Anyone who has used wso2 identity server? It's an open source identity solution with many customizations available, but it requires a license for commercial use though.
Keycloak: Open-Source Identity and Access Management
81–90 of 243 posts
Re: Keycloak: Open-Source Identity and Access Management
#82In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…
Thanks for the thumbs up!
>> 562MB
Curious, why is the Quay image/container so large? Is there a way to list the contents without downloading it?
Re: Keycloak: Open-Source Identity and Access Management
#83My biggest complaint with Keycloak is that the documentation is poor. You will need to set various flags to fit your use-case. Lots of googling and SO to get things running. Some of the options have changed since 17.x so many guides are outdated.
This was definitely true for the Wildfly/JBoss version, but on Quarkus configuring Keycloak is mostly trivial now[1]. The only options I had to set outside environment variables in production are related to Infinispan discovery.
Re: Keycloak: Open-Source Identity and Access Management
#84Does Keycloak or any of the alternatives mentioned here do a good job of supporting localization? What about customization of the email messages for lost password flows?
Re: Keycloak: Open-Source Identity and Access Management
#85My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…
You might want to have a look on zitadel [1] If you are intrigued into the differences, you can read some of them here [2] Oh and judging from your username: it could be interesting to you... because we use eventsourcing and cqrs ;-) Disclaimer: I am one of the authors 1. https://github.com/zitadel/zitadel/ 2. https://zitadel.ch/blog/zitadel-vs-keycloak
I was interested in Zitadel, but because it requires Kubernetes, it can't replace Keycloak in my docker-compose managed homelab setup. If you could just run it as a standalone container, I'd give it a shot.
Re: Keycloak: Open-Source Identity and Access Management
#86Recently deployed Keycloak as a front end to hide legacy auth in our org and put OAuth in front of it. Despite the apparent complexity under the hood, it works great and no complaints so far. By and large, it just does what it says on the tin and works.
Re: Keycloak: Open-Source Identity and Access Management
#87In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…
> Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation.
This is one area where incentives don't align correctly for open source projects that offer commercial support.
Re: Keycloak: Open-Source Identity and Access Management
#88I have been using Keycloak for the past couple of years in my homelab for SSO. It works really well, but there's a bit of a learning curve.
What would you say have been the positives and negatives of it? Is the learning curve above and beyond OIDC/OAuth? How much did you have to customize it?
Keycloak just assumes you know OIDC terminology, and it has some quirks that you might not expect (e.g. until recently, client credential grants created a refresh token).
It also, concerningly, uses some OIDC terminology outside of OIDC. There are two kinds of scopes in Keycloak. OIDC scopes (that are a set of mappers and represent permissions) and which client and realm roles can be included in a token (including the famous "Full Scope allowed" option that'll dump all roles into your token if you use the default OIDC scope).
A lot of behavior is also just implicit. Particularly in the Authentication Flow Editor. You just gotta know what you want if you want to customize them. The Audience mapper is another tricky one, relying on the (not OIDC) scope to figure out which client to put into the "aud" claim.
Re: Keycloak: Open-Source Identity and Access Management
#89We are currently using Shibboleth, and would love to get away from using java/Tomcat. It looks like Keycloak also uses java. Is there an alternative to this that doesn't require it?
possibly https://www.ory.sh/
ORY is amazing, but it also requires significiant investment. It's a headless API (so you never have to touch OAuth/OIDC internals) for building your own IdP.
Re: Keycloak: Open-Source Identity and Access Management
#90Slightly off-topic: Could anybody recommend a lightweight, self-hosted php IAM that would handle new accounts (with email confirmation), password recovery, maybe user groups? I've been using Wordpress a couple of times just for the user management, not very proud of that but I didn't know better :/