
Explore a hands-on security architecture using open source tools, from web firewall and mod_security to keycloak for identity and access management, OpenID Connect, and secure service communication.
Use Docker to run the entire architecture locally, install Docker Desktop to view running containers, and start all services defined in a configuration file with a single command.
Explore secure architecture foundations by implementing an open source identity provider with Keycloak, focusing on authentication flows, OpenID Connect, OAuth2, SAML, and hosting options, plus single sign-on and social login.
Set up Keycloak via Docker Compose, configure a multi-tenant environment with tenants A, clients (user login and service credentials), and token mappings using OpenID Connect, OpenID, and logout endpoints.
Learn how OpenID Connect sits on top of OAuth 2.0, using a front-end authentication gateway to obtain an ID token for authentication and an access token for authorization from Keycloak.
Build an authentication gateway with nginx, extend it with JavaScript to redirect to Keycloak for OpenID login, and retrieve tokens and codes.
Apply Nginx JavaScript to complete the OpenID Connect flow by implementing token exchange with a token endpoint proxied to Keycloak, validating codes, and returning tokens within a dockerized architecture.
Register our client and grab the client ID and client secret, then call the OpenID token endpoint to obtain an access token for backend access via the authentication gateway.
Enforce authentication by validating JWT tokens in the authorization header and proxying requests to a private downstream service via nginx, performing token checks and returning 401 when missing.
Explore how JWT or dot tokens authorize requests, following the OpenID standard, detailing the header, payload, and signature, and show how public keys and certificates verify.
Explore ways to validate jwt signatures by using key id with a certificate endpoint, x5t fingerprint, or a token with a full chain, and retrieve certificates from local trust store.
Learn to validate JWT tokens using certificates from the header (embedded x5c), a fingerprint trust store, and an idp certificate endpoint, with quick tests across scenarios.
Explore how secure connections use TLS and HTTPS to encrypt browser-server data with public and private keys and digital certificates, validated by certificate authorities and root stores.
Generate a root certificate authority and intermediary certificate authority, sign certificates via a certificate signing request, and assemble a full chain certificate for offline, secure provisioning across services.
Generate service certificates from an intermediary ca for each service. Create private keys and csrs, sign them with the intermediate ca, and apply the full chain to gateways.
Package service certificates into a local trust store to support token validation. View trusted certificates with Keystore Explorer and distribute the trust store for new services.
Configure http to https redirection and establish tls-enabled connections by exposing port 443 with nginx and existing certificates, securing the authentication gateway before enabling downstream services.
employ the sidecar design pattern to centralize security measures, using nginx sidecars to enforce https tls handshakes and verify service identities with certificates and a certificate authority.
Implement mutual tls by requiring and validating client certificates to identify requesters. Configure nginx with a certificate authority and test client verification using curl with the cert and key.
Route app requests through the sidecar by using an nginx sidecar proxy and iptables, enabling automatic TLS certificate handling and dynamic upstream resolution without modifying the service.
Develop a node application with express on port 7000 as a protected service, routed by per-service nginx with a sidecar, and provisioning to build images and generate certificates for ingress.
Enforce service authorization by extracting the service name from the certificate's common name, validating requests before forwarding to the upstream service, and implementing opa policy validation.
Decouple authorization policies from applications using open policy agent, enabling centralized, flexible policy management with rego across kubernetes, data access, and services.
Implement OPA into your architecture to enable decentralized policy enforcement via a separate service. Define simple rego policies, test access, and decouple policy enforcement from application code.
Learn to deploy ModSecurity with the core rule set on Nginx to implement a web application firewall, protecting against SQL injection and cross-site scripting.
Configure a docker-based waf with nginx and modsecurity, adjust paranoia and logging, and forward requests to the authentication gateway. Observe logs to verify blocking of cross-site scripting and sql injection.
Step into the world of distributed systems with our hands-on course that equips you with the skills and knowledge you need to build secure and reliable systems and act as a security architect. Tackle core challenges such as authentication, authorization, and secure communication while leveraging industry-standard technologies and patterns that prepare you for today’s dynamic threat landscape.
In this course, you'll get your hands dirty with real-world tools like Keycloak for authentication and OPA for precise policy enforcement. Master secure communication and traffic management using Nginx, and become adept at detecting and mitigating threats with OWASP CRS and ModSecurity. You'll integrate JWT for secure token management, Sidecar for modular architecture, and Reverse Proxy for efficient traffic handling. Plus, you'll implement secure protocols with digital certificates and HTTPS to ensure data integrity and privacy.
In this course, you will learn how to:
• Authenticate and verify identities using an self hosted Opensource identity provider.
• Control access with precision using OPA for policy enforcement.
• Secure communications and manage network traffic with Nginx acting as inbound and outbound sidecar proxy.
• Detect and mitigate threats with OWASP CSR for robust threat detection rules and OWASP ModSecurity as your first line of defense.
• Integrate essential security patterns such as JWT for secure token management, Sidecar for modular architecture, and Reverse Proxy for efficient traffic handling.
• Implement secure mutual TLS(mTLS) with digital certificates to ensure data integrity and privacy.
With our hands-on approach, every module empowers you to apply these techniques directly in real-world environments. This course is ideal for software developers, security professionals, architects, and anyone interested in designing and implementing secure systems.
Elevate your expertise in security architecture by engaging with interactive labs and exercises that transform theoretical concepts into deployable solutions.