Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-source identity and access management

keycloak.org

Post reply on HN
Print view View original

21–30 of 124 posts

Re: Keycloak: Open-source identity and access management

#21

Post by rad_gruchalski »

captn3m0 wrote: post #2

Anyone here using Keycloak for a home setup? I've been considering this v/s https://www.ory.sh/ , which is more OIDC focused and can't decide.

I’ve been looking into ory platform recently. It’s all still alpha and beta but pretty impressive. The architecture is much more microservice oriented. Keycloack is one large monolith but easy to deploy with Docker.

Both suffer on the documentation front, especially useful “cookbook” type of things. Keycloak is impressive, like a lot of things from Red Hat. But ory is worth keeping an eye on. Both assume fluent understanding of terminology.

If you need an integrated identity database out of the box, go for Keycloak today. Comes with OIDC and SAML, both work great. Ory Kratos still requires some manual tinkering.

Re: Keycloak: Open-source identity and access management

#22

Post by realdavidops »

cdbattags wrote: post #17

We use this at my company (Amplify) as a single "realm" configuration with Google and and a few other identity providers for "login with X". There's also some fun token exchange possible for any openid connect provider. This means that I can swap Google access tokens for other access tokens and vice versa. I'm also a contributor to the "frontend" piece of keycloak that's a JavaScript library called keycloak-connect (…

The best part is when you start chaining Keycloak instances together. We've had a couple cases where customers have wanted their own identity management, so we use an instance of Keycloak to connect to our central keycloak instances and to their solution of choice (Google, AzureAD, etc), and allows everyone to use their preferred identity platform.

Re: Keycloak: Open-source identity and access management

#24

Post by bebop »

snuxoll wrote: post #10
toomuchtodo wrote: post #5

Earlier quoted context omitted.

Any pitfalls you’ve encountered when implementing?

It’s highly integrated with Wildfly (or JBoss EAP for the commercial product), so if you’re not deploying it with the Docker images expect to have fun dealing with the special hell that is Java application servers - setting up infispan and configuring the database in JNDI at a minimum will require some moderate reading. If you do use the Docker images it’s pretty straightforward though. Past that, customization could…

I would agree that a pain point is the lack of documentation, examples, and googleability of the SPI's. I have spent much longer than I would have expected integrating an existing user database.

Re: Keycloak: Open-source identity and access management

#25

Post by ceeker »

Can someone confirm if this can be used in a multi-tenant saas app environment?

Customers want to have their own SSO setup or user roles and instead of providing all those functionalities in the app, can we use Keycloak in front and the Customer can manage their own users/permissions via Keycloak?

So in essence:

Customer A: Have 5 users (login / password), 1 admin and 4 regular users -- admin can add or remove users

Customer B: Have an LDAP and would like to authenticate using it

Re: Keycloak: Open-source identity and access management

#26

Post by jgrodziski »

Keycloak is a great piece of engineering. It's a robust IAM, fully-featured, easy to deploy and integrate with. My opinion is that people should rely on battle-tested 3rd party solution like Keycloak for their authentication and authorization needs.

We run it in production on GCP and it integrates nicely with the Clojure ecosystem (both on the frontend with a SPA and on the backend dealing with REST API security).

Shameless plug: I maintain the keycloak-clojure wrapper: https://github.com/jgrodziski/keycloak-clojure (You'll find some explanations of the Keycloak concepts in the README).

Re: Keycloak: Open-source identity and access management

#27

Post by snuxoll »

ceeker wrote: post #25

Can someone confirm if this can be used in a multi-tenant saas app environment? Customers want to have their own SSO setup or user roles and instead of providing all those functionalities in the app, can we use Keycloak in front and the Customer can manage their own users/permissions via Keycloak? So in essence: Customer A: Have 5 users (login / password), 1 admin and 4 regular users -- admin can add or remove users…

Absolutely. You can setup multiple realms in Keycloak to isolate tenants from each other, and beyond the built in admin UI you can access all of the configuration over a REST API to build you own admin tools if needed.

Re: Keycloak: Open-source identity and access management

#28

Post by mjochim »

ceeker wrote: post #25

Can someone confirm if this can be used in a multi-tenant saas app environment? Customers want to have their own SSO setup or user roles and instead of providing all those functionalities in the app, can we use Keycloak in front and the Customer can manage their own users/permissions via Keycloak? So in essence: Customer A: Have 5 users (login / password), 1 admin and 4 regular users -- admin can add or remove users…

This should be possible, since everything you mention are realm-specific settings (i.e. you create one realm per customer), including that a user can be admin in one realm only.

I'm saying "should be" because personally, I have only used single-realm setups in production so far.

Must say I'm a big fan of Keycloak.

Post reply on HN