Does it support webAuthn?
Yup. Here's the doco for configuring it: https://www.keycloak.org/docs/latest/server_admin/#_webauthn
Keycloak: Open-Source Identity and Access Management
61–70 of 243 posts
Re: Keycloak: Open-Source Identity and Access Management
#62Can I use Keycloak for the following use case? I have a few services on my family server (say, Gitea, Grafana, finance tracking app etc.). I'd like to have a SSO but also limit which users can use which services (e.g. my significant other can use Grafana but no Gitea). Is integrating above services with Keycloak enough? Or would I need another components? Or maybe I've got it wrong and should reconsider the architect…
This is a very common auth situation (wanting to have a central place to control access to multiple applications).
The biggest hurdle I see is do all of your apps support SAML or OAuth/OIDC for authentication/authorization? The SSO tax is a real thing.
Re: Keycloak: Open-Source Identity and Access Management
#63Have used and brought keycloak into many companies over the years as a solution. Steep learning curve a little. But it essentially works as designed either as the IDP (rare in my exp) or as a IAM broker more common.
Big companies need it because their hands are tied to old and inflexible vendor's APIs. However they can with some effort craft a branded and modern UI/UX. Backend works with just about anything old Auth related whilst supporting a newer modern Auth schemes.
I am surprised IBM has not made RHEL ruin it yet.
To say IBM is a slightly better steward of their open source efforts than Oracle never leaves one with much comfort.
Re: Keycloak: Open-Source Identity and Access Management
#64My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…
Was working at a Java shop once which used Keycloak as a central IAM solution. As an FE Dev, I was tasked to customize/style the login-page provided by Keycloak, and quickly faced what you described: Pretty heavily Java-based, even to edit HTML templates I had to recompile using a full blown Java/JVM stack. As an FE dev without Java background, this became pretty difficult. But once we finished that with the help of…
Java backend/React frontend dev here.
I customized Keycloak 10 login page a while back, and it did not require anything but markup. My Keycloak 18 instance runs the same customization now, unchanged.
Re: Keycloak: Open-Source Identity and Access Management
#65I've been running Keycloak for 4 years now, starting with version 10.
I like a well-disciplined stack and Keycloak is a star. And that's huge considering my other big players are Vert.x and PostgreSQL.
Re: Keycloak: Open-Source Identity and Access Management
#66Authentik is also worth checking out: https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.
This looks awesome! I dropped Keycloak because it's 2 GiB of RAM was too much for me to commit to SSO on my tiny VPS, so I just switched to static htpasswd management. But this looks like it might be a great replacement.
It seems to support groups/selective access to services through group membership, which is great. Does it support username authentication or does it require that an LDAP server or other OIDP is used as a source of truth?
Re: Keycloak: Open-Source Identity and Access Management
#67My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…
We hear comments like this a lot. Keycloak has a lot of functionality but also a lot of quirks. We have a product, FusionAuth, that folks often consider at the same time. Similarities between our products: * Overall base feature set (OAuth, OIDC, SAML, user management, authentication, RBAC) is similar. * Both written in Java. * Both use container technology to hide Java from you :) * Both offer commercial support (Re…
> Disclosure: I work for FusionAuth.
Don't worry, that was obvious.
Re: Keycloak: Open-Source Identity and Access Management
#68My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…
Was working at a Java shop once which used Keycloak as a central IAM solution. As an FE Dev, I was tasked to customize/style the login-page provided by Keycloak, and quickly faced what you described: Pretty heavily Java-based, even to edit HTML templates I had to recompile using a full blown Java/JVM stack. As an FE dev without Java background, this became pretty difficult. But once we finished that with the help of…
> even to edit HTML templates I had to recompile using a full blown Java/JVM stack
Next time check the docs and turn off the theme cache: https://www.keycloak.org/docs/latest/server_development/#cre...
> While creating a theme it’s a good idea to disable caching as this makes it possible to edit theme resources directly from the themes directory without restarting Keycloak.
Re: Keycloak: Open-Source Identity and Access Management
#69My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…
You might want to have a look on zitadel [1] If you are intrigued into the differences, you can read some of them here [2] Oh and judging from your username: it could be interesting to you... because we use eventsourcing and cqrs ;-) Disclaimer: I am one of the authors 1. https://github.com/zitadel/zitadel/ 2. https://zitadel.ch/blog/zitadel-vs-keycloak
What is your opinion on ORY, specifically ORY Kratos? We have been building on Kratos for some time now and find that it is not super well documented, but it is still a very pleasant experience and their ORY Cloud project is backed by support from their team.
How does Zitadel differ/compare? Do you have similar goals as an organization?
Re: Keycloak: Open-Source Identity and Access Management
#70Earlier quoted context omitted.
We hear comments like this a lot. Keycloak has a lot of functionality but also a lot of quirks. We have a product, FusionAuth, that folks often consider at the same time. Similarities between our products: * Overall base feature set (OAuth, OIDC, SAML, user management, authentication, RBAC) is similar. * Both written in Java. * Both use container technology to hide Java from you :) * Both offer commercial support (Re…
> Disclosure: I work for FusionAuth. Don't worry, that was obvious.
Ha ha, fair enough. I've found it better to err on the side of transparency.