Efficient auditing for read operations

Oskars — Wed, 20 Oct 2021 08:23:44 +0000

Recently I ran into a scenario when the read operation was not performing well due to auditing requirements. If you need to persist an audit record on every read operation, writing to the database will most likely be the bottleneck.
There are a few improvements listed below that can be done to improve performance. Improvements are ordered by subjective performance gain.

Defer writing audit records using asynchronous queue
Consume records from the queue in batches and do bulk inserts
Separate read and write operations and read data from replica

Detailed descriptions of steps in the flow:

User requests to get the status of something
Application registers an event "getStatusCalled" that getStatus request has been performed.
Application retrieves status from database standby node, thus not loading primary database node. The user receives a response
Another application node (or same application node, but a different thread) periodically consumes "getStatusCalled" events in batches
Application performs bulk insert to primary database node. Changes are replicated to the standby node using the database replication process.

Have a feedback or improvement idea? Share it in a comment.

Import PBKDF2 hashed user passwords into Keycloak

Oskars — Mon, 04 Jan 2021 14:02:27 +0000

If you are in process of migrating to dedicated authentication provider Keycloak, you might need to retain original passwords from the source system.

Since I spent some time on getting creating users with already hashed passwords to work with Keycloak, sharing the API call that is needed to achieve this. Tested with Keycloak 9.0.5

POST http://localhost:8080/auth/admin/realms/master/users
Authorization: Bearer {{access_token}}
Content-Type: application/json

{
  "enabled": true,
  "attributes": {},
  "username": "admin",
  "emailVerified": "",
  "credentials": [
    {
      "credentialData": "{\"hashIterations\": 27500,\"algorithm\": \"pbkdf2-sha256\"}",
      "secretData": "{\"salt\": \"x/bm4Y3DcuV9eU97ervkPA==\",\"value\": \"1u7BLvfSPxQFpwc5jpGSA+88EGl9pZYKhaZ8YPIu9N4=\"}",
      "type": "password"
    }
  ]
}

Here salt must be Base64 encoded value.
An example creates a user with username "admin" and password "admin"

There are also online tools available to encode raw passwords, for example, https://8gwifi.org/pbkdf.jsp.

DEV Community: Oskars

Efficient auditing for read operations

Import PBKDF2 hashed user passwords into Keycloak