Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

41–50 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#41

Post by chrisoverzero »

schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

> Beware: they aren't using Docker Hub anymore. Newer versions are on Quay only

Oh, right, Quaycloak.

Re: Keycloak: Open-Source Identity and Access Management

#42

Post by mooreds »

schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

> Beware: they aren't using Docker Hub anymore.

Do you know why? Is it because of the docker hub pricing changes?

I found this discussion on the mailing list but didn't see a reason why: https://lists.jboss.org/pipermail/keycloak-user/2019-March/0...

Re: Keycloak: Open-Source Identity and Access Management

#43

Post by p_l »

whazor wrote: post #11

Authentik is also worth checking out: https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.

Arguably best is to not have proxied oauth at all and instead implement oauth in your software.

Re: Keycloak: Open-Source Identity and Access Management

#44

Post by p_l »

n3t wrote: post #30

Can I use Keycloak for the following use case? I have a few services on my family server (say, Gitea, Grafana, finance tracking app etc.). I'd like to have a SSO but also limit which users can use which services (e.g. my significant other can use Grafana but no Gitea). Is integrating above services with Keycloak enough? Or would I need another components? Or maybe I've got it wrong and should reconsider the architect…

It will definitely work - Keycloak can provide its own user database, or it can use external one, as well as do some crazier things that go outside of the scope you mentioned.

In simplest setup (non-HA, local user database), you would create users inside Keycloak, assign them to different groups, then create applications (which handle configuration for individual applications like grafana and gitea) and create rules that specify that only users that belong to specific group can login to specific application.

You can also allow linking multiple external SSOs this way to single keycloak identity, and even include login through kerberos5 or client certificates.

Re: Keycloak: Open-Source Identity and Access Management

#45

Post by mkdirp »

mooreds wrote: post #42
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

> Beware: they aren't using Docker Hub anymore. Do you know why? Is it because of the docker hub pricing changes? I found this discussion on the mailing list but didn't see a reason why: https://lists.jboss.org/pipermail/keycloak-user/2019-March/0...

Pretty sure it's because the core devs are RH employees, who owns Quay. Seems reasonable to keep things on your own infra.

Having said that, I know there has been some falling out between RH and Docker some time ago, which was one of the reason RH ended up creating Podman.

Re: Keycloak: Open-Source Identity and Access Management

#46

Post by papercrane »

mooreds wrote: post #42
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

> Beware: they aren't using Docker Hub anymore. Do you know why? Is it because of the docker hub pricing changes? I found this discussion on the mailing list but didn't see a reason why: https://lists.jboss.org/pipermail/keycloak-user/2019-March/0...

This is the publicly stated reasoning:

https://lists.jboss.org/pipermail/keycloak-user/2019-March/0...

Mostly I think the answer is just that it's a Red Hat project and Red Hat wants to use their ecosystem.

Re: Keycloak: Open-Source Identity and Access Management

#47

Post by [deleted] »

mooreds wrote: post #42
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

> Beware: they aren't using Docker Hub anymore. Do you know why? Is it because of the docker hub pricing changes? I found this discussion on the mailing list but didn't see a reason why: https://lists.jboss.org/pipermail/keycloak-user/2019-March/0...

[deleted]

Re: Keycloak: Open-Source Identity and Access Management

#49

Post by ffo »

davidcollantes wrote: post #15

We are currently using Shibboleth, and would love to get away from using java/Tomcat. It looks like Keycloak also uses java. Is there an alternative to this that doesn't require it?

Maybe https://github.com/zitadel/zitadel could be an alternative to you.

Its written in Go, can be self-hosted or used from a cloud service.

It will also soon (end of May) provide SAML 2.0 support besides the current OpenID Connect and OAuth support.

Disclaimer: I am one of the authors ;-)

Re: Keycloak: Open-Source Identity and Access Management

#50

Post by mooreds »

doctor_eval wrote: post #24

My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…

We hear comments like this a lot. Keycloak has a lot of functionality but also a lot of quirks. We have a product, FusionAuth, that folks often consider at the same time.

Similarities between our products:

* Overall base feature set (OAuth, OIDC, SAML, user management, authentication, RBAC) is similar.

* Both written in Java.

* Both use container technology to hide Java from you :)

* Both offer commercial support (Redhat SSO is the commercial offering for Keycloak, FusionAuth has paid editions with support). FusionAuth is much less expensive (compare https://marketplace.redhat.com/en-us/products/red-hat-single... with https://fusionauth.io/pricing .)

* Both offer the ability to self-host.

* Both develop in the open (we use GitHub issues, they use a mailing list).

Differences:

* They're OSS, we are free as in beer.

* I haven't found a compelling hosting solution for Keycloak, most folks self host. FusionAuth offers a hosted product if you'd like.

* Keycloak has more niche features (CAS SSO support) and a bigger community.

* FusionAuth has better, more straightforward docs.

* FusionAuth user UI customization is easier.

* FusionAuth supports a number of languages with client libraries for easier config management. I only saw a python client library for Keycloak.

* FusionAuth supports unlimited tenants, limited only by your server's resources. We have folks running thousands of tenants. Last time I looked Keycloak had issues around 400 realms (their term for tenants): https://keycloak.discourse.group/t/maximum-limit-of-realms/8...

Disclosure: I work for FusionAuth.

Post reply on HN