r\n });\r\n }\r\n}\r\n<\/pre>\n<\/div>\n\u0130\u015fte bu kadar \ud83d\ude42<\/p>\n Bizler i\u00e7erik boyunca teknik a\u00e7\u0131dan Google ile login s\u00fcrecini tecr\u00fcbe etmi\u015f bulunmaktay\u0131z. Tabi ki de sizler farkl\u0131 external identity provider’lar\u0131 deneyebilir ve varsa k\u00fc\u00e7\u00fck n\u00fcanslar bizleri de ayd\u0131nlatabilirsiniz.<\/p>\n Nihai olarak;<\/p>\n First Broker Login Flow, modern kimlik federasyonunun bel kemi\u011fini olu\u015fturan ve external identity provider’lar ile kurumsal kullan\u0131c\u0131 y\u00f6netimi aras\u0131ndaki kritik k\u00f6pr\u00fcy\u00fc g\u00fcvenli bir \u015fekilde in\u015fa etmemizi sa\u011flayan vazge\u00e7ilmez bir mekanizmad\u0131r. Do\u011fru yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131 taktirde hem kullan\u0131c\u0131 deneyimini kusursuzla\u015ft\u0131ran hem de hesap ele ge\u00e7irme gibi ciddi g\u00fcvenlik risklerini bertaraf eden bu ak\u0131\u015f, Keycloak’un identity brokering yeteneklerini tam anlam\u0131yla ete kemi\u011fe b\u00fcr\u00fcnd\u00fcrmektedir. Unutulmamal\u0131d\u0131r ki, her external provider’dan giri\u015f esas\u0131nda bir g\u00fcven meselesidir. Bu meselenin yap\u0131land\u0131rmas\u0131 ne kadar sa\u011flam ve bilin\u00e7li bir \u015fekilde sa\u011flan\u0131rsa, dijital kimlik altyap\u0131s\u0131 o kadar diren\u00e7li ve g\u00fcvenilir olacakt\u0131r.<\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n\n\n \n\u00d6rnek \u00e7al\u0131\u015fmaya a\u015fa\u011f\u0131daki GitHub reposundan eri\u015febilirsiniz.<\/div>\nhttps:\/\/github.com\/gncyyldz\/Keycloak.Examples<\/div>\n<\/p><\/div>\n<\/p><\/div>\n\n Bu repository, ilgili konuya dair \u00f6rnek \u00e7al\u0131\u015fman\u0131n kaynak kodlar\u0131n\u0131 ve mimari yap\u0131s\u0131n\u0131 i\u00e7ermektedir. Detaylar i\u00e7in GitHub \u00fczerinden incelemede bulunabilirsiniz.\n <\/div>\n \n GitHub\u2019da G\u00f6r\u00fcnt\u00fcle \u2192 \n <\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":" Merhaba, Biliyorsunuz ki, modern kimlik y\u00f6netimi sistemlerinde kullan\u0131c\u0131lar yaln\u0131zca uygulaman\u0131n kendi kullan\u0131c\u0131 veritaban\u0131 \u00fczerinden de\u011fil; Google, Microsoft, GitHub veya kurumsal kimlik sa\u011flay\u0131c\u0131lar\u0131 gibi harici Identity Provider‘lar arac\u0131l\u0131\u011f\u0131yla kimlik do\u011frulamas\u0131 ger\u00e7ekle\u015ftirmektedirler. Keycloak bu senaryoyu Identity...<\/p>\n","protected":false},"author":1,"featured_media":28235,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5554],"tags":[5672,5670,5669,5626,5678,5555,5677,5671,5676],"class_list":["post-28484","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-keycloak","tag-account-takeover","tag-broker-login-flow","tag-first-broker-login-flow","tag-identity-brokering","tag-kc_idp_hint","tag-keycloak","tag-par","tag-post-broker-login-flow","tag-pushed-authorization-requests"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28484","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=28484"}],"version-history":[{"count":22,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28484\/revisions"}],"predecessor-version":[{"id":28526,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28484\/revisions\/28526"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/28235"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=28484"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=28484"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=28484"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}