Hi,
we currently use oath2 (keycloak) users/client to secure technical service to service communication. We (and SP) are not so happy with it due to security concerns, configuration and maintenance effort (password rotation) .
UAA proposed to use certificates for this usecase.
We are thinking about a solution that use cert-manager and vault as certificate issuer to automate the certificate creation and renewal process.
Does anybody does something like this already or has a better way to secure service communication?
Hi,
UAA recommends using out-of-the-box authentication type CERT for server to server communication. Having that type, it’s required to pre-generate the client certificate and register to the server through configuration (please refer to the UAA document for more clues). UAA does not provide any mechanism to automatically generate or renew certificate, you have to do it by your own and re-register to the server after the certificate expires.
Hope this would help.
Hello @julian-typed-spruce,
is the answer from @anh-fresh-forge solving your problem?
Yes thank you.
We are planning to go in that direction and see how this will work out.
If some other team already does this in production please let me know.