Keycloak: Open-source identity and access management

#1

Post by fanf2 » Tue, Apr 14, 2020, 8:43 PM UTC

Keycloak: Open-source identity and access management
keycloak.org

Re: Keycloak: Open-source identity and access management

#2

Post by captn3m0 » Tue, Apr 14, 2020, 9:07 PM UTC

Anyone here using Keycloak for a home setup? I've been considering this v/s https://www.ory.sh/, which is more OIDC focused and can't decide.

Re: Keycloak: Open-source identity and access management

#3

Post by xupybd » Tue, Apr 14, 2020, 9:17 PM UTC

I've been meaning to play with this for a while. I'm planning on evaluating how well it works as an authentication layer for Hasura. Hasura looks really nice but would be no good to me without an authentication layer. I found this connector as a stat point https://github.com/httpsOmkar/keycloak-hasura-connector

Re: Keycloak: Open-source identity and access management

#4

Post by realdavidops » Tue, Apr 14, 2020, 9:19 PM UTC

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective.

Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.)

Running in Kubernetes with RDS Postgres in AWS.

Re: Keycloak: Open-source identity and access management

#5

Post by toomuchtodo » Tue, Apr 14, 2020, 9:22 PM UTC

realdavidops wrote: post #4

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective. Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.) Running in Kubernetes with RDS Postgres in AWS.

Any pitfalls you’ve encountered when implementing?

Re: Keycloak: Open-source identity and access management

#6

Post by madjam002 » Tue, Apr 14, 2020, 9:27 PM UTC

captn3m0 wrote: post #2

Anyone here using Keycloak for a home setup? I've been considering this v/s https://www.ory.sh/ , which is more OIDC focused and can't decide.

Yup, it’s good, I use it with the recently introduced WebAuthN support although it would be nice if it supported passwordless/usernameless login with resident keys

Re: Keycloak: Open-source identity and access management

#7

Post by snuxoll » Tue, Apr 14, 2020, 9:28 PM UTC

realdavidops wrote: post #4

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective. Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.) Running in Kubernetes with RDS Postgres in AWS.

Upstream of Red Hat SSO, Red Hat IdM is the commercial product based on FreeIPA.

Re: Keycloak: Open-source identity and access management

#8

Post by scrollaway » Tue, Apr 14, 2020, 9:28 PM UTC

We've started using Keycloak as a SSO solution for archlinux.org. if you're interested in helping out with Keycloak on an open source project, send me an email!

Re: Keycloak: Open-source identity and access management

#9

Post by B3NE » Tue, Apr 14, 2020, 9:29 PM UTC

realdavidops wrote: post #4

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective. Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.) Running in Kubernetes with RDS Postgres in AWS.

Did you build any custom extensions for Keycloak by implementing Keycloak's Service Provider Interfaces? If you are running any custom extensions, what features did you have to add?

Re: Keycloak: Open-source identity and access management

#10

Post by snuxoll » Tue, Apr 14, 2020, 9:34 PM UTC

toomuchtodo wrote: post #5

realdavidops wrote: post #4

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective. Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.) Running in Kubernetes with RDS Postgres in AWS.

Any pitfalls you’ve encountered when implementing?

It’s highly integrated with Wildfly (or JBoss EAP for the commercial product), so if you’re not deploying it with the Docker images expect to have fun dealing with the special hell that is Java application servers - setting up infispan and configuring the database in JNDI at a minimum will require some moderate reading.

If you do use the Docker images it’s pretty straightforward though.

Past that, customization could be better - not because it doesn’t support it but because many of the SPI’s are poorly documented at best, or totally undocumented at worst. You’ll need to read the code and understand Java EE to do anything not supported out of the box, which, to be fair is a lot - but I’m having to spend far more time looking through code than I’d like to add a Steam login for PCGamingWiki, as an example. Thankfully I’ve dabbled with Java EE before so it’s no big deal to me, but something to consider if you wanna do something simple like add extra profile fields.

EDIT: one major nag I have is that the LDAP integration has an annoying bug related to renaming of users. Keycloak can be configured to use a GUID in an LDAP store as the link between a Keycloak user profile and an LDAP object, but when the username changes it will delete and recreate the account instead of updating the username. This creates a whole new sub identifier in the JWT assertions, which has caused me headaches.

I have a bug on file for this which just recently got updated targeting a fix in 10.0, so hopefully this gets fixed soon.