Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

21–30 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#21

Post by bayesian_horse »

lifeisstillgood wrote: post #19
nird wrote: post #8

Earlier quoted context omitted.

We have been using it for 6-7 years now. Have been able to run very stable and integrated a lot of external IdP's to offer proper SSO on mulitple of our software stacks. Added a lot of other open source pieces of software we run for our backoffice needs (hashi vault, adminbro, etc.). So far very happy with it. Running in clustered mode without issues and as such little issues with the startup times. It probably helps…

This fascinated me - where and how does this fit into other identity providers (and thence into SSO). I kind of yearn for client certificates everywhere simply because I can grok how that remains secure as we pass through layer after layer. the rest I just worry about

keycloak can broker between identity providers. It can use social logins as identity providers, connect to ldap, kerberos and others for user federation, and then provide SAML and OpenIDC to other applications.

Re: Keycloak: Open-Source Identity and Access Management

#24

Post by doctor_eval »

My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary.

While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly (at the time).

This meant we needed to know not only about Keycloak itself, but also about Wildfly's special quirks, the clustering system (Infinispan??), Java and Docker.

Now it's packaged with Quarkus, which is another dependency to learn about, and to be honest despite the quality of the finished product, all those dependencies have become pretty off-putting.

So while I can recommend Keycloak's functionality, if you're not already deploying Java apps as part of your job, I suspect it will present a pretty serious administrative burden to deploy into serious production.

Re: Keycloak: Open-Source Identity and Access Management

#27

Post by jcroll »

Spring has an oauth2 authorization server that is currently in early release: https://github.com/spring-projects/spring-authorization-serv...

I'm building something with it currently and it's quite nice, especially if you are already familiar with spring security. Documentation is quite sparse tho.

Re: Keycloak: Open-Source Identity and Access Management

#30

Post by n3t »

Can I use Keycloak for the following use case?

I have a few services on my family server (say, Gitea, Grafana, finance tracking app etc.). I'd like to have a SSO but also limit which users can use which services (e.g. my significant other can use Grafana but no Gitea).

Is integrating above services with Keycloak enough? Or would I need another components? Or maybe I've got it wrong and should reconsider the architecture?

Post reply on HN