Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-source identity and access management

keycloak.org

Post reply on HN
Print view View original

81–90 of 124 posts

Re: Keycloak: Open-source identity and access management

#81

Post by benjaminwai »

pm90 wrote: post #53
realdavidops wrote: post #22

Earlier quoted context omitted.

The best part is when you start chaining Keycloak instances together. We've had a couple cases where customers have wanted their own identity management, so we use an instance of Keycloak to connect to our central keycloak instances and to their solution of choice (Google, AzureAD, etc), and allows everyone to use their preferred identity platform.

I’m a bit confused...are you federating user management of those customers to their IDP? Or running separate keycloack instances for each of them? Or something else?

Think it would be using brokering, the instance of Keycloak would be an external identity provider. Each customer would have their own instance of Keycloak that could then be configured to broker their choice of identity provider. I think this might be achievable at the realm level in a smaller scale deployment, i.e., using a separate realm for each customer but still chaining them back to the central realm through brokering, rather than spawning off new instances of Keycloak. Just a thought..

Re: Keycloak: Open-source identity and access management

#82

Post by moiz41510 »

closeparen wrote: post #18
realdavidops wrote: post #4

We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective. Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.) Running in Kubernetes with RDS Postgres in AWS.

I've only played with it, but was kind of put off by how much of the 2FA credential management is only available to admins. It's not like Duo where you can update your own enrolled phones, U2F devices, and defaults. End users would have to ask admins to do all that for them.

My company uses Keycloak with Duo 2FA.

Re: Keycloak: Open-source identity and access management

#84

Post by jokull »

thinkharderdev wrote: post #38
mooreds wrote: post #11

I found this list of open source SSO providers to be useful in learning about CIAM options: https://gist.github.com/bmaupin/6878fae9abcb63ef43f8ac9b9de8... I'd also love to hear any experiences comparing KeyCloak with commercial providers (Okta, Auth0, FusionAuth).

We looked at Okta, Auth0 and Cognito when shopping for an identity/auth solution. If you have pretty vanilla requirements then a SaaS solution will probably be easier. Keycloak is not the easiest thing in the world to deploy (although it's pretty straightforward to deploy on k8s using https://github.com/codecentric/helm-charts/tree/master/chart... ). If you need a lot of customizations then Keycloak is great since it…

Since you looked at Okta, Auth0 and Cognita ... which one did you pick?

Re: Keycloak: Open-source identity and access management

#85

Post by vetinari »

snuxoll wrote: post #49
TedLePoireau wrote: post #32

I love keycloak but I was always disappointed it cannot be used as an LDAP server. As many open source products and SaaS support LDAP as authentication/authorization, it would have been perfecy for an internal SSO. Instead of keycloak, I had to rely on GSuite Identity Premium: hood product but gets expensive quickly...

Setting up OpenLDAP or 389ds and integrating Keycloak with it is hardly rocket science - no need to reinvent the wheel.

Setting it up with FreeIPA (which contains 389ds) is a matter of filling up a single form in Keycloak admin.

That includes SPNEGO (passwordless auth in browser) for those, who are enrolled into domain or have Kerberos tickets.

Re: Keycloak: Open-source identity and access management

#86

Post by devnullbyte »

tofflos wrote: post #73
deathtrader666 wrote: post #67

Could someone please ELI-5 what Keycloak is, and how it fits in a SaaS app?

Keycloak is an authentication portal that sits in front of other applications thereby freeing those applications from the burden of implementing login forms and secure password storage.

"that sits in front of " does that denote that miminal refactor / re-architecture is needed for a rest based application, trying to get an idea of how easy it is to start using keycloak?

Re: Keycloak: Open-source identity and access management

#87

Post by jgrodziski »

nickik wrote: post #76
jgrodziski wrote: post #26

Keycloak is a great piece of engineering. It's a robust IAM, fully-featured, easy to deploy and integrate with. My opinion is that people should rely on battle-tested 3rd party solution like Keycloak for their authentication and authorization needs. We run it in production on GCP and it integrates nicely with the Clojure ecosystem (both on the frontend with a SPA and on the backend dealing with REST API security). Sh…

Oh interesting, I have been wanting to do something with it and Clojure.

Feel free to ask me anything about Keycloak in the Clojure ecosystem. The README of keycloak-clojure needs some lifting but hopefully you'll find everything you need.

Re: Keycloak: Open-source identity and access management

#88

Post by cybrix12 »

markbaikal wrote: post #58
cybrix12 wrote: post #45

What would be the suggested way to automate resources creation? I use various home made Ansible roles and I find the Keycloak API to be inconsistent. Eg: Various GET methods that doesn't return complete payload and some endpoints that doesn't save on POST but they do when updating. That said, it's very hard to keep an idempotency with the actual state of the API. I haven't yet tested the keycloak-operator [1]. [1]: h…

We used the ansible module at work but we had to fork it internally and extend it heavily. I would suggest you try https://github.com/mrparkers/terraform-provider-keycloak instead, because terraform cleans up after itself (it deletes resources that you deleted from code, rather than leaving them behind) and terraform is also much faster, because it auto-parallelizes according to the dependency graph. The terraform pr…

Thank you very much. I shared it with the team for a lookup.

Re: Keycloak: Open-source identity and access management

#89

Post by segmondy »

A happy keycloak user here! Okta wants us to pay per user! Ha, if you're a small outfit with a few hundred users sure, but if you have hundred thousands or millions of users. Nope! We went with keycloak and loving it! We run it in multiple docker containers for resiliency on AWS. Postgres DB on RDS. Bulletproof, zero downtime.
Post reply on HN