Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-source identity and access management

keycloak.org

Post reply on HN
Print view View original

61–70 of 124 posts

Re: Keycloak: Open-source identity and access management

#61

Post by mulcahey »

snuxoll wrote: post #30
SeriousM wrote: post #16

For the dotnet world you can use and extend https://identityserver4.readthedocs.io/en/latest/

IdentityServer is a framework to roll your own IdP, it’s not fully functional out of the box like Keycloak.

It can be easier to extend & customize[0] though.

I went with IdentityServer4 on a recent project over Keycloak and Gluu[1] for that reason and because it was in the same stack as the rest of our ecosystem.

[0] See comment from this thread https://news.ycombinator.com/item?id=22871756

[1] https://www.gluu.org/

Re: Keycloak: Open-source identity and access management

#62

Post by lukevp »

Fusionauth was pretty easy to set up self hosted in a container. Is keycloak better or equivalent if all I want is Multitenant JWTs issued (multiple apps/themes in one instance) and an email confirm / password reset workflow for users? Disclaimer: I’ve contributed to the fusionauth .net core library

Re: Keycloak: Open-source identity and access management

#64

Post by AnonC »

I haven’t looked at this in years (after it was taken over by RedHat). Can someone comment on using Keycloak within a .NET application (which would be a service provider) for SSO with SAML? Does it have easy to use libraries that make application development easier to work with a configured IdP?

Re: Keycloak: Open-source identity and access management

#65

Post by theomega »

ceeker wrote: post #25

Can someone confirm if this can be used in a multi-tenant saas app environment? Customers want to have their own SSO setup or user roles and instead of providing all those functionalities in the app, can we use Keycloak in front and the Customer can manage their own users/permissions via Keycloak? So in essence: Customer A: Have 5 users (login / password), 1 admin and 4 regular users -- admin can add or remove users…

I was a heavy user of Keycloak until a year ago and I can only recommend your setup if you are sure that the amount of realms is not growing. Every additional realm uses huge amount of memory in Keycloak. From how I understood the architecture, a lot of components (if not all of them) are initialized per realm.

We had huge problems modeling multi-tenancy through reals in Keycloak.

Take everything I'm saying with a grain of salt. But, if you are planning to have a lot of customers and realms, do a benchmark by creating a lot of realms and checking if you can use all of them in parallel. YMMV.

Re: Keycloak: Open-source identity and access management

#66

Post by 411111111111111 »

pm90 wrote: post #53
realdavidops wrote: post #22

Earlier quoted context omitted.

The best part is when you start chaining Keycloak instances together. We've had a couple cases where customers have wanted their own identity management, so we use an instance of Keycloak to connect to our central keycloak instances and to their solution of choice (Google, AzureAD, etc), and allows everyone to use their preferred identity platform.

I’m a bit confused...are you federating user management of those customers to their IDP? Or running separate keycloack instances for each of them? Or something else?

they could also just let them run their own keycloak instance and use that as the provider for the realm so customers can more easily debug it themselves.

it doesnt need much maintenance, so it doesnt really get easier than that.

Re: Keycloak: Open-source identity and access management

#69

Post by ccouzens »

I have created OpenAPI (Swagger) schemas for Keycloak's admin rest API.

https://github.com/ccouzens/keycloak-openapi/tree/master/key...

Hopefully these are useful to other people.

See the parent directory for the tooling I wrote to generate them from Keycloak's HTML documentation.

Re: Keycloak: Open-source identity and access management

#70

Post by orthoxerox »

SeriousM wrote: post #16

For the dotnet world you can use and extend https://identityserver4.readthedocs.io/en/latest/

Except it can't federate multiple AD domains out of the box, which is what I needed and got from Keycloak.

IS4 sits in this weird space where it does work via OAuth/SAML and can work with Windows identity that the browser gives to it, but can't authenticate users against AD with a password.

Post reply on HN