Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

91–100 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#91

Post by sascha_sl »

fjni wrote: post #36

My biggest issue in the version I was evaluating: Some service providers use “email” as username (in fact many do.) Keycloak doesn’t make it easy to prohibit users from changing their own email, making it trivial to impersonate someone else and gain access one shouldn’t have. https://keycloak.discourse.group/t/hide-disable-email-change...

Keycloak actually makes it very easy now, assuming you have account-api and account2 feature flags set (default these days). You remove "manage-account" inside the "account" client from the default roles. Do mind this breaks the account console for those users (which is what you probably want anyway).

Re: Keycloak: Open-Source Identity and Access Management

#93

Post by navbaker »

Transitioning a preexisting web stack in our corporate network from Identity Server to Keycloak has been my extremely rough intro to the world of auth. I would say I’m almost there, but have one issue holding me up. We have a few different data enclaves, including one that requires users to sign an NDA and be added to an AD group. I’ve been searching high and low to see if Keycloak has a simple flag to say “don’t let anyone in that isn’t a member of this AD group”. Does that exist or do I have to create groups in Keycloak itself and add users manually?

Re: Keycloak: Open-Source Identity and Access Management

#94

Post by jonkoops »

schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

We're actually working on a new version of the Administration UI at the moment (I'm one of the devs) so this is useful feedback. We're looking for folks to try it out, so take a look at https://github.com/keycloak/keycloak-admin-ui/.

You can try it out on the latest Keycloak by passing the --features=admin2 flag on startup.

Re: Keycloak: Open-Source Identity and Access Management

#95

Post by oauea »

I think keycloak is fantastic. The only thing I don't really like is how the user profile is deeply baked into the code. It seems they're working on improving this, but at least currently, it is not possible to have users that do not use a "First name" and a "Last name". Which is rather annoying when using it for things like game servers, where people just want to go by their username.

Re: Keycloak: Open-Source Identity and Access Management

#96

Post by yrro »

schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

Can you disclose the number of users & apps you have? Are you using Keycloak or do you pay for Red Hat Single Sign-On (for context, that's the name of the downstream product that Red Hat sell subscriptions for).

Re: Keycloak: Open-Source Identity and Access Management

#97

Post by e1g »

Perseids wrote: post #77
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

> In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Hot take: OAuth2 is a really shitty protocol. It is one of those technologies that get a lot of good press, because it enables you to do stuff you wouldn't be able to do in standardized manner without resorting to abysmal alternatives (SAML in this case). And because of that it shines in comparison. But looking at it…

You're right about the complexity and the steep learning curve, but there's hope that OAuth 2.1 will simplify this mess by forcing almost everyone to use a simple setup: authorization code + PKCE + dPoP. No "implicit flow" madness.

Another big problem with OAuth is the lack of quality client/server libraries. For example, in JS/Node, there's just one lone hero (https://github.com/panva) doing great work against an army of rubbish JWT/OAuth libs.

Re: Keycloak: Open-Source Identity and Access Management

#98

Post by psnehanshu »

littlecranky67 wrote: post #37
doctor_eval wrote: post #24

My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…

Was working at a Java shop once which used Keycloak as a central IAM solution. As an FE Dev, I was tasked to customize/style the login-page provided by Keycloak, and quickly faced what you described: Pretty heavily Java-based, even to edit HTML templates I had to recompile using a full blown Java/JVM stack. As an FE dev without Java background, this became pretty difficult. But once we finished that with the help of…

Why customize the FE when you can use the keycloak-js[1] NPM library to integrate with any JS framework?

[1] https://www.npmjs.com/package/keycloak-js

Re: Keycloak: Open-Source Identity and Access Management

#99

Post by MrTawti »

I used Keycloak about 4 or 5 years ago in a former job. It did work very well. Note however, that we did not need to customize anything nor did we have to deal with scaling (in house web-app where it was rare to have more than 100 people using on it at any given day).

Right now, I'm looking into https://supertokens.com/ I have not used it in any capacity but it does seem much more approachable -at least to me- and allows for much flexibility (code wise on your own Backend).

I would be interested in hearing if anyone here has any feedback.

Re: Keycloak: Open-Source Identity and Access Management

#100

Post by advaitruia »

doctor_eval wrote: post #24

My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…

> my #1 complaint at the time was how heavyweight it was, which was a burden for development What do you mean by "heavyweight"?

I ask because Java in other large open source projects (Elastic Search, Cassandra, Android) and it really depends on how its being used (by Keycloak as well)

I've also come across GraalVM which can significantly reduce Java memory consumption (if that is something you are referring to)

Post reply on HN