Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-source identity and access management

keycloak.org

Post reply on HN
Print view View original

31–40 of 124 posts

Re: Keycloak: Open-source identity and access management

#31

Post by closeparen »

realdavidops wrote: post #20
closeparen wrote: post #18

Earlier quoted context omitted.

I've only played with it, but was kind of put off by how much of the 2FA credential management is only available to admins. It's not like Duo where you can update your own enrolled phones, U2F devices, and defaults. End users would have to ask admins to do all that for them.

Hmm. I'm not sure what you mean. Users by default can use the console to update their 2FA credentials. The only time I have to intervene is when they lose their 2FA as it doesn't really do backup codes. We do require 2FA as a part of our login flows so this is something we're using heavily.

It may be better for TOTP; I was looking at U2F and WebAuthn.

Re: Keycloak: Open-source identity and access management

#32

Post by TedLePoireau »

I love keycloak but I was always disappointed it cannot be used as an LDAP server. As many open source products and SaaS support LDAP as authentication/authorization, it would have been perfecy for an internal SSO. Instead of keycloak, I had to rely on GSuite Identity Premium: hood product but gets expensive quickly...

Re: Keycloak: Open-source identity and access management

#33

Post by xupybd »

ignoramous wrote: post #13
xupybd wrote: post #3

I've been meaning to play with this for a while. I'm planning on evaluating how well it works as an authentication layer for Hasura. Hasura looks really nice but would be no good to me without an authentication layer. I found this connector as a stat point https://github.com/httpsOmkar/keycloak-hasura-connector

https://userbase.com is a serverless identity and access management platform that might tie-in well with hasura. One of the caveats is the forgot password feature is tricky: https://userbase.com/docs/faq/

Thanks, that does look really good. I'll look into it. I've also been looking at https://fusionauth.io/.

It's not easy to weigh up all the options. A simple script to generate JWT tokens might even be an option.

Re: Keycloak: Open-source identity and access management

#34

Post by ackerleytng »

Big fan of keycloak (and gatekeeper!) and looking into this issue now: I have an app (foo) which the user calls through a web frontend. Foo then has to call bar, massage bar's response, then return that to the user. How should I manage tokens that way? So far I have 2 ideas

(1) Have foo request expanded scope for tokens, including scope for bar. Use that same access token to access bar. For this, I'm concerned that if foo needs to use the access token for a longer time and it expires, then should foo do the refreshing independently of gatekeeper? Is there a way to update gatekeeper with a new token?

(2) Have some way of exchanging the user's token for foo, with a user's token for bar. Can keycloak do this? Can I still use gatekeeper for this?

Re: Keycloak: Open-source identity and access management

#35

Post by thinkharderdev »

snuxoll wrote: post #10
toomuchtodo wrote: post #5

Earlier quoted context omitted.

Any pitfalls you’ve encountered when implementing?

It’s highly integrated with Wildfly (or JBoss EAP for the commercial product), so if you’re not deploying it with the Docker images expect to have fun dealing with the special hell that is Java application servers - setting up infispan and configuring the database in JNDI at a minimum will require some moderate reading. If you do use the Docker images it’s pretty straightforward though. Past that, customization could…

Agree on the lack of documentation. But one thing I've found really nice is that the source code is really well structured and readable. Every time the documentation has let me down I've been able to find what I needed by reading the source code. That's one of the great underrated advantages of using open source solutions, you're not completely hamstrung when the docs don't give you what you need.

Re: Keycloak: Open-source identity and access management

#36

Post by thinkharderdev »

ceeker wrote: post #25

Can someone confirm if this can be used in a multi-tenant saas app environment? Customers want to have their own SSO setup or user roles and instead of providing all those functionalities in the app, can we use Keycloak in front and the Customer can manage their own users/permissions via Keycloak? So in essence: Customer A: Have 5 users (login / password), 1 admin and 4 regular users -- admin can add or remove users…

Yeah, it's really easy. You can setup multiple realms and then have completely separate realm admin roles for each. Each realm admin will have their own admin console and login URL

Re: Keycloak: Open-source identity and access management

#37

Post by thinkharderdev »

realdavidops wrote: post #19
toomuchtodo wrote: post #5

Earlier quoted context omitted.

Any pitfalls you’ve encountered when implementing?

The biggest thing we encountered was related actually to our initial deployment with active directory. This made logins slow, but actually found we could remove the requirement for Active Directory. It is super heavily based on Wildfly, and if you're not using a tool like docker, it can be kind-of a burden. It runs decently well in standalone mode, but we ended up using the docker container's clustering with Kubernet…

I'm curious how you manage upgrades. I am in the process of rolling Keycloak out to production now and the only thing I don't quite grok is how to do zero-downtime upgrades. It seems like the upgrade may make backwards-incompatible changes the DB schema. Do you replicate the entire database for the upgraded environment?

Re: Keycloak: Open-source identity and access management

#38

Post by thinkharderdev »

mooreds wrote: post #11

I found this list of open source SSO providers to be useful in learning about CIAM options: https://gist.github.com/bmaupin/6878fae9abcb63ef43f8ac9b9de8... I'd also love to hear any experiences comparing KeyCloak with commercial providers (Okta, Auth0, FusionAuth).

We looked at Okta, Auth0 and Cognito when shopping for an identity/auth solution. If you have pretty vanilla requirements then a SaaS solution will probably be easier. Keycloak is not the easiest thing in the world to deploy (although it's pretty straightforward to deploy on k8s using https://github.com/codecentric/helm-charts/tree/master/chart...).

If you need a lot of customizations then Keycloak is great since it has a really robust architecture for writing extensions. It's also pretty cheap to run so if cost is a major consideration it's definitely worth a look.

Re: Keycloak: Open-source identity and access management

#39

Post by gopaz »

Can someone recommend a product (open source) that supports: * ldap * multiple password hashes per person, or some other way to keep different hash-functions of the password ( ldap supports this) * saml/shibboleth or openid connect (preferably both) * export all users and password hashes (I guess ldap supports this natively)

Want to replace a legacy openldap installation with something more modern and future proof, but need to keep supporting a couple of old systems that won't go away for a long time.

Re: Keycloak: Open-source identity and access management

#40

Post by jeroenhd »

gopaz wrote: post #39

Can someone recommend a product (open source) that supports: * ldap * multiple password hashes per person, or some other way to keep different hash-functions of the password ( ldap supports this) * saml/shibboleth or openid connect (preferably both) * export all users and password hashes (I guess ldap supports this natively) Want to replace a legacy openldap installation with something more modern and future proof, b…

I've been considering setting up a Gluu [1] instance for some of my services. It supposedly supports LDAP as well as OpenID and Oauth2 for authentication as well as RADIUS. From what I can tell, this would fit your use case perfectly fine. It's available as open source software but the company behind it is selling it as well in case you'd like a support contract.

Note that I haven't set it up myself yet, it's still on my ever-growing list of "tools I have to take a good look at sometime in the future". It does seem like a very good piece of software though.

[1] https://www.gluu.org/

Post reply on HN