Cumulative Statistics with Identity Gateway

How healthy is your Identity Gateway? How healthy are the downstream applications it protects. Cough, cough - one might think.
IG Studio allows to easily enable statistics collection. Data is cumulative since server startup or over recent time intervals. Statistics-based health checking is not just if endpoints are alive or dead, but how they are serving clients. 

So, bring up IG Studio and configure the /rocksock application (route) and enable statistics for it. 

Turning statistics on and providing the percentiles sets the "monitor" object in the configuration.

  "monitor" : {

    "enabled" : true,

    "percentiles" : [ 0.25, 0.5, 0.9, 0.99, 0.999, 0.9999 ]

  }

The cumulative statistics can be retrieved with a simple curl command :

curl http://openig.example.com:8080/openig/api/system/objects/_router/routes/rocksock/monitoring?_prettyPrint=true

{

  "requests" : {

    "total" : 1590742,

    "active" : 0

  },

  "responses" : {

    "total" : 1590742,

    "info" : 0,

    "success" : 1590742,

    "redirect" : 0,

    "clientError" : 0,

    "serverError" : 0,

    "other" : 0,

    "errors" : 0,

    "null" : 0

  },

  "throughput" : {

    "mean" : 3060.6,

    "lastMinute" : 3206.0,

    "last5Minutes" : 2584.7,

    "last15Minutes" : 1349.9

  },

  "responseTime" : {

    "mean" : 0.017,

    "median" : 0.009,

    "standardDeviation" : 0.042,

    "total" : 31727,

    "percentiles" : {

      "0.25" : 0.007,

      "0.5" : 0.009,

      "0.9" : 0.022,

      "0.99" : 0.206,

      "0.999" : 0.504,

      "0.9999" : 0.995

    }

  }

}

The allows allows to read out characteristics which help to determine the actual health of the system:

• IG is up and this application protection (route) is deployed
• IG treated 1590742 requests since startup for /rocksock of which all received a success response
• The throughput over that last minute was 3206 requests per second, 2584 requests/sec over the last 5 minutes and 1349.9 requests over the last 15 minutes
• 99.99 % of the requests were responded to in 0.995 milliseconds or less

For further details on configuring statistics and analysing the result, see the Configuration Reference. Note that the absolute response times depend a lot on the response times of the downstream applications.

The Identity Gateway Studio will be shipped with ForgeRock Identity Gateway 5.0.

For more, see the Identity Gateway Studio introduction or the blog post on message capture.

By Joachim Andres

OpenIG on Docker: The Perfect Couple

"Docker containers wrap a piece of software in a complete filesystem that contains everything needed to run [...]" [1]

OpenIG (Open Identity Gateway) provides an elegant yet flexible way to integrate your applications, devices, APIs with modern identity standards such as token types, authentication and authorization. The gateway as your integration component can be deployed and scaled along the applications and services it secures. 
Whilst organizations adopt containerization as part of a "well-oiled" delivery pipeline, which includes the gateway, OpenIG in a container is also very beneficial for evaluation purposes. Here's how you can evaluate in just a couple of minutes.

As prerequisites, you need docker and git on your system.

1. Checkout the ForgeRock docker project to retrieve the Dockerfile and sample OpenIG configuration files
• git clone https://stash.forgerock.org/scm/docker/docker.git
• cd docker/openig
2. Build the docker image (the --no-cache option assures that it pulls the latest OpenIG nightly build at each docker build)
• docker build -t forgerock/openig:latest .
3. Run the docker image and mount the sample-config directory from your local git copy in the container
• docker run --detach -p 8080:8080 --volume <LOCAL_PATH_TO_GIT>/docker/openig/sample-config:/var/openig --name openig -it forgerock/openig
  

To test the sample configuration, point your client (e.g. web browser, curl) to http://localhost:8080/simplethrottle for instance. The response is determined by the StaticResponseHandler setting in the 20-simplethrottle.json file.

A simplified version of this procedure however without the sample configuration but not necessitating usage of git and clone the full repo goes as follows. This is well suited to evaluate the upcoming user interface.

1. Download the Dockerfile from https://stash.forgerock.org/projects/DOCKER/repos/docker/browse/openig/Dockerfile
2. Build the docker image (as above)
• docker build -t forgerock/openig:latest .
3. Run the docker image
• docker run -d -p 8080:8080 --name openig -it forgerock/openig

Other useful commands:

• Stop container: docker stop openig
• Start container: docker start openig
• Get shell prompt: docker exec -i -t openig /bin/bash
• Remove container: docker rm openig

References

[1] "Package your application into a standardized unit for software development". Retrieved from https://www.docker.com/what-docker on Sep 6th, 2016.