Architecture and Distributed Systems, Web Distributed Systems Design
Distributed Architecture and Multi Tenancy
-
Upload
forgerock -
Category
Technology
-
view
166 -
download
1
Transcript of Distributed Architecture and Multi Tenancy
WANTED ** Large IT service and operations provider seeks identity
management solution supporting 1100+ tenants **
** Tenants ranging from dozens to thousands of users **
** No nonsense! Full range of IDM functionality required **
!! Financial sector - strict tenant separation down to the log file level is a MUST !!
So does OpenIDM ‘do’ multi-tenancy ?? Formally no…… but actually:
YES ! because it’s a well-behaved tenant itself:
- devops friendly
- lightweight and compact
- ForgeRock platform provides integration
Copyright © 2016 ForgeRock, all rights reserved.
BUILDING IDAAS w OpenIDM
4
▪ swarm of isolated, lightweight OpenIDM instance
▪ no extra Java appserver required ▪ low memory footprint (1GB+) ▪ multi-tenancy down to loglevel ▪ devops ready
TENANT 1
TENANT 2
TENANT 3
TENANT 1100
AD RACF SAP LDAP
OpenIDM 1
OpenIDM 2
OpenIDM 3
OpenIDM 1100
ACCESS Layer (e.g. Reverse Proxies with Access Agent; URL Rewrite)
IDaaS Service Layer
SAML | OIDC IDP
OpenIDM Repository DATABASE LAYER (eg pluggable DB)
OpenIDM Audit & Registration DATABASE | FILE | ANY LAYER (eg pluggable DB)
GIT Repo Docker
Kubernetes
Copyright © 2016 ForgeRock, all rights reserved.
HOOKING UP OpenIDM
5
Tenant config repo holds- Dockerfile- OpenIDM Config
- auditing & logging
- endpoint config- managed
objects- system
System Update
Docker Base Image
Setup
Pull OpenIDM
Binary
Extract OpenIDM
Add DB Repo
Config
Add Tenant specific Config
Setup container
network & proxy
LAUNCH
BINARY REPO
File, Git, SVN
TENANTCONFIG
REPO
CONFIG REPOeg Git
git clone
RUN wget
Re-config LB /
Access Proxy
etcd/confd
docker data volume
UPGRADE
PATCH
START
POC INGREDIENTS
6
• Virtual machine host for multiple IDM instances
• Dedicated file system folder per instance
• Binaries deployed (unzipped) via shell script
• Configuration version-controlled and deployed via Github
• Script sets up dedicated repo (Amazon RDS), LDAP base DN (OpenDJ) and admin users (OpenAM)
• Script parametrises boot properties (TCP ports, instance name, certificates etc.) and sets up forwarding on IG
ACTUALLY, WHO NEEDS DOCKER?
7
OPENIG
OPENAM
OPENIDM
T0234 T1256 T3378 T9402 …
CLIENT
MYSQL (RDS)
OPENDJ
SSH
repo
bin
deploy.sh
GITHUB AD
CONNECTORS
master adminglobal service admin
tenant admintenant service admin
https://t9402.forgerock.test
https://idmhost:9402
DEPLOY.SH
1. Refreshes repo from github
2. Displays inventory of tenant instances
3. Prompts admin for desired operation
CREATE/DEPLOY NEW TENANT
1. Select menu item 1 2. Enter tenant ID
Script: • copies binaries • fetches master config from repository • applies per-instances settings • time to completion: < 5 seconds
3. ‘Y’ to start service initial startup: < 20 seconds
IDM FEATURES WHICH SAVED OUR DAY
10
• Scalability: Expands well AND shrinks well - allows for physical co-location of many small instances
• Lightweight and compact - single zip file to distribute
• JSON config - infrastructure as code, easy to manage and deploy
• Built-in parametrisation and auto-replacement of config settings
• License model agnostic to number of instances
• Stack integration - IG and AM re-integrate separate tenants into one solution
THE REAL THING - MOVING TO PROD
11
• Need Docker after all… swarm + …
• DB Backend
• High-availability - all rats don’t sink with the ship
• SLAs - parallel architecture gives flexibility/granularity
• “The white layer” - integration and translation layer for operational purposes and service access
• IG + AM -> IDM UI + custom endpoints (password reset)
THE DEVOPS FUTURE
12
• Docker replaces deployment script
• …
© 2017 ForgeRock. All rights reserved.
Docker Support - March 2017 • Sample Dockerfiles provided for all products
• Currently, customers must build their own docker images from the provided binaries.
• Sample Kubernetes manifests for dev / test / QA environments • Support for deployment using Docker Images
• From a support perspective it’s just another VM platform
Future:• Provide reference Docker images
• Distribution mechanism TBD - “ForgeRock Docker Registry”
• Reference Kubernetes manifests for large scale production
THE DEVOPS FUTURE
13
• Docker replaces deployment script
• …
© 2017 ForgeRock. All rights reserved.
OpenIDM 5.0• OpenIDM has always been REST/JSON friendly by design from the
groundup• Native support for infrastructure as code (json export / import)• Requires persistence service (database) that is cluster aware
Enhancements coming in 5.5:• Enhanced dynamic cluster node handling• Deal with cluster nodes that come and go (DevOps
environment)• Support for Immutable Server Configuration • Configuration read at startup, stored in memory, not in repo
• Development mode: Configuration is synced back to disk• Production mode: Configuration is read only