Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

101–110 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#101

Post by yrro »

erwincoumans wrote: post #82
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

Thanks for the thumbs up! >> 562MB Curious, why is the Quay image/container so large? Is there a way to list the contents without downloading it?

The base image (registry.access.redhat.com/ubi8-minimal) is about 100 MiB.

    ID                                                                CREATED       CREATED BY                                                                                                                                                                                                                                                                                SIZE        COMMENT
    a6bd0f949af01b5680767225c3ac2b428d9b6921a6a9a420f6189f2523931c4c  18 hours ago  ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]                                                                                                                                                                                                                                                    0 B         buildkit.dockerfile.v0
                                                             18 hours ago  EXPOSE map[8443/tcp:{}]                                                                                                                                                                                                                                                                   0 B         buildkit.dockerfile.v0
                                                             18 hours ago  EXPOSE map[8080/tcp:{}]                                                                                                                                                                                                                                                                   0 B         buildkit.dockerfile.v0
                                                             18 hours ago  USER 1000                                                                                                                                                                                                                                                                                 0 B         buildkit.dockerfile.v0
                                                             18 hours ago  RUN /bin/sh -c microdnf update -y &&     microdnf install -y java-11-openjdk-headless && microdnf clean all && rm -rf /var/cache/yum/* &&     echo "keycloak:x:0:root" >> /etc/group &&     echo "keycloak:x:1000:0:keycloak user:/opt/keycloak:/sbin/nologin" >> /etc/passwd # buildkit  272 MB      buildkit.dockerfile.v0
                                                             18 hours ago  COPY /opt/keycloak /opt/keycloak # buildkit                                                                                                                                                                                                                                               192 MB      buildkit.dockerfile.v0
    1ecf95eda522cf8db84ac321e43a353deea042480ed4e97e02c5290eb53390c3  5 days ago                                                                                                                                                                                                                                                                                              20.5 kB     
                                                             5 days ago                                                                                                                                                                                                                                                                                              107 MB      Imported from -

Re: Keycloak: Open-Source Identity and Access Management

#102

Post by stebenz »

jordemort wrote: post #85
ffo wrote: post #40

Earlier quoted context omitted.

You might want to have a look on zitadel [1] If you are intrigued into the differences, you can read some of them here [2] Oh and judging from your username: it could be interesting to you... because we use eventsourcing and cqrs ;-) Disclaimer: I am one of the authors 1. https://github.com/zitadel/zitadel/ 2. https://zitadel.ch/blog/zitadel-vs-keycloak

I was interested in Zitadel, but because it requires Kubernetes, it can't replace Keycloak in my docker-compose managed homelab setup. If you could just run it as a standalone container, I'd give it a shot.

Sounds like you would be interested in v2 (https://zitadel.ch/v2) as in it will be provided as single binary, which you should be able to use in our homelab setup.

There are a lot of other improvements, but if that's the only dealbreaker, v2 should take care of it.

Re: Keycloak: Open-Source Identity and Access Management

#104

Post by sebmellen »

ffo wrote: post #74
sebmellen wrote: post #69

Earlier quoted context omitted.

What is your opinion on ORY, specifically ORY Kratos? We have been building on Kratos for some time now and find that it is not super well documented, but it is still a very pleasant experience and their ORY Cloud project is backed by support from their team. How does Zitadel differ/compare? Do you have similar goals as an organization?

Well to keep it brief, we see it the following way. Use: - ZITADEL: If you want turnkey solution built for the cloud with a great support for B2B, a strong audit trail and self-hosting, but also the option for SaaS - Ory: If you want flexibility to customize all the stuff but are aware that it is not as turnkey as ZITADEL and Keycloak - Keycloak: If you want turnkey with a high maturity and a lot of features but some…

Make sense, thank you for the answer! I do think the turnkey solution middleground is badly needed and I'm excited to see where ZITADEL goes. We've already committed heavily to Ory on this project, but maybe on the next one we'll be able to explore ZITADEL!

Re: Keycloak: Open-Source Identity and Access Management

#105

Post by jordemort »

stebenz wrote: post #102
jordemort wrote: post #85

Earlier quoted context omitted.

I was interested in Zitadel, but because it requires Kubernetes, it can't replace Keycloak in my docker-compose managed homelab setup. If you could just run it as a standalone container, I'd give it a shot.

Sounds like you would be interested in v2 ( https://zitadel.ch/v2 ) as in it will be provided as single binary, which you should be able to use in our homelab setup. There are a lot of other improvements, but if that's the only dealbreaker, v2 should take care of it.

Yep, that's the only dealbreaker for me - I'll keep an eye out for v2!

Re: Keycloak: Open-Source Identity and Access Management

#108

Post by sascha_sl »

Perseids wrote: post #77
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

> In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Hot take: OAuth2 is a really shitty protocol. It is one of those technologies that get a lot of good press, because it enables you to do stuff you wouldn't be able to do in standardized manner without resorting to abysmal alternatives (SAML in this case). And because of that it shines in comparison. But looking at it…

For most Keycloak users, a very tiny subset of OIDC is being used too. Usually there is no three way relationship between a third party developer, an API provider and a user anymore. You could rip scopes out of Keycloak and few users wouldn't be able to cover their use cases. Rarely is there more than one set of scopes being used with the same client.

Keycloak also supports some very obscure specs, my favourite probably being "Client Initiated Backend Authentication" which can enable a push message sent to authenticator app type authentication flow using a lot of polling and/or webhooks.

Re: Keycloak: Open-Source Identity and Access Management

#109

Post by ffo »

sebmellen wrote: post #104
ffo wrote: post #74

Earlier quoted context omitted.

Well to keep it brief, we see it the following way. Use: - ZITADEL: If you want turnkey solution built for the cloud with a great support for B2B, a strong audit trail and self-hosting, but also the option for SaaS - Ory: If you want flexibility to customize all the stuff but are aware that it is not as turnkey as ZITADEL and Keycloak - Keycloak: If you want turnkey with a high maturity and a lot of features but some…

Make sense, thank you for the answer! I do think the turnkey solution middleground is badly needed and I'm excited to see where ZITADEL goes. We've already committed heavily to Ory on this project, but maybe on the next one we'll be able to explore ZITADEL!

Thank you too. Feel free to join our chat and ask questions any time https://zitadel.ch/chat (discord)

Re: Keycloak: Open-Source Identity and Access Management

#110

Post by littlecranky67 »

e1g wrote: post #97
Perseids wrote: post #77

Earlier quoted context omitted.

> In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Hot take: OAuth2 is a really shitty protocol. It is one of those technologies that get a lot of good press, because it enables you to do stuff you wouldn't be able to do in standardized manner without resorting to abysmal alternatives (SAML in this case). And because of that it shines in comparison. But looking at it…

You're right about the complexity and the steep learning curve, but there's hope that OAuth 2.1 will simplify this mess by forcing almost everyone to use a simple setup: authorization code + PKCE + dPoP. No "implicit flow" madness. Another big problem with OAuth is the lack of quality client/server libraries. For example, in JS/Node, there's just one lone hero ( https://github.com/panva ) doing great work against an…

The problem with the authorization code flow is, it was not build with SPAs in mind. I.e. you always need a server-side component that obtains those tokens.

So a 100% client/FE solution based on NextJS/React/angular/vue etc. can not simply be deployed to a CDN and then use Auth0/AWS Cognito/Azure AD whatever without running and hosting your own server-side component.

Post reply on HN