It it easy to save along the user information like companies, contracts and so on?
Keycloak: Open-source identity and access management
101–110 of 124 posts
Re: Keycloak: Open-source identity and access management
#102Earlier quoted context omitted.
Good to hear that a Clojure wrapper is there. I've been thinking about Keycloak, but I was worried that the login or credentials management UI would be outside of my app (and different). But perhaps there is a way to integrate with it while keeping the UI in-app?
You can theme the Keycloak UI to be similar to your app's one, particularly the login/registration screens so the user experience is very smooth. But you can also define the user/account UI and logic in your app and just delegate the authn and authz data through the Keycloak APIs.
The second option seems interesting! Theming wouldn't help, my app is waaaay different from an old-style themed template (server-side rendering, client-side ClojureScript, websockets, etc).
I will definitely take a look, then.
Re: Keycloak: Open-source identity and access management
#103Earlier quoted context omitted.
We looked at Okta, Auth0 and Cognito when shopping for an identity/auth solution. If you have pretty vanilla requirements then a SaaS solution will probably be easier. Keycloak is not the easiest thing in the world to deploy (although it's pretty straightforward to deploy on k8s using https://github.com/codecentric/helm-charts/tree/master/chart... ). If you need a lot of customizations then Keycloak is great since it…
Since you looked at Okta, Auth0 and Cognita ... which one did you pick?
We went with Keycloak. Both for cost and for extensibility. More than happy with our choice
Re: Keycloak: Open-source identity and access management
#104Earlier quoted context omitted.
It may be better for TOTP; I was looking at U2F and WebAuthn.
What would admin enrollment even look like for WebAuthn? Do I need to FedEx my FIDO security keys to the company IT security department? I can't imagine any scenario in which you have FIDO keys and admin enrollment and security but I'm prepared to be enlightened.
You can assign the user a temporary password so that they get prompted to enroll their credential on first login. But:
a) Because the password is assigned first, it has higher priority, so subsequent logins will prompt for password first until the admin manually changes the user's credential ordering to put the WebAuthn (passwordless) token higher. The user's credential priority overrides the order of challenges in the login flow.
b) There is no option to add or replace one of these credentials, or manage credential ordering yourself, in the end-user webapp that does profile editing / password updates.
An admin may be able to reset your account so that you get the first-login experience again and can enroll new credentials.
Re: Keycloak: Open-source identity and access management
#105I found this list of open source SSO providers to be useful in learning about CIAM options: https://gist.github.com/bmaupin/6878fae9abcb63ef43f8ac9b9de8... I'd also love to hear any experiences comparing KeyCloak with commercial providers (Okta, Auth0, FusionAuth).
We looked at Okta, Auth0 and Cognito when shopping for an identity/auth solution. If you have pretty vanilla requirements then a SaaS solution will probably be easier. Keycloak is not the easiest thing in the world to deploy (although it's pretty straightforward to deploy on k8s using https://github.com/codecentric/helm-charts/tree/master/chart... ). If you need a lot of customizations then Keycloak is great since it…
FusionAuth has some k8s, helm, docker and openshift examples as well. https://github.com/FusionAuth/fusionauth-containers
FusionAuth is not open source, so if that is a hard requirement, you'll have to skip it.
Re: Keycloak: Open-source identity and access management
#106Earlier quoted context omitted.
IdentityServer is a framework to roll your own IdP, it’s not fully functional out of the box like Keycloak.
It can be easier to extend & customize[0] though. I went with IdentityServer4 on a recent project over Keycloak and Gluu[1] for that reason and because it was in the same stack as the rest of our ecosystem. [0] See comment from this thread https://news.ycombinator.com/item?id=22871756 [1] https://www.gluu.org/
I wrote the comment you cited :)
IdentityServer certainly has better documentation for its extension points at the moment, but the tradeoff is you have to build everything yourself. Keycloak comes with a built in admin UI, account management UI, TOTP and WebAuthN support, the list goes on. You have to go out of your way to build these or search for a mismash of plugins for IdenityServer to get everything Keycloak provides out of the box.
And while the extension points of Keycloak aren't super well documented, literally all of them are in a dedicated Maven module [0] making it easy to just browse the code.
[0]: https://github.com/keycloak/keycloak/tree/master/server-spi/...
Re: Keycloak: Open-source identity and access management
#107Earlier quoted context omitted.
You can theme the Keycloak UI to be similar to your app's one, particularly the login/registration screens so the user experience is very smooth. But you can also define the user/account UI and logic in your app and just delegate the authn and authz data through the Keycloak APIs.
The second option seems interesting! Theming wouldn't help, my app is waaaay different from an old-style themed template (server-side rendering, client-side ClojureScript, websockets, etc). I will definitely take a look, then.
> The second option seems interesting! Theming wouldn't help, my app is waaaay different from an old-style themed template (server-side rendering, client-side ClojureScript, websockets, etc).
Well, since we are talking SAML or OIDC here - you don't really have a choice for the login/registration. The IdP provides the login and registration pages, not your application. You are free to build your own account management page, but you still have to ask Keycloak for a token.
Re: Keycloak: Open-source identity and access management
#108I've been meaning to play with this for a while. I'm planning on evaluating how well it works as an authentication layer for Hasura. Hasura looks really nice but would be no good to me without an authentication layer. I found this connector as a stat point https://github.com/httpsOmkar/keycloak-hasura-connector
It works with Hasura out of the box, you just can't set the x-hasura-default-role jwt claim dynamically and thus it has to be hardcoded. I evaluated keycloak with Hasura for our company, but settled on writing my own SSO solution, since my experience wasn't as great as others are describing.
> It works with Hasura out of the box, you just can't set the x-hasura-default-role jwt claim dynamically and thus it has to be hardcoded.
Completely incorrect. There's numerous ways you can handle setting a claim in Keycloak, from hardcoded values, simple JavaScript mappers or custom mappers in JVM languages built using the SPI's.
Re: Keycloak: Open-source identity and access management
#109It it easy to save along the user information like companies, contracts and so on?
Simple attributes can be added easily (it's as simple as adding form fields with an id of `user.attribute.company`), but anything requiring access restrictions (only an admin can update, for example) will require custom development.
The Profile SPI in the works hopes to make this much easier, you can track the progress on that on the JBoss JIRA tracker [0].
Re: Keycloak: Open-source identity and access management
#110Can keycloak let me integrate different k8s clusters running in Azure/Google/AWS with i.e.: Azure AD ? All our users have accounts in Azure AD but we would like to let them use k8s clusters running in different cloud providers without maintaining user accounts there. Is it possible with keycloak ?
> Can keycloak let me integrate different k8s clusters running in Azure/Google/AWS with i.e.: Azure AD ? All our users have accounts in Azure AD but we would like to let them use k8s clusters running in different cloud providers without maintaining user accounts there. Is it possible with keycloak ?
No real need for Keycloak here, AKS uses Azure AD natively, GCP and AWS can be configured to use SAML straight from Azure AD to handle authentication.
You could use Keycloak though.