This post [0] persuaded me that I need multiple SAML IDP signing keys to prevent badly behaved third party apps from accepting every user authentication as an authorization. Keycloak supports this configuration, but can anyone comment on how reasonable this is from an ops standpoint? Is it difficult to configure this way? Is it harder to back up?
Keycloak: Open-source identity and access management
121–124 of 124 posts
Re: Keycloak: Open-source identity and access management
#122How does this compare to Hydra?
Keycloak is basically the entire Ory ecosystem rolled into one big software, along with a management interface and login. Ory Hydra only deploys a openid connect provider on top of whatever authentication you want to use. Ory Krato is their new auth system, but still in very early stages.
Ah thank you for the well explained response. So does Keycloak have any tools to build an identity provider?
Re: Keycloak: Open-source identity and access management
#123Earlier quoted context omitted.
FreeIPA has it's own set of problems. One being basically unrunnable in containers because of weird systemd stuff
FreeIPA is not supported in containers, because it is integration of a bunch of services that need to be on the same machine and each of them has its own idea where to keep state. It has nothing to do with systemd, despite what systemd-phobes think.
And is somewhat broken and bodged with FreeBSD.
Re: Keycloak: Open-source identity and access management
#124I might be late to this thread. sad :(
I was looking into Keycloak last year but eventually gave up because I can't find a friendly/robust enough solution to use source code to manage Keycloak config.
I am curious how do you guys manage staging/production Keycloak instances? Do you just manually trying to keep it the same?
Another question is: Does any company actually use the authorization part of Keycloak? How's the experience?