Authentik is also worth checking out: https://goauthentik.io/
The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.
Keycloak: Open-Source Identity and Access Management
11–20 of 243 posts
Re: Keycloak: Open-Source Identity and Access Management
#12Earlier quoted context omitted.
Keycloak is now running on Quarkus, so startup times are much faster (few seconds). But -- KC is not something you start up often (in production). It's reliable, flexible and actively developed, so not a bad choice as a self-hosted IAM solution.
With Quarkus, they went into other extreme -- if you are using docker, to get as fast startup as possible, you have to build your image with your configuration/modules used baked in. Overall, I'm pretty satisfied. There are some bumps, but they are not Keycloak fault (having two different keytabs for two different host names for two different container images sharing same IP and reverse name not matching is kind of d…
There is an auto-build option so building a custom Docker image is an optimisation.
Re: Keycloak: Open-Source Identity and Access Management
#13I've been investigating an authorization application to use with the SAFE stack. I'm testing Keycloak and it looks good so far.
Similar scenario here. Drop me a comment if you want to share anything learned.
Re: Keycloak: Open-Source Identity and Access Management
#14Authentik is also worth checking out: https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.
I’ve been a keycloak advocate since my jboss days (really the only good thing that came out of jboss). I have never heard of authentik and I’m so glad you mentioned it, it looks amazing! I had been contemplating doing a similar project but this would satisfy that need. Thank you.
Re: Keycloak: Open-Source Identity and Access Management
#15We are currently using Shibboleth, and would love to get away from using java/Tomcat. It looks like Keycloak also uses java. Is there an alternative to this that doesn't require it?
Re: Keycloak: Open-Source Identity and Access Management
#16Does it support webAuthn?
Re: Keycloak: Open-Source Identity and Access Management
#17We are currently using Shibboleth, and would love to get away from using java/Tomcat. It looks like Keycloak also uses java. Is there an alternative to this that doesn't require it?
possibly https://www.ory.sh/
Re: Keycloak: Open-Source Identity and Access Management
#18Authentik is also worth checking out: https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.
I’ve been a keycloak advocate since my jboss days (really the only good thing that came out of jboss). I have never heard of authentik and I’m so glad you mentioned it, it looks amazing! I had been contemplating doing a similar project but this would satisfy that need. Thank you.
Just be careful with Athentik, it is an extremely young, rapidly developing project. So expect the odd pitfall
Re: Keycloak: Open-Source Identity and Access Management
#19We tried using keycloak in a startup where I worked. It needed a loooooooot of memory and was very slow to start. It probably needed some JVM tuning, but we were just deploying as a stateful set (for the postgres). The docker images were also huge. We had to use another FOSS project called Gatekeeper as an authentication software along with keycloak, which got obsoleted and replaced with a different project (lukedo p…
We have been using it for 6-7 years now. Have been able to run very stable and integrated a lot of external IdP's to offer proper SSO on mulitple of our software stacks. Added a lot of other open source pieces of software we run for our backoffice needs (hashi vault, adminbro, etc.). So far very happy with it. Running in clustered mode without issues and as such little issues with the startup times. It probably helps…
This fascinated me - where and how does this fit into other identity providers (and thence into SSO).
I kind of yearn for client certificates everywhere simply because I can grok how that remains secure as we pass through layer after layer. the rest I just worry about
Re: Keycloak: Open-Source Identity and Access Management
#20In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect.
Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity.
A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot.
Keycloak is good software. It never failed for me. Even upgrading from 7.x.x to 16.x.x somehow just worked.
Yes, their docker image is fat, but it's also very flexible. Now that they are basing Keycloak on Quarkus instead on Wildfly, the docker image should shrink in size.
quay.io/keycloak/keycloak 18.0.0 a6bd0f949af0 15 hours ago 562MB
quay.io/keycloak/keycloak 18.0.0-legacy 421e95f49589 46 hours ago 753MB
Beware: they aren't using Docker Hub anymore. Newer versions are on Quay only (https://quay.io/repository/keycloak/keycloak).
I'm happy with Keycloak. Also nice folks around Keycloak.