Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

111–120 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#111

Post by fjni »

sascha_sl wrote: post #91
fjni wrote: post #36

My biggest issue in the version I was evaluating: Some service providers use “email” as username (in fact many do.) Keycloak doesn’t make it easy to prohibit users from changing their own email, making it trivial to impersonate someone else and gain access one shouldn’t have. https://keycloak.discourse.group/t/hide-disable-email-change...

Keycloak actually makes it very easy now, assuming you have account-api and account2 feature flags set (default these days). You remove "manage-account" inside the "account" client from the default roles. Do mind this breaks the account console for those users (which is what you probably want anyway).

I don’t remember exactly, but I think this also took away the ability for users to manage their factors (I.e. register a new hardware token)

Re: Keycloak: Open-Source Identity and Access Management

#112

Post by newera2016 »

jonkoops wrote: post #94
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

We're actually working on a new version of the Administration UI at the moment (I'm one of the devs) so this is useful feedback. We're looking for folks to try it out, so take a look at https://github.com/keycloak/keycloak-admin-ui/ . You can try it out on the latest Keycloak by passing the --features=admin2 flag on startup.

We have way too many issues with KeyCloak. Sometimes I wonder why did we integrate this. One of the main issue is when you authorize by Github but cancel the authentication, it redirects to KeyCloak page rather than our login page. Couldn't find any solution yet.

Re: Keycloak: Open-Source Identity and Access Management

#113

Post by fjni »

mooreds wrote: post #57
fjni wrote: post #36

My biggest issue in the version I was evaluating: Some service providers use “email” as username (in fact many do.) Keycloak doesn’t make it easy to prohibit users from changing their own email, making it trivial to impersonate someone else and gain access one shouldn’t have. https://keycloak.discourse.group/t/hide-disable-email-change...

Did they offer some kind of verification path? So you could only allow an email change if the user proved they owned the new email account by clicking a link or entering a code sent to that account? Seems like a natural option. Of course, allowing you to disallow email changes seems pretty reasonable too.

The issue if I remember correctly was that you could require the email to be verified. But while that verification was pending, it would already use the new email as the user’s asserted attribute.

Re: Keycloak: Open-Source Identity and Access Management

#114

Post by littlecranky67 »

mooreds wrote: post #54
littlecranky67 wrote: post #39

As others mentioned, Keycloak is a good choice if you need a self-hosted IAM solution and are familiar with Java development. If you don't need selfhosted, I can recommend using Amazon AWS Cognito as a OAuth2/IAM solution - it is included in the free tier for up to 50.000 MAUs, plus the signup/lost password mails etc. are sent through Amazon SES, which heavily increases the inboxing rate. You could always transition…

What are your main reasons for recommending Cognito? That it is free and easy to get going with? Have you customized the user login experience? I only ask because I've heard folks talk about how Cognito does the basics right (which is great, no one should roll their own auth) and is quick to get started with, and is serverless and free (unless you want SAML connections). But once you get past the basics, it turns int…

Yes, I mostly recommend it because it is free and I've used before, plus I've been on several projects where we used Keycloak. For me, Cognito's 50.000 monthly active users is probably all I will ever need, and as you said, its quick to get started. Keycloak is the other way around, you will have to invest beforehand into learning and running it. Also, if you allow self-signup by your users, Email inboxing is a serious issue. So even if you run Keycloak yourself, you must think how you are going to deliver emails - which will bring you to other SaaS services like MailChimp or AWS SES anyway.

I can't speak about FusionAuth or Auth0, but yes, other SaaS might be as good as Cognito as well - but I do not know their free tiers.

Disclaimer: I am not working for any of those, just a small side-gig SaaS builder/WebDev speaking of my experience.

Re: Keycloak: Open-Source Identity and Access Management

#115

Post by littlecranky67 »

psnehanshu wrote: post #98
littlecranky67 wrote: post #37

Earlier quoted context omitted.

Was working at a Java shop once which used Keycloak as a central IAM solution. As an FE Dev, I was tasked to customize/style the login-page provided by Keycloak, and quickly faced what you described: Pretty heavily Java-based, even to edit HTML templates I had to recompile using a full blown Java/JVM stack. As an FE dev without Java background, this became pretty difficult. But once we finished that with the help of…

Why customize the FE when you can use the keycloak-js[1] NPM library to integrate with any JS framework? [1] https://www.npmjs.com/package/keycloak-js

Because that is not how you customize the login/signup page that lives inside Keycloak (and its Docker image, if you use docker).

Re: Keycloak: Open-Source Identity and Access Management

#116

Post by littlecranky67 »

mooreds wrote: post #54
littlecranky67 wrote: post #39

As others mentioned, Keycloak is a good choice if you need a self-hosted IAM solution and are familiar with Java development. If you don't need selfhosted, I can recommend using Amazon AWS Cognito as a OAuth2/IAM solution - it is included in the free tier for up to 50.000 MAUs, plus the signup/lost password mails etc. are sent through Amazon SES, which heavily increases the inboxing rate. You could always transition…

What are your main reasons for recommending Cognito? That it is free and easy to get going with? Have you customized the user login experience? I only ask because I've heard folks talk about how Cognito does the basics right (which is great, no one should roll their own auth) and is quick to get started with, and is serverless and free (unless you want SAML connections). But once you get past the basics, it turns int…

I just checked prices of FusionAuth, and clearly your company is not interested in smaller side-gig like customers or self-funded startup that need to grow. Basic, production cloud options (non-eval) start at $162/mo for 10.000 MAUs. Once I move the slide to over 10.000MAUs the basic option is gone, and the cheapest option suddenly jumps to $1062/mo.

Re: Keycloak: Open-Source Identity and Access Management

#117

Post by joekrill »

sebmellen wrote: post #69
ffo wrote: post #40

Earlier quoted context omitted.

You might want to have a look on zitadel [1] If you are intrigued into the differences, you can read some of them here [2] Oh and judging from your username: it could be interesting to you... because we use eventsourcing and cqrs ;-) Disclaimer: I am one of the authors 1. https://github.com/zitadel/zitadel/ 2. https://zitadel.ch/blog/zitadel-vs-keycloak

What is your opinion on ORY, specifically ORY Kratos? We have been building on Kratos for some time now and find that it is not super well documented, but it is still a very pleasant experience and their ORY Cloud project is backed by support from their team. How does Zitadel differ/compare? Do you have similar goals as an organization?

That's really surprising to me. I've been building some things with Ory Kratos myself and I find the documentation pretty good. There's definitely room for improvement but I'm typically able to find what I need pretty easily. I certainly find it much more usable than the Keycloak docs.

Re: Keycloak: Open-Source Identity and Access Management

#119

Post by Turbots »

yrro wrote: post #101
erwincoumans wrote: post #82

Earlier quoted context omitted.

Thanks for the thumbs up! >> 562MB Curious, why is the Quay image/container so large? Is there a way to list the contents without downloading it?

The base image (registry.access.redhat.com/ubi8-minimal) is about 100 MiB. ID CREATED CREATED BY SIZE COMMENT a6bd0f949af01b5680767225c3ac2b428d9b6921a6a9a420f6189f2523931c4c 18 hours ago ENTRYPOINT ["/opt/keycloak/bin/kc.sh"] 0 B buildkit.dockerfile.v0 18 hours ago EXPOSE map[8443/tcp:{}] 0 B buildkit.dockerfile.v0 18 hours ago EXPOSE map[8080/tcp:{}] 0 B buildkit.dockerfile.v0 18 hours ago USER 1000 0 B buildkit.do…

No post body was provided.

Re: Keycloak: Open-Source Identity and Access Management

#120

Post by mooreds »

littlecranky67 wrote: post #116
mooreds wrote: post #54

Earlier quoted context omitted.

What are your main reasons for recommending Cognito? That it is free and easy to get going with? Have you customized the user login experience? I only ask because I've heard folks talk about how Cognito does the basics right (which is great, no one should roll their own auth) and is quick to get started with, and is serverless and free (unless you want SAML connections). But once you get past the basics, it turns int…

I just checked prices of FusionAuth, and clearly your company is not interested in smaller side-gig like customers or self-funded startup that need to grow. Basic, production cloud options (non-eval) start at $162/mo for 10.000 MAUs. Once I move the slide to over 10.000MAUs the basic option is gone, and the cheapest option suddenly jumps to $1062/mo.

Thanks for taking a look. For your use case, I'd probably recommend self hosting community edition. FusionAuth price: $0.

You could do this on ec2, etc, or there's a heroku 'one click deploy': https://elements.heroku.com/buttons/mickeymond/fusion-auth-h... This is the path most folks using FusionAuth for side-gig use.

You can download the community edition here: https://fusionauth.io/download

For smaller companies, we recommend business cloud with community edition, which starts at $225/month. The basic hosted version doesn't have backups and so isn't suitable for prod use. I get that this is a lot for a side project (I wouldn't use it for one). Or a self-funded startup--I remember one startup where the entire application was running on about $75/month in hosting spend on heroku. No way would I have paid $225/month for auth.

We have a slightly complicated pricing model (with both hosting and licensed editions, creating a matrix that is not typical), but I truly appreciate your feedback and will share it internally.

Edit: Added startup anecdote.

Post reply on HN