Before I start my talk, I would like to acknowledge the traditional owners of the land on which we are celebrating and gathering today, the Jagra and the Terrible People, their connections to land, water and community. I pay respect to elders past, present and emerging. Distinguished guests, fellow delegates, colleagues, in shaping our water futures, as Marianne has indicated, our waterways are very important. So we do need to listen, listen to them a bit more. Even in the development of solutions, we need to be able to target the solutions to what the waterways are trying to tell us, rather than develop solutions for the sake of developing solutions. The other night, I was talking to a colleague, a friend, and a fellow woman water champion, Leith Bully, who wrote this amazing poem about partnerships and water. And I asked Leith then if I could share some excerpts or some parts of that poem with you, especially the ones where she talks about it from the point of view of our waterways. So I'd like to start my talk with that one. While I'm doing that, in the background, there'll be a number of photos, amazing photos of different waterways. These photographs have been submitted to the Global Change Institute as part of our competition to basically portray the use and the characteristics of water. So that will be showing in the background. So I might start that now. So Leith's poem goes like this. Six disconnected people looking at their dying river. Excuse me. While governments made promises, conducting endless meetings, single issues, confusing policies and processes by the mile, politics is served, but will the river smile. Each person possessed a piece of wisdom, none prepared to share, for trust was lost and self-interest reigned supreme. The curry's face was one of sadness. She saw timeless knowledge lost forever. She felt the river crying as land and people disconnected. So the mighty river sighed and died. It died from people's lack of trust and precious knowledge left to rust. Just think of how it might have been if only they had found a way to share their wisdom and work together to save their precious river. Thank you very much, Leith. And Leith is in the audience at the moment. So these are the credits for the photographers who have very kindly given us the photographs. So colleagues, there really is a requirement for us to have a paradigm shift on how we view our waterways. We have, all of us would have seen in the past, we looked at our waterways as sources of water. We have to. They basically provide us with a water for household, water for industry and water for the community. In some rivers, unfortunately, they're treated as sewers. It's the easiest way to discharge waste. You dump the waste, they go out. Solution, diffusion is the solution to pollution. Cities love to build around rivers. We love in some cities and Brisbane is one, Singapore, for example, Malaysia, we love living on the rivers. So we've actually now started to look at rivers as lifestyle. We like recreational activities along the river. We enjoy basically just looking at the different components of the river. But the challenge for us here today is really looking at rivers for future generation. We need to conserve and preserve and protect our rivers for not just us, but for our children and the future generation. As such, we need to really, on top of just looking at rivers as services or provision of services for us, we really need to look more at the impacts that we are putting on our rivers. We need to look at physical solutions. We've talked a lot about this, as well as enabling solutions, such as governance, such as financial mechanisms, such as community ownership. But we also need to be more strategic about rivers, not just reactive, because as we know, it takes overnight to basically destroy a river, but it will take a long time to restore a river. So with that, on Monday, John Thwaite, our keynote speaker, actually provided us with one of the levers or opportunities to actually help us protect and restore our waterways, the Sustainable Development Goals. And we've talked a lot about that, specifically Sustainable Development Goal number six, and more specifically the goals that relate to improved water quality by the reduction of pollution, the implementation of integrated water resource management, protect and restore water-related ecosystems, expand international cooperation and capacity building, and strengthen community participation. So my keynote would touch on bits and pieces of this and show to you some case studies by which we could actually fast-track some of these to achieve Sustainable Goals, Sustainable Goal number six. So just as a quick background, our waterways support a number of environmental values. In fact, the valuation of our waterways, specifically the freshwater lakes and rivers, which occupies about 165 million hectares worldwide, is about $3.2 billion US dollars a year. So it is a fairly valuable resource that we have here. Our rivers and waterways support a number of environmental values. In Southeast Queensland, for example, it supports aquatic ecosystems, cultural and spiritual values, supports primary recreation. We love swimming in our waterways. Secondary recreation, of course, human consumption, aquaculture, industrial use, and predominantly around the world drinking water. However, these values are threatened by multiple pressures, such as the development of water resources that tend to alter the natural flow of our rivers, such as water storages, hydropower plants, runoff coming from different land uses, agriculture, urban areas, industrial areas, and in some rivers, we still see a lot of rubbish and garbage. On top of that is the whole challenge of climate change. We can't just keep on doing what we're doing now. We can't just do a little bit more. We have to do a lot more because we have to counteract climate change. So it's not a surprise, and our speaker yesterday from the Asian Development Bank, when we launched the Asian Water Development Outlook Document in 2016 yesterday, that the first Outlook Document outlined that 80% of the rivers in Asia-Pacific area are in poor condition. The red line there indicates where it's poor, so you only have a few countries there with rivers that are in good condition, and they are, of course, New Zealand, Australia is in there, but the rest are really in poor condition. We have put too much pressures on our rivers to actually give them time to cope. And what we have done as water managers, water scientists, water advocates, we have been very active in coming up with multiple solutions for multiple pressures. The diagram you see there is actually a diagram developed through the International Water Center, which basically displays the different types of solutions that Southeast Queensland had put in place during the millennium drought. So we had wastewater reuse. We had water-sensitive urban design We had a reduction of nutrients coming from our wastewater treatment plants. We have best practice agriculture, so all the different types of solutions that we could possibly put towards the catchments to ensure that our waterways are coping very well. So I'm sure you would have had a pleasure of seeing Brisbane River. The Convention Center is actually adjacent or alongside the Brisbane River, and Brisbane River as you see it now is actually a result of a number of years of work and commitment by the, as Marion has indicated, whole of government, the community, and the researchers who have actually put forth a lot of effort in where Brisbane River is at now. But our colleagues at Healthy Waterways and catchments would know that that's not good enough. Brisbane River still has a lot of room for improvement. How are waterways responding? Now, there are different waterways respond differently, and these photos here were given by a dear friend of mine from Passig River Commission. So you can see a before-after shot of Passig River, exactly the same shot. The first photo, as you can see, a lot of rubbish. The next photo, the effect of the removal of that rubbish and the planting of different types of vegetation actually improve that aesthetic condition. This type of response is very easy to track. It's very easy to observe because it's very visual. And usually that's a very, what we call as a low-hanging fruit. You have to get rid of the rubbish. You have to get rid of the garbage. In so doing, and I know Ramil from the Passig River Commission was challenged with this, the relocation of some of the people who were living on the side of the rivers and literally discharging directly onto the river had to be relocated and had to be given alternative livelihood. But look at it now. You could actually see it. That's how the river is responding. It loved it. In Southeast Queensland, through healthy waterways and catchments, there is a monitoring program called the Ecosystem Health Monitoring Program that has been running for over 10 years now. It's a very extensive monitoring program. And to some extent we are more challenged here with monitoring because we really are monitoring now the chemical and the biological features of our waterways, not just aesthetics because we've cleaned the rivers already from an aesthetic point of view. We then now have to look at the chemical and the biological factors. The map you see there is a map of Morton Bay and most of you would have seen Morton Bay as you fly into Brisbane. The Bay water quality actually shows an east-west or west-east gradient where you have the eastern part, the blue areas, our clean, pristine water quality. It's actually a very special part in the world. It's the only place in the world where you could actually stand on the blue part there, sit on a boat, I mean stand on a boat and see dugongs, turtles, healthy seagrass, very clean water quality, turn yourself and see the city skyline, see Brisbane. So this amazing juxtaposition of very pristine high biodiversity area with juxtaposition with a highly urbanized area does exist and exist in Morton Bay. The areas on the western part though are more turbid. They have higher nutrients because we've actually positioned our sewage treatment plant discharges on that part. So hence you have the east-west, west-east gradient. In 2000, the different governments, local governments and in collaboration with Australian government actually invested about $400 million to reduce wastewater. The graph you see there is actually the reduction of nitrogen. The blue one is coming from the largest sewage treatment plant we have, Luggage Point. Most of you would have heard about that through the two days and you see by 2000 there was a significant reduction of nitrogen. The other plants also followed. So there was significant reduction of nitrogen from the sewage treatment plants. So how are waterways responding? This is a sewage map. What you see there in red is sewage. It was actually measured using a radioisotope signature, Delta 15N, it's a very specific signature for sewage. And you can immediately see that where there's the discharge of Luggage Point and the other sewage treatment plants associated with other local governments, you actually see and can measure sewage. After the commitment, with the commitment of several millions of dollars from local government, you actually see the sewage decreasing in the bay until such time here in the last graph, really, there's only very little sewage. That's a major accomplishment on the part of the local governments. But they did that because they had visually a map that could tell them that there is sewage on the bay. So, and it is very visual and that means they have to do something about it. So, and hence the power of being able to tell the managers about how our waterways are responding is very critical. The graph you saw before was powerful, but maps like this are more powerful in actually showing the effectiveness of management interventions. So, how do we listen to our waterways? We monitor them. But we know that in most places, even here, we're not exempted to that. Monitoring is always seen as an expensive activity. In developing plans for waterways and rivers, it's always put in as the last. We would like to monitor them, but monitoring is very expensive, especially when we embark on the chemical and the biological monitoring programs. I did this engram, a very quick engram, which basically shows in the 1990s, you actually see an increase in the mention of monitoring in the publications around the world. And that's because I think that's when we kind of gleaned that our waterways are getting to be polluted. And so we started monitoring them and it's still going up.  The traditional ways we graph, we put them in tables, and you saw the ones before, we reflect them in maps, which is probably more visual than just graphs and tables. And in most cases, they're left and put on the shelves and it's predominantly the regulatory agencies who would like to use them because they have to use them as part of their mandate. Now there are other ways by which we could reflect the results or the reactions or the responses of our rivers better. And one of that is through waterway health report cards. And this is giving our waterways a better voice and a voice that could actually reach out to a broader audience. So why healthy waterways or why waterway health report cards? It's very simple. It's the same phenomenon or it's the same process or principle as a school report card. So your kid comes home with a report card, you know he or she did well because he or she got an A. Well, he didn't do very well in some subject because he got an F or a D. So healthy waterway, but the report card in the school, the teacher actually uses a lot of exams, participation in class, a lot of different parameters to actually come up with a report card. The same with a waterway health report card. It enables large and complex data to be communicated to a broader audience because it's easy to understand. It directs and focuses management action. So you know that your child will have to do better in maths because he or she got a C instead of an A. So you can actually target management interventions with using a report card. It identify regions or issues of concern. It also provides accountability. And I'll show you some examples of this later on, measuring the success of effort of management actions. And it's a framework for monitoring activities. So it allows you to prioritize your monitoring activities. So you'll see there a lot of examples of report cards. The S&Q Healthy Waterways partnership then first released a report card in 1998. And I know Paul Greenfield who's in the audience would know that that wasn't a very smooth process for us when we first released it. There were a number of factors why it wasn't as smooth as we wanted it to be, which we could share with you later on in the discussion. But the report cards are now becoming very popular because it has been very effective in raising awareness. This is an example of the type of awareness we get out of a report card launch. And this is just about 30% of the print media. And I mean, this is print. I don't even talk about the audio and the video media that we get after a report card is launched. So it has increased awareness, different types of headlines, of course. So it does command the headline of our print media for a week or a month after the release. As I indicated before, we could use report cards to identify issues of concern. Once again, the map of the bay, that part of the bay got a D minus and the bottom bit close to luggage point got an F. And that was because during that year when we were monitoring that, it actually reflected some algal blooms due to the increase of nitrogen going into that part of the bay. So you can highlight that these are the areas that we need to look at and manage a bit more. Now, I've done this graph to really show how in a simple way, we could actually use the report card ratings to provide accountability or to track the effectiveness of management interventions. So the first, I started with the 2002 report card. Generally, through that time, Morton Bay held on to a good rating in spite of increase in population, and that was because of the significant investments in sewage treatment. So you might say, okay, it maintained a B, but the bay maintained a B despite the population increase and that's because of the investment of local governments in sewage treatment plan upgrades. We had a wake-up call in 2009 for the first time the bay declined to a D, which is equivalent to a poor and boy, did the media love it. The headline went crazy. First time, for the first time in 10 years, the bay was poor. And that was associated with a high rainfall after a decade of drought. But you don't just blame rainfall, you actually blame the catchments and the stuff on the catchment that was brought down to the bay by the rainfall. So the message there is we need to look after our catchments all throughout the period, not just during a high rainfall event or when there's no rain. The bay did pick up and to some extent, this is a story of resilience. So the bay recovered slightly when we had the 2011 flood. It went back to a C. It, 2011 flood came on top of this recovery. It still maintained the C. And at the moment, the B is hovering between a B minus, a C and a B minus, which is good. So it is a story of resilience that it was able to pick up after that call that we had in 2009. So it's there. The challenge that we have put forward in our future of Motton Bay business case is there are two options. We need to invest more in protecting our woodways and with that, we should be able to maintain a B, a good rating for the bay by 2030. If we do nothing, we have increased in population. We talked about climate change and there's a high chance the bay will go down. So these are all predicted. So these types of visualization we could use to actually tell the story to our politicians and to the managers. So, excuse me, I always have to say this all the time because people forget that, because A, B, Cs and Ds are very simplified, they forget that the report card ratings are actually backed by rigorous science. And if there's not enough monitoring data, we do look at expert opinion, but that's still very rigorous science. So if we were to graph increasing science quality and increasing communication quality, by the way, I give credit to Bill Denison who we work together a lot. If we were to graph that, the modern scientists would definitely be on the increasing science quality. That's where we thrive, we publish in nature, we publish in science. The politicians are on the other hand in the increasing community quality, that's why their politicians, they speak very well. What we want is basically the truth to power here for our stakeholders. And usually the report card is very effective in driving this. We want increasing science quality but also effective communication quality. But monitoring is not enough. You can monitor your waterways until you see the last fish or until you see the last seagrass. So I've put this quote up. The activist is not the man who says the river is dirty, the activist is the man who cleans up the river. So we need to do more than just monitoring. And that's where IWRM comes on board. I did another Ngram of IWRM and IWRM did actually increase together hand in hand with the increase in monitoring. So the global water partnership has provided a general framework for IWRM which looks at economic efficiency, considering social equity and ecological sustainability. There'll be some questions about this later on. IWRM became very popular in the last two decades. The question we have to ourselves, why have our rivers not improved that much? Do we need to do something? Do we need, how do we operationalize IWRM more? I'd like to showcase healthy waterways and catchments. It's an independent not-for-profit organization. We have been involved, it has been in existence for over 20 years now, has gone through different types of government. The vision is very solid. It works with government, industry and community to protect and improve Southeast Queensland's waterways. It influences decisions, policy and actions to improve and maintain waterway health. And it releases the report card every year. And I'll finish with one slide. And lately it's merged with SEQ catchments. So healthy waterways is actually a very good example of how IWRM can be implemented. I won't go into that detail of adaptive management because I'm running out of time, I've got two slides. I'd like to share the difference between studying a problem and solving a problem, and this is once again from Bill. When we study a problem, we tend to detach ourselves. We're not as passionate. When we have to solve the problems of our waterways, we need to be passionate. When we study, we have to embrace complexity. When we solve, we have to simplify. We have to involve people. When we study, we publish and fund in peer-reviewed journals, but in solving, it's quite different. These are different journals that our stakeholders want us to put our work in. In studying, we need to get it right, but in solving, we need to get it done. So, last one. Hall of System Understanding and Approach in Developing Solutions, Recognizing Trade-offs and Ecosystem Services, Strengthen and Support the Implementation of IWRM Plans through PPP, Innovative Financial Mechanisms, and Ableing the Communities, and lastly, listening to our waterways monitor, model, and communicate. I'll put this as a placeholder for the Basin Leaders Forum later on, but before I do a 50-second video after this, I would like to acknowledge the key players in what we are doing today in terms of waterways here. Paul Greenfield, Bill Denison, and Stuart Bahn, SEQ Healthy Waterways Catchments, the GCI Photography Competition that you've seen before, Leith Bully, who shared with me her photos, and the last one, I would like to indulge you in a very short audio video that will happen here. It was done by Leah Barclay, who's a musical expert, and what Leah has done has actually captured the different voices of our rivers, and this one is from Nusa River, and this river got an A rating, and I'm finished then, Ganesh. Dolphins, insects, fish, water bubbles. Thank you very much.


Sayo, Belinda Bodechins All kinds of stuff That is nice, that is so dope You need to have a side hustle So who is your inspiration when it comes to music? I like Beyoncé I like that she can multitask She can be a mom, she can be a wife She can be a business lady And she is quite the performer I like that about her So thinking of also going that way You want to be like that You know have amazing performances You know dance and everything So everyone can just be attracted to your music What about in Kenya? Who would you like to work with when it comes to the Kenyan industry? I like to work with I love Saltisone They have really nice music I like calligraph I actually do like calligraph music I would really like to work with calligraph And Otile And Femi Femi is my home girl I would also like to do something with her Okay There is a point Ilifika And you decided to rebrand Tell us a bit about that rebrand And did it come from the break that you took? So me and my management We just sat down Discussed about it So that is the best way to go And so far I have seen Reviews about it And people are loving it Alright So tell us a bit about your new track What it's about And how is the reception out here? My track is called All Night It's about a crash Singing to your crash Just expressing yourself Telling them how you feel Because maybe sometimes you may be unable to approach them In person So you just express yourself through music Most of us can relate to such a scenario We all have crashes Maybe we are unable to approach them So this song would be a nice new passion It is always hard to approach a crash And it is risky It may work in your favor Or it may work against you So it's a gamble But it's better expressing it in a song Because I know so many people can relate to it Actually I've gotten very good reviews People love the music People are so supportive My family, my online family, my friends I'm so happy I feel so motivated So I'm going back to the studio And working on something hot So expect something soon Are we going to dance? Of course I want you to dance so much I want you to be dancing High vibration music that makes you be joyful Be happy We are going through tough times So we need something to boost our morale Something to keep us lively So where can people find Your new song and the ones But before you tell us I want us to take a short commercial break We'll be back And of course we'll be dancing We have to dance And I am dancing whether you like it or not Don't go anywhere We'll be back We have Wanjake in the building I said she's an amazing performer I want to dance With my left foot I am dancing I want to dance I want to dance You remember that coach? Yes That was tough Please listen I am embarrassed myself but it's okay I don't care Wanjake you talked about a business Tell us a bit about Travel business and the jewelry business And where people can find those two So my tours and travel business is called Linkups Adventures And we have very nice affordable packages If you want to travel Be it Marra, Coast Dubai name it Any place we have affordable packages You can also give us We can tailor make a package for you Give us your requirements Whatever you want to make a nice package for you To fit even your budget If you want to go You'll have a memorable experience So our motto is We are fun meets adventure We drive on having fun And adventure Turu di kwa rebrand kido go What happened between that time You decided to rebrand Tuwambiai leka jinaul kuna jita kitambo And then kwa ni kwa decide kwenakwa Wanjake I used to go by the name Peach It was also a nice name Pitch like the fruit It is nice, it is unique It is a sweet name Flipo ah Kwa yuki jana So Me and my management we sat down When I came back to the music game Me and my management we sat down And we decided to Head towards Wanjake It's more of an African name So it's good sometimes it's nice to go By your African name so that even when people across the world listen to your music They know this one is an African woman Maybe from Kenya It's an African song And all that yeah We decided to go that way And so far there has been positive reception People are loving it Everyone I'm just so happy I'm feeling motivated People are very Let me just say People just like the name What does K stands for Kinudia Kinudia is my dad My late dad may rest in peace I wanted him to be Part of this musical journey Because he was also so supportive Of my businesses, of my music So I want to keep his memory To live on in me Do you have any collables coming through We are working on that We are working on that So let's just Wait for something hot I don't want to talk much about it You won't talk much about it But suki premium Of course So where can people find your music One more time So please go to my YouTube channel It's called Wanja K Subscribe, like, share On my Facebook I'm Wanja K K is K-A-Y On Instagram and Twitter Is Wanja underscore K Is Wanja K So make sure you don't miss out on Tik Tok Yes I saw you have very nice dancing videos I watched a couple I liked them There is someone asking Wanja is single She is a mum But Wanja is single Let me just say A single mum Beautiful Tuachiap I am a single mum I am a single mum I have a single mum I am a single mum I am a single mum I am a single mum We have no problem We have no problem I am a single mum We are single So what is your school? High school High school I was a Gito girl She was a Gidongori Gidongori was a Gito girl She was a Gito girl High schools have She was a Niki girl She was a Gito girl She was a Gito girl But the school was Gito girls Greetings to all my classmates Greetings to all my classmates I used to lead In the school I have loved singing since I was a young girl I used to go to primary school I used to go to Mount Laven academy It was a Catholic school I used to go to choir practice It was a must every day After class It was a must we even had choir books We used to go to church Catholic school It was a must It is a nice school up to today We used to become the best Catholic primary school in Kenya What is your experience in boarding school? What is that one story I am not sure That one story How many stories do you have? I have 7 I have 7 I have 7 I have 7 I have 7 I have 7 We know deputies are Displinarians We have to be tough We hear that Because 9 was called woha manyaovehisha ki uli snowo baby they did not know but they try to help us out dh wow wumasting and mpa We want to hear those crazy stories, interesting stories on our social media handles. We are waiting for them. And remember our hit or miss track, so end up on a Twitter, cast your vote whether it is a hit or a miss for you. And coming up in a few minutes is request hour. So to my request, so long as it's a Kenyan song, alright? So up next is Wanja Kay to cut tickets.


Hello and welcome to this presentation. My name is James Sakoko. The title of my presentation is Molecular Epidemiology of Brucellar Species in Mixed Livestock Human Ecosystems in Kenya and Tanzania. Brucellar species cause infection in animals and humans and results into socioeconomic losses. Several studies have reported the presence of Brucellar antibodies in Kenya and Tanzania, but information on circulating species of Brucellar within the region still remains insufficient. Therefore, we collected a total of 1,051 samples from cattle, sheep, goats, camels, pigs, and humans, from Marsabit and the Narrow Counties in Kenya, as well as Northern Tanzania. We extracted DNA from these samples and tested the DNA for the presence of the genus Brucellar, as well as Brucellar botas and Brucellar militancies using real-time PCR technique. Our results shows that Brucellar botas and Brucellar militancies are circulating in human population, as well as all the livestock species, except pigs that only tested positive for Brucellar botas. The distribution of Brucellar species varied across the different regions, with Northern Tanzania and Narrow having a higher proportion of Brucellar militancies as opposed to Brucellar botas, while Marsabit region had a higher proportion of Brucellar botas. We did not find any significant association between Brucellar botas and sheep and goats, while Brucellar militancies didn't have any significant association with cattle. We found significant association between currents of abortion and the presence of Brucellar botas, while Brucellar militancies were associated with the return placenta in animals. People within the age category between 21 and 40 had an elevated positivity rate. This is mainly due to their increased role in taking care of animals. So in summary, we found zoonotic species of Brucellar circulating the different animal species, suggesting that all these animals would be playing a role in transmitting Brucellar to humans. Therefore, we commend a multidisciplinary approach that target all the different lives of species to help in creating public awareness and contribute to the reduction of the existing risks, such as improper handling and disposal of aborted materials, return placenta, drinking of raw milk, as well as mixing hearts that could perpetuate the transmission of Brucellar within the population. Otherwise, if nothing is done, then we still have continued transmission of Brucellar that results into socioeconomic losses. Thank you very much for your attention.


Skupaj, lebov. Što mi je zelo, je to neki potečno prejavno. Svej je neki, kako začali o Kiklok? Potečno. Nekaj nekih nekaj, ki so nekaj način, ali možemo neki. Tako, najbolj pošličim, da jim dokega prejevno prejavno in zelo se, če je to? Tudi je vse pripunetjega za vse izmaženji. Zelo sem tukaj na vse na draženja. Fibršanje je, da narednje obršnje navokas prehodski vs. na weedični ostat. Ne plumetje, ki vse je tukaj u padu teželji vse magam, ki se naredno vse odlega. And SSO, or single sign on, means that you can point more applications to your KeyCloak server. And when you open your first application and this application redirects to KeyCloak SSO and user provides his username and password, then after he opens second application he is automatically locked in and he doesn't need to add his username and password again. Single sign out is kind of the same thing, but for logout, so when you logout from one application in your browser you are locked out from the address as well, and everything is based on standard protocols like OpenID Connect and Summer2, Out2, and UMA. So all the exchanges and messages between the browser and between client application and KeyCloak server are standardized. Identity management is a very important part of the KeyCloak because KeyCloak has a database which is able to store all the metadata about users and roles and clients. So basically when you have traditional application, when you develop all the security by yourself you usually need to develop login forms when your users need to provide username and password and you need to implement storage for users so that you have database where your users are and you need to care about all the things like password hashing and when you want to add some more things like registration of users or things like forget password link on the login screen you need to have lots of things to implement and if you use KeyCloak then all of those things are available for free for you. KeyCloak also has lots of UIs so admin console allows to easily manage your users and other metadata. Account management is useful for end users so they are able to see their profile and they are able to edit their passwords or other credentials like TOTP for example and we of course provide login forms and optionally things like registration forms or those things like reset passwords and so on and there are much more cool features like KeyCloak can be integrated with social providers like Facebook, Google or Twitter so that you delegate authentication to those providers. It's possible to integrate with any other OpenID Connect provider or some other provider. It's possible to point KeyCloak so that it can provision users from LDAP or SSSD. There is support for TOTP or Kerberos authentication. There is support for Teams which allows you to customize login forms so that you can add your own CSS and events are for monitoring and there are lots and lots of other things. But like one of the most important things is how you actually secure your application and what is helpful here is KeyCloak adapter which basically is client side implementation of the OpenID Connect or some specification and you usually don't need to quote anything in your application. You just need to provide configuration of KeyCloak adapter and usually add some dependencies or something based on the adapter implementation but typically it's very easy to integrate your app with KeyCloak and for adapters we have adapter for Javascript application, we have adapter for like server or web applications deployed on Valkyrie, JT or Tomcat. There is Fuse adapter, Node.js adapter, a server filter adapter. There is Spring Boot and Spring Security adapter which I will show in the demo and we have also generic adapter like Gatekeeper which can be used for any other kind of web application. So this picture shows how OpenID Connect flow looks like. The most important part here is that when user opens browser and wants to access any application, the application just directs to KeyCloak server and after user authenticates on KeyCloak side then there is some other handshake but in the end application will receive ID token and access token which is signed by KeyCloak server private key and then it can verify, like later in later stage that this token can be verified by public key. So typically those like frontend applications are accessing some REST services and they can access them with the access token which was signed by KeyCloak and the service which is also secret by KeyCloak can just read the token in REST HTTP requests the token are sent in the HTTP header and so service can just read it and it can verify the signature on the token and it doesn't need to communicate with the KeyCloak server itself so it's also very good from the performance perspective. The only thing needed is that at the very beginning the service needs to download the public key from KeyCloak but then it can use it for verify thousands of tokens and there is also possibility that service will always verify token but like online verification but that's not so performant. So in next step I will try to show some simple demo of KeyCloak. So I have already KeyCloak running so I will just restart it and I will run it on port 8180. So if you want to try KeyCloak by the way it's very easy but you just need to download KeyCloak server from the KeyCloak home page and you need to unzip it and that's all. So if you want to try some playing with it it's usually a question of few minutes or you need Java but that's really the only requirement so it's really, really easy to setup and at this moment I can open admin console of KeyCloak and I will login as the default user admin and at this stage we can see that there is admin interface where I can look at existing users so at this moment I have just one user admin but what I will do now is that I will add new realm realm is something like abstraction for handling set of users and set of client applications which will be able to share same SSO session so simply said and I will import new realm from JSON file so one of the great things on KeyCloak is when you preconfigure your realm with all your data and users, clients and so on you can just export it into JSON file and then you can import it from this JSON file later which is good if you need to migrate between different environments like from stage to production and I have realm which is called cars and I have imported it from the JSON file and I have few simple users here like user Alice and she is member of some roles like there is a role called user which is important and clients are something like abstraction for client applications so I have client called cars app which represents my application which I will later show and there are some meta data which needs to be configured on KeyCloak site for that client like the value to redirect to this for example where KeyCloak will redirect after the authentication is finished and so on and the cars service represents like rest service which can't itself start the authentication but it's able to receive better tokens which are sent to it from the application which may be cars app and in the IDE I will probably switch it to presentation mode so in this IDE I have two apps sorry so app and service and so the service is just rest service and only thing which I needed to do and it's spring boot it's spring boot rest service so it has application properties configuration file and here I just need to add few things few meta data about KeyCloak like point the service to the KeyCloak server and to my realm and to cars service is name of the client on KeyCloak site there is also client secret which is used for secure communication between client application and between the KeyCloak server and here those security patterns security constraints are like typical for JEE server applications so basically when I want to access anything under cars I need to be in the role user and I need to have some dependency on KeyCloak spring boot starter in my POM XML and that's all which I need to have in my app for my service for the app it's similar I just have this configuration in application properties and this app is it represents frontend application and it uses spring boot and spring security so it has also this bin and security constraints are configured here so it also requires role user to be accessed so I will just run my service and my app I am just running it from IDE I hope it will start fine and I will open my app on this URL and it was on port 8080 and you can see that I was directed to the login screen which is KeyCloak login screen so this login screen is provided by KeyCloak server and when I put some username and password of user Alice I need to also confirm the grant screen this is optional thing that if I configure like consent required on my client it means that this consent screen will be shown to users and user basically needs to grant some permissions to client application that it can access his email and his profile and some other things there are lots of similar fine grade configurations if you want some customizations but for basic integration it is really very easy to try it and now I can see that I am successfully authenticated and this informations about user like username, email and name are provisioned from the token which was sent by KeyCloak and it contains some metadata some data about users and some other metadata like informations about his roles and with this I can send rest requests to service and I can... my service is able to create new cars and ask for existing cars and delete cars and it provisions also pictures of cars so I can look at this nice snowplow for example and when I logout and login as different user JDo I can also create some cars but I have also access to all the cars which were created by Alice because there is basically no fine grade authorization so all users which have role user are able to access everything right now so in next step we will try to look at the fine grade authorization capabilities which KeyCloak provides and it's quite new thing like KeyCloak is mainly now for providing authentication but we recently added also authorization support and the idea behind it is that we want to decouple authorization from services and from applications as much as possible there is also aim to have dynamic access control model we also want to be stick on standards like OpenID Connect and UMA and there is also aim to have privacy support and things like enable sharing of resources between users so for example users are able to share their documents or their photos with other users and we want to achieve all of this with ideal performance and ideally with not so much requests needed to be sent between KeyCloak server and the service and applications so the command authorization approach is usually role-based or group-based authorization so for example when we want people managers to be able to access information about any employee you usually in your application ask if an authenticated user is in a role like people manager this is sufficient for lots of the applications but for many others it may not be so nice because for example when there is some change in the business requirements the role-based authorization may not be sufficient basically for example you may want that some user is not able to access salaries anymore but you still want him to be in role-people manager because this role is used for many other things in your application and here you have an issue and because your authorization based on roles is not fine-grained enough so the proposal is to rather focus on things which user can do and on the resource which he wants to access so for example instead of do checks based on roles we will ask if user is able to do some action like access salary of employee or if user is able to change salary of some concrete employee John Doe so basically when x can do y on z the x is in key-clog authorization model the x is user which wants to do something y is action which is called authorization scope and z is resource so in the example above is something like this employee salary and policy is the actual implementation of the authorization rule which can decide if access is granted or not and permission is basically like binding between resource and scope and between the policy and final result is evaluation this is not part of the model but evaluation is important to decide if access is granted and more policies can be added to permission so the overall architecture looks like this it looks a bit tricky maybe but it's quite easy in the end so when we have client application which accesses resource server resource server is basically rest service there is usually policy enforcer which is deployed together with the resource server so it's typically part of key-clog adapter and this policy enforcer checks if authorization requirements are met and it can invoke key-clog for this and key-clog provides some less APIs like authorization API and protection API authorization API is for doing authorization decisions and protection API is for managing resources and permissions and other objects and administration is possible from key-clog admin console but lots of things are accessible through rest API and key-clog also provides storage for all the metadata like resources, scopes, permissions and policies and evaluation engine that is able to decide if access should be granted or not so for configuration of fine-grained policies basic configurations you need to create some policies and resources scopes and permissions on key-clog server side and on the service side on the adapter you need to have policy enforcer so I will try to show this so my basic service which at this moment doesn't use fine-grained authorization so I want to add some more fine-grained authorization for specify that just some so I want to have fine-grained authorization for creating cars right now so the first thing which I need to do is to enable this authorization switch on my car service and when I save it I have new tab called authorization and here I can add some resources for example so this default resource is always created by default when you create when you enable authorization for your service so I will create new resource called car resource which will represent car and so this play name will be car resource as well type is not mandatory so URL is not mandatory but I will use cars because my service is listening under cars and scopes are actions so I will need to create some authorization scopes or action which I want to do with cars so I want to be able to have scope for creating car and for example also for viewing car and I want to add those scopes to my car resource and yeah so I have now resource and scope and I need policy which will be able to decide so by default there is default policy here which is based on javascript and I will for policies we have lots of implementation of various policies like role based policy it's really maybe simplest one and it just checks if user is in if user is member of some particular role so I will just start with this one and I will specify that user needs to be member of admin role to pass this policy and I need to create permission which is the last thing and so I want to specify that for creating cars so I need to use car resource and scope car create so creating cars will be possible just if user is admin so I bind admin I associated admin role policy with this permission and evaluate app is very great because I can check if my authorization rules works as expected so I will try to check if user admin is able to access car resource or to create car and here I can see that it's permitted nice but if I try different user like Alice for example it shouldn't be permitted of course because Alice Alice is not member of the admin role she is just member of user role so at this moment when I go back to my application and I will log in as Alice I am still able to buy new car because I didn't configured the policy enforcer which is needed on the adapter side so it's this application properties file and I will just uncomment policy enforcer it's not so hard to write it by hand but you know during presentation it's safer to pre-configure it so this configuration specify that when the rest service is accessed under this URL like cars create then the car resource and car create scope will be used so policy enforcer will basically check if user is able to access car resource and the scope car create and this permissive switch on policy enforcer means that just the URLs which are specified will be checked by policy enforcer but the address which are not specified won't be checked by it so for all the other things like viewing car and deleting car it's still possible to do it just for simple users which are just in the low user and I need to just restart my service and when I click create car right now it's not possible anymore but admin user should be still able to do it yeah it works so he was able to create that Ferrari or that Mixel that's nice so we saw just basic policy but there is also possibility to use more tricky policies so javascript based policy is very powerful time based policy is very nice for demo purposes because we can for example specify that some action is possible just at 25 days of the month which is today so if I specify it like this and I will add this new policy to permission then yeah so decision strategy unanimous means that both policies needs to be met so that overall decision is approved so you can think of unanimous like logical condition end so user needs to be admin and action needs to be done on 25 days of the month like affirmative is like all so if I use affirmative it would mean that user needs to be admin or it needs to be 25 days of the month so on 25 days it will be possible for everyone to create car but that's not what I want you mean here? I think that I need to type first character or I can yeah I think that yeah you need to know at least first character it's something which is yeah it's like if you don't know it it's maybe not so intuitive maybe but in most of the cases you usually know this so it's like maybe there are some possible improvements of UI but I'm not sure to be honest I'm not expert on UI so for me it's just fine but yeah so if we retry it we can see that admin is able to create car because both policies vote to permit and if I change so it should be still possible for admin to create car but if I change the policy and I will change it to for example 24 days of the month then yeah it's not possible anymore and admin can create new car so I will change it back and it will be possible to use both 24 and 25 and admin should be able to create new car yeah so we can see that without changing anything on the application side but just changing the policy the authorization rules is immediately like updated immediately applied so in next step I will try to show like user managed access or UMA which is like very nice extension of the authorization capabilities provided by Keycloak and main message behind it is that users are able to share resources with the other users and part of this is also asynchronous authorization so typical use case for asynchronous authorization is that J.Dow wants to access some pictures of user Alice and he doesn't have yet permissions to access them so he just send request to Alice to be able to see her pictures and Alice is notified about this request so she just approves it and J.Dow can now access Alice pictures and anytime Alice can decide and revoke access to her pictures so you probably know this use case from applications like Google Drive when you can share your documents with other users and if someone sends you a link and you don't have permission to access any document you click to something like request access and the owner is notified about this and he will grant you access so with this it's basically easy to or much easier to add some capability like this to your application secured by Keycloak so one related thing to this is RPT token which is basically access token with permissions and it can be used by frontend application to send requests to services which are protected by policy enforcer and then the policy enforcer is able to just verify permissions inside this RPT token so in previous demo we didn't use this RPT token so the frontend application sent just normal better tokens to service and service policy enforcer needed to always send request to Keycloak to verify if access should be granted or not it's good that you were able to see that it worked in real time but the performance of that is not so great so with this RPT token usually better performance because when you repeatedly want to access any resource the permission is already in the RPT token so service is just able to grant this and in case that the permission is not in the RPT tokens then the UMA ticket is sent from the service to the application and application is able to exchange this ticket with existing RPT token to Keycloak server and if Keycloak server decides that access should be granted then it will send new RPT which will contain all the old permissions and new permissions as well so it's something like incremental authorization when the RPT tokens contains just those permissions which are needed and which were asked by the service and Keycloak provides restful APIs so authorization API is useful for managing for obtaining those RPT and protection API is used for managing resources and those things like permission tickets so if you want to have to use this fine grade authorization you actually may need to add some code to your application because for example when you car or new photo or any other resource then usually you need also to create resource on the Keycloak server side so that Keycloak is able to later associate ACLs with this particular resource so if you want to being able to share a single photo or single car you need to have resource per car and otherwise if you want for example share album you may need to have resource just for album so it's like usually it's some tradeoff between how fine grade your authorization need to be so in the demo I will so I will stop the service end up and I will just I will just try to switch to different branch when I have when I have ok so so I will just check out to some different branch when I have already someone more in UMA in UMA integration code done in my app so in this case I also have things like when user creates car there is resource created so Keycloak has admin client I will probably just so Keycloak has admin client written in Java like create new resources or delete resources as needed but everything is available through the rest API as well and those APIs are documented so it's useful for from any language and now in so in admin console I will just delete my realm and I will create new one because the JSON file in my new branch contains some more fine grade configuration of the policies and now you can see that I have permissions so creating car permissions creating car is possible for any user but like being able to view car or view detail of the car is possible only for owner and administrators and this policy only owner and administrator policy is like aggregated policy and it contains of two other policies so it's affirmative so it's like or so if user is owner he can do everything and if he is administrator he can do also everything so one of these conditions needs to be met and any admin policy or administration policy consists also of two policies like any admin policy just checks if user is admin but there is also a requirement that admin can access key clock from specific IP address so there is javascript policy used here and as you can see javascript policy is very flexible you can check for things like IP address and only owner policy is also based on javascript and in javascript you have access to some properties like identity which means authenticated user and resource is the subject of the policy and here we check if owner of the resource is equivalent to identity so that's the configuration key clock side and on my upside I will just run the service and application and I think that now when I log in as service for example I am able to create new car and in RPT token we can see that it contains just permission for creating car but when I ask to view details of this like nice Volkswagen transporter hippies bus I can see that RPT token contains some more permission because like policy and force created ticket and RPT token now edit key clock grant me permission for viewing this new resource but when I click this again there is no no need to send another request from service to key clock because the access is already granted and point of UMA is that management of key clock when users can read a profile and for UMA they can also share their resources with other users so I will for example just share like this Volkswagen transporter bus with the JDO user and now when I log in as JDO I am able to create my car but I am also able to view this view I am not able to I am just able to list it but view details is different scope so I need to ask ask Alice if she can grant me the access for viewing details and when I log out and I log in again as Alice in her account management she can see that JDO ask her to being able to view the hippies bus so if she approves it the user JDO should be now able to view this bus so as you can see you can do lots of other things with this and I think that's all which I have there are some additional questions if you want to try Kiko or access this demo or if you have any general questions you can look at Kiko who is the mailing list or at my mail and do you have any questions yeah you choose to create the key but without having to store yeah so can you repeat yeah yeah so it's possible regarding this authorization it's possible to have authorization based on users or based on user attributes as well and in general in account management users can edit some simple attributes of themselves and this page is customizable so you can add some more things for example address of user or phone of user is this what you mean to having more claims or attributes of user so what users can do is that they are usually not able to manually create the tokens or something like that but it depends on what application allows them so I think that probably not like when you are creating tokens is not anything which is directly permitted because you usually need other things like client credentials and so on so tokens need to be created on behalf of the client as well but not sure maybe I misunderstand your question sorry but we can discuss maybe after this session any other questions how often does the application need to acquire a key clock to get the info about user's permissions so the life cycle is configurable and it's configurable usually paired realm but can be specified on clients as well but on the realm it's not for the values things because as we have the values use cases like we need to add more and more timeouts but the most important for this use case is access token lifespan which is 5 minutes by default so the RPT token is also valid for 5 minutes so for example if some permission is granted in RPT after 5 minutes the RPT token always needs to be recreated and because it's usually tradeoff between changed authorization criteria and the performance if you want to have something like online performance which we used before in the second demo we may not need this RPT at all but then your service will always need to query key clock and if you use timeout like this it can happen that there is some stale info in the RPT token and the authorization shouldn't be granted anymore but it's usually just for a few minutes so like 5 minutes is a very good tradeoff for most of the applications and OpenID Connect in general have support for the refreshing tokens so usually after each 5 minutes the token can be or is refreshed but if the session is not valid anymore the refresh won't happen and also things like those will be will be like always refreshed so I think that's all and I'm sorry we're out of time but if you have more questions I will be around so we can discuss later if you want so thanks everyone for watching