This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| builder | |
| .stream(LOGIN_ATTEMPT_TOPIC, Consumed.with(stringSerde, jsonSerde)) | |
| .filter((key, value) -> value != null) | |
| .peek((k, v) -> logger.info("event fraude key : {} value : {}", k, v)) | |
| .groupByKey() | |
| .windowedBy(TimeWindows.of(Duration.ofMinutes(5))) | |
| .aggregate(FraudDto::new, (k, v, fraud) -> { | |
| fraud.setUsername(v.getDetails().getUsername()); | |
| fraud.setIpAddress(v.getIpAddress()); | |
| fraud.setDeviceDto(v.getDevice()); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| curl -s -XPUT "<http://localhost:9200/_template/malicious-attempt/>" -H 'Content-Type: application/json' -d' | |
| { | |
| "template": "*", | |
| "mappings": { "dynamic_templates": [ { "dates": { "match": "time", "mapping": { "type": "date" } } } ] } | |
| }' | |
| curl -X POST <http://localhost:8083/connectors> -H "Content-Type: application/json" -d '{ | |
| "name": "malicious-connector", | |
| "config": { | |
| "connector.class": "io.confluent.connect.elasticsearch.ElasticsearchSinkConnector", |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| KStream<String, KeycloakDto> deviceStream = builder | |
| .stream(LOGIN_ATTEMPT_TOPIC, Consumed.with(stringSerde, keycloakJsonSerde)) | |
| .filter((key, value) -> value != null) | |
| .map((key, v) -> new KeyValue<>(v.getUsername() + ":" + getHashDevice(v.getDevice()), v)) | |
| .leftJoin(knownDevices, (left, right) -> { | |
| if (right == null) return left; | |
| return null; | |
| }) | |
| .filter((key, value) -> value != null); | |
| deviceStream.to(NEW_DEVICE_ATTEMPT_TOPIC, Produced.with(stringSerde, keycloakJsonSerde)); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| String[] ELLIGIBLE_EVENT = { | |
| "LOGIN", "LOGIN_ERROR" | |
| }; | |
| StreamsBuilder builder = new StreamsBuilder(); | |
| builder | |
| .stream("keycloak-event", Consumed.with(stringSerde, jsonSerde)) | |
| .peek((k, v) -> logger.info("Observed key:{} event: {}", k, v.toString())) | |
| .filter((k, v) -> Arrays.asList(ELLIGIBLE_EVENT).contains(v.getType())) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| static String getHashDevice(DeviceDto deviceDto) { | |
| String deviceHash = deviceDto.getOs() + deviceDto.getOsVersion() + deviceDto.getDevice() + deviceDto.isMobile(); | |
| return Base64.getEncoder().encodeToString(deviceHash.getBytes(StandardCharsets.UTF_8)); | |
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package de.tdlabs.keycloak.client; | |
| import java.util.Arrays; | |
| import java.util.Collections; | |
| import javax.ws.rs.core.Response; | |
| import org.keycloak.OAuth2Constants; | |
| import org.keycloak.admin.client.Keycloak; | |
| import org.keycloak.admin.client.KeycloakBuilder; |