Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-source identity and access management

keycloak.org

Post reply on HN
Print view View original

41–50 of 124 posts

Re: Keycloak: Open-source identity and access management

#41

Post by cybrix12 »

thinkharderdev wrote: post #37
realdavidops wrote: post #19

Earlier quoted context omitted.

The biggest thing we encountered was related actually to our initial deployment with active directory. This made logins slow, but actually found we could remove the requirement for Active Directory. It is super heavily based on Wildfly, and if you're not using a tool like docker, it can be kind-of a burden. It runs decently well in standalone mode, but we ended up using the docker container's clustering with Kubernet…

I'm curious how you manage upgrades. I am in the process of rolling Keycloak out to production now and the only thing I don't quite grok is how to do zero-downtime upgrades. It seems like the upgrade may make backwards-incompatible changes the DB schema. Do you replicate the entire database for the upgraded environment?

When using a K8s cluster with the helm chart [1], it's actually the stateful set that takes care to the update.

When the first replica restart, Keycloak makes the updates to the database itself. Sometimes rolling back to a previous version can break. They do not hold the reverse of the database version [2].

I believe the reason behind the STS (StatefulSet) is so the cache have the time to spread among the replicas as it get upgraded.

[1]: https://github.com/codecentric/helm-charts/tree/master/chart... [2]: https://www.keycloak.org/docs/9.0/upgrading/

Re: Keycloak: Open-source identity and access management

#42

Post by realdavidops »

thinkharderdev wrote: post #37
realdavidops wrote: post #19

Earlier quoted context omitted.

The biggest thing we encountered was related actually to our initial deployment with active directory. This made logins slow, but actually found we could remove the requirement for Active Directory. It is super heavily based on Wildfly, and if you're not using a tool like docker, it can be kind-of a burden. It runs decently well in standalone mode, but we ended up using the docker container's clustering with Kubernet…

I'm curious how you manage upgrades. I am in the process of rolling Keycloak out to production now and the only thing I don't quite grok is how to do zero-downtime upgrades. It seems like the upgrade may make backwards-incompatible changes the DB schema. Do you replicate the entire database for the upgraded environment?

We schedule a downtime window during upgrade, but typically see no frontend impact to the core service, SSO for end users. We snapshot the DB for rollback if needed as the migrations are not reversible.

Our actual DB size is pretty small so these are very non-intensive tasks.

Re: Keycloak: Open-source identity and access management

#43

Post by cybrix12 »

snuxoll wrote: post #10
toomuchtodo wrote: post #5

Earlier quoted context omitted.

Any pitfalls you’ve encountered when implementing?

It’s highly integrated with Wildfly (or JBoss EAP for the commercial product), so if you’re not deploying it with the Docker images expect to have fun dealing with the special hell that is Java application servers - setting up infispan and configuring the database in JNDI at a minimum will require some moderate reading. If you do use the Docker images it’s pretty straightforward though. Past that, customization could…

It looks like Quarkus is going to be considered for one of the next major release [1].

That said, do you believe it will still be possible to extend Keycloak using the deployment-scanner?

Also, do you happen to have open-source code related to Keycloak and/or custom extensions?

Beside the poor doc, finding more open-source code is one of the best way to learn this.

[1]: https://issues.redhat.com/browse/KEYCLOAK-13068?jql=project%...

Re: Keycloak: Open-source identity and access management

#44

Post by cybrix12 »

realdavidops wrote: post #42
thinkharderdev wrote: post #37

Earlier quoted context omitted.

I'm curious how you manage upgrades. I am in the process of rolling Keycloak out to production now and the only thing I don't quite grok is how to do zero-downtime upgrades. It seems like the upgrade may make backwards-incompatible changes the DB schema. Do you replicate the entire database for the upgraded environment?

We schedule a downtime window during upgrade, but typically see no frontend impact to the core service, SSO for end users. We snapshot the DB for rollback if needed as the migrations are not reversible. Our actual DB size is pretty small so these are very non-intensive tasks.

May I know how many replicas and CACHE_OWNERS do you have?

Re: Keycloak: Open-source identity and access management

#45

Post by cybrix12 »

What would be the suggested way to automate resources creation?

I use various home made Ansible roles and I find the Keycloak API to be inconsistent.

Eg: Various GET methods that doesn't return complete payload and some endpoints that doesn't save on POST but they do when updating.

That said, it's very hard to keep an idempotency with the actual state of the API.

I haven't yet tested the keycloak-operator [1].

[1]: https://github.com/keycloak/keycloak-operator

Re: Keycloak: Open-source identity and access management

#46

Post by cybrix12 »

cdbattags wrote: post #17

We use this at my company (Amplify) as a single "realm" configuration with Google and and a few other identity providers for "login with X". There's also some fun token exchange possible for any openid connect provider. This means that I can swap Google access tokens for other access tokens and vice versa. I'm also a contributor to the "frontend" piece of keycloak that's a JavaScript library called keycloak-connect (…

Does it mean that a single user can be bound to more then one User Federation/Identity Provider?

Can you provide more detail on how you've done this?

Re: Keycloak: Open-source identity and access management

#47

Post by snuxoll »

cybrix12 wrote: post #46
cdbattags wrote: post #17

We use this at my company (Amplify) as a single "realm" configuration with Google and and a few other identity providers for "login with X". There's also some fun token exchange possible for any openid connect provider. This means that I can swap Google access tokens for other access tokens and vice versa. I'm also a contributor to the "frontend" piece of keycloak that's a JavaScript library called keycloak-connect (…

Does it mean that a single user can be bound to more then one User Federation/Identity Provider? Can you provide more detail on how you've done this?

Keycloak links federated identities to its own user accounts, users can do this manually from the account management UI or it can automatically link them by email when a user signs in with a new IdP.

No configuration beyond setting up the federated provider required.

Re: Keycloak: Open-source identity and access management

#48

Post by SEJeff »

jeroenhd wrote: post #40
gopaz wrote: post #39

Can someone recommend a product (open source) that supports: * ldap * multiple password hashes per person, or some other way to keep different hash-functions of the password ( ldap supports this) * saml/shibboleth or openid connect (preferably both) * export all users and password hashes (I guess ldap supports this natively) Want to replace a legacy openldap installation with something more modern and future proof, b…

I've been considering setting up a Gluu [1] instance for some of my services. It supposedly supports LDAP as well as OpenID and Oauth2 for authentication as well as RADIUS. From what I can tell, this would fit your use case perfectly fine. It's available as open source software but the company behind it is selling it as well in case you'd like a support contract. Note that I haven't set it up myself yet, it's still o…

Just want to say that I've met the lead developer of Gluu randomly at a gitlab hackathon / party in portland. It seems like they've got a really nice product and he was extremely knowledgeable along with very likable.

I've never used it, but if I needed to do something like the GP asked, I'd definitely give it a look.

Re: Keycloak: Open-source identity and access management

#49

Post by snuxoll »

TedLePoireau wrote: post #32

I love keycloak but I was always disappointed it cannot be used as an LDAP server. As many open source products and SaaS support LDAP as authentication/authorization, it would have been perfecy for an internal SSO. Instead of keycloak, I had to rely on GSuite Identity Premium: hood product but gets expensive quickly...

Setting up OpenLDAP or 389ds and integrating Keycloak with it is hardly rocket science - no need to reinvent the wheel.
Post reply on HN