Keycloak: Open-source identity and access management • Hacker News Board

Re: Keycloak: Open-source identity and access management

#11

Post by mooreds » Tue, Apr 14, 2020, 9:46 PM UTC

I found this list of open source SSO providers to be useful in learning about CIAM options: https://gist.github.com/bmaupin/6878fae9abcb63ef43f8ac9b9de8...

I'd also love to hear any experiences comparing KeyCloak with commercial providers (Okta, Auth0, FusionAuth).

Re: Keycloak: Open-source identity and access management

#12

Post by lostsoul8282 » Tue, Apr 14, 2020, 9:49 PM UTC

My company has been using this and it's not only really easy to integrate but we have found it very stable. No issues and really helped us get to market quickly.

Re: Keycloak: Open-source identity and access management

#13

Post by ignoramous » Tue, Apr 14, 2020, 9:52 PM UTC

xupybd wrote: post #3

I've been meaning to play with this for a while. I'm planning on evaluating how well it works as an authentication layer for Hasura. Hasura looks really nice but would be no good to me without an authentication layer. I found this connector as a stat point https://github.com/httpsOmkar/keycloak-hasura-connector

https://userbase.com is a serverless identity and access management platform that might tie-in well with hasura. One of the caveats is the forgot password feature is tricky: https://userbase.com/docs/faq/

Re: Keycloak: Open-source identity and access management

#14

Post by barryrandall » Tue, Apr 14, 2020, 10:04 PM UTC

captn3m0 wrote: post #2

Anyone here using Keycloak for a home setup? I've been considering this v/s https://www.ory.sh/ , which is more OIDC focused and can't decide.

I’ve been tempted, but it doesn’t support multilateral SAML federation, which is almost mandatory for higher education, which is 100% of my customer base.

But it’s definitely easier to live with than Active Directory or SecureAuth.

Re: Keycloak: Open-source identity and access management

#15

Post by realdavidops » Tue, Apr 14, 2020, 10:04 PM UTC

snuxoll wrote: post #7

realdavidops wrote: post #4

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective. Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.) Running in Kubernetes with RDS Postgres in AWS.

Upstream of Red Hat SSO, Red Hat IdM is the commercial product based on FreeIPA.

Oof! Good catch! Yes Red Hat SSO

Re: Keycloak: Open-source identity and access management

#16

Post by SeriousM » Tue, Apr 14, 2020, 10:05 PM UTC

For the dotnet world you can use and extend https://identityserver4.readthedocs.io/en/latest/

Re: Keycloak: Open-source identity and access management

#17

Post by cdbattags » Tue, Apr 14, 2020, 10:07 PM UTC

We use this at my company (Amplify) as a single "realm" configuration with Google and and a few other identity providers for "login with X". There's also some fun token exchange possible for any openid connect provider.

This means that I can swap Google access tokens for other access tokens and vice versa.

I'm also a contributor to the "frontend" piece of keycloak that's a JavaScript library called keycloak-connect (these are known as adapters).

Also also, I'm a maintainer of https://github.com/cdbattags/lua-resty-jwt that I'm using in tandem with the Keycloak RSA public keys for auth at API gateway/network level.

Ask me anything!

Re: Keycloak: Open-source identity and access management

#18

Post by closeparen » Tue, Apr 14, 2020, 10:09 PM UTC

realdavidops wrote: post #4

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective. Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.) Running in Kubernetes with RDS Postgres in AWS.

I've only played with it, but was kind of put off by how much of the 2FA credential management is only available to admins. It's not like Duo where you can update your own enrolled phones, U2F devices, and defaults. End users would have to ask admins to do all that for them.

Re: Keycloak: Open-source identity and access management

#19

Post by realdavidops » Tue, Apr 14, 2020, 10:10 PM UTC

toomuchtodo wrote: post #5

realdavidops wrote: post #4

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective. Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.) Running in Kubernetes with RDS Postgres in AWS.

Any pitfalls you’ve encountered when implementing?

The biggest thing we encountered was related actually to our initial deployment with active directory. This made logins slow, but actually found we could remove the requirement for Active Directory.

It is super heavily based on Wildfly, and if you're not using a tool like docker, it can be kind-of a burden. It runs decently well in standalone mode, but we ended up using the docker container's clustering with Kubernetes service discovery helping to find the other nodes to achieve a clustered deployment.

Outside of that is has been extremely stable, we use Kubernetes deployment mechanism along with a correctly defined readiness check to allow us to seamlessly upgrade, and we've gone from 4.3.0.Final to 7.0.1 in production without any problems. We haven't upgraded to 8 or 9 yet as we're actually working on some new frontend UI changes we wanted to get out the door with the release.

Re: Keycloak: Open-source identity and access management

#20

Post by realdavidops » Tue, Apr 14, 2020, 10:13 PM UTC

closeparen wrote: post #18

realdavidops wrote: post #4

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective. Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.) Running in Kubernetes with RDS Postgres in AWS.

I've only played with it, but was kind of put off by how much of the 2FA credential management is only available to admins. It's not like Duo where you can update your own enrolled phones, U2F devices, and defaults. End users would have to ask admins to do all that for them.

Hmm. I'm not sure what you mean. Users by default can use the console to update their 2FA credentials. The only time I have to intervene is when they lose their 2FA as it doesn't really do backup codes. We do require 2FA as a part of our login flows so this is something we're using heavily.