How does this compare to Hydra?
Keycloak: Open-source identity and access management
51–60 of 124 posts
Re: Keycloak: Open-source identity and access management
#52We use this at my.zerotier.com and it works quite well, though it can be a little heavy.
Re: Keycloak: Open-source identity and access management
#53We use this at my company (Amplify) as a single "realm" configuration with Google and and a few other identity providers for "login with X". There's also some fun token exchange possible for any openid connect provider. This means that I can swap Google access tokens for other access tokens and vice versa. I'm also a contributor to the "frontend" piece of keycloak that's a JavaScript library called keycloak-connect (…
The best part is when you start chaining Keycloak instances together. We've had a couple cases where customers have wanted their own identity management, so we use an instance of Keycloak to connect to our central keycloak instances and to their solution of choice (Google, AzureAD, etc), and allows everyone to use their preferred identity platform.
I’m a bit confused...are you federating user management of those customers to their IDP? Or running separate keycloack instances for each of them? Or something else?
Re: Keycloak: Open-source identity and access management
#54I've been meaning to play with this for a while. I'm planning on evaluating how well it works as an authentication layer for Hasura. Hasura looks really nice but would be no good to me without an authentication layer. I found this connector as a stat point https://github.com/httpsOmkar/keycloak-hasura-connector
I'm in the process of transitioning our production Hasura deployment to use Keycloak. So far things are pretty straightforward.
Re: Keycloak: Open-source identity and access management
#55Can someone recommend a product (open source) that supports: * ldap * multiple password hashes per person, or some other way to keep different hash-functions of the password ( ldap supports this) * saml/shibboleth or openid connect (preferably both) * export all users and password hashes (I guess ldap supports this natively) Want to replace a legacy openldap installation with something more modern and future proof, b…
If you're really married to the idea of "keep different hash-functions of the password ( ldap supports this)" then I think you are going to have a tough time without really digging into candidate products' customization hooks or considering some manner of virtual directory. IME maintaining multiple password hashes is not at all a common LDAP server feature. Many products will stand in your way of exporting password hashes (just try and wrest this info from Active Directory or Auth0) and you may not be able to control the hash algorithm besides.
Re: Keycloak: Open-source identity and access management
#56Does anyone here have experience of miniOrange? What do you think of Keycloak compared to miniOrange? I see it in many places such as JIRA marketplace, WordPress plugins and they always have 5-star ratings. They have their own IdP server too.
Re: Keycloak: Open-source identity and access management
#57I've been meaning to play with this for a while. I'm planning on evaluating how well it works as an authentication layer for Hasura. Hasura looks really nice but would be no good to me without an authentication layer. I found this connector as a stat point https://github.com/httpsOmkar/keycloak-hasura-connector
It works with Hasura out of the box, you just can't set the x-hasura-default-role jwt claim dynamically and thus it has to be hardcoded. I evaluated keycloak with Hasura for our company, but settled on writing my own SSO solution, since my experience wasn't as great as others are describing.
Re: Keycloak: Open-source identity and access management
#58What would be the suggested way to automate resources creation? I use various home made Ansible roles and I find the Keycloak API to be inconsistent. Eg: Various GET methods that doesn't return complete payload and some endpoints that doesn't save on POST but they do when updating. That said, it's very hard to keep an idempotency with the actual state of the API. I haven't yet tested the keycloak-operator [1]. [1]: h…
We used the ansible module at work but we had to fork it internally and extend it heavily. I would suggest you try https://github.com/mrparkers/terraform-provider-keycloak instead, because terraform cleans up after itself (it deletes resources that you deleted from code, rather than leaving them behind) and terraform is also much faster, because it auto-parallelizes according to the dependency graph. The terraform provider also seems much better maintained than the ansible module.
And yes, the keycloak api is inconsistent.
Re: Keycloak: Open-source identity and access management
#59How does this compare to Hydra?
Keycloak is basically the entire Ory ecosystem rolled into one big software, along with a management interface and login.
Ory Hydra only deploys a openid connect provider on top of whatever authentication you want to use. Ory Krato is their new auth system, but still in very early stages.
Re: Keycloak: Open-source identity and access management
#60Key cloak is pretty awesome. So far it is the only authentication mechanism that we have provided for our open source Dev tool at https://github.com/zubairq/pilot