Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

121–130 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#121

Post by mooreds »

littlecranky67 wrote: post #114
mooreds wrote: post #54

Earlier quoted context omitted.

What are your main reasons for recommending Cognito? That it is free and easy to get going with? Have you customized the user login experience? I only ask because I've heard folks talk about how Cognito does the basics right (which is great, no one should roll their own auth) and is quick to get started with, and is serverless and free (unless you want SAML connections). But once you get past the basics, it turns int…

Yes, I mostly recommend it because it is free and I've used before, plus I've been on several projects where we used Keycloak. For me, Cognito's 50.000 monthly active users is probably all I will ever need, and as you said, its quick to get started. Keycloak is the other way around, you will have to invest beforehand into learning and running it. Also, if you allow self-signup by your users, Email inboxing is a serio…

Thanks for sharing your rationale, makes a ton of sense. Cognito's free tier is great and frankly, takes auth off of many folks' plate. Which is a good thing.

I've heard similar things about Azure AD B2C. Strangely, Google has a comparable offering ( https://cloud.google.com/identity-platform ) but I've never talked with anyone using it.

Re: Keycloak: Open-Source Identity and Access Management

#122

Post by cpitman »

navbaker wrote: post #93

Transitioning a preexisting web stack in our corporate network from Identity Server to Keycloak has been my extremely rough intro to the world of auth. I would say I’m almost there, but have one issue holding me up. We have a few different data enclaves, including one that requires users to sign an NDA and be added to an AD group. I’ve been searching high and low to see if Keycloak has a simple flag to say “don’t let…

Sounds like you want to configure a Group Mapper: https://www.keycloak.org/docs/latest/server_admin/#_ldap_map...

Re: Keycloak: Open-Source Identity and Access Management

#123

Post by mekster »

I've integrated keycloak for SSO between several self hosted apps and boy I had no idea what I was doing but copy paste config from left and right from various sites which worked in the end but does SSO have to be this complicated?

Can someone recommend a simpler solution to integrate SSO with online tools (like NextCloud, Discourse, Wiki.js, Gitea etc)?

Does anyone have experience with Authentik?

Re: Keycloak: Open-Source Identity and Access Management

#124

Post by zmxz »

littlecranky67 wrote: post #110
e1g wrote: post #97

Earlier quoted context omitted.

You're right about the complexity and the steep learning curve, but there's hope that OAuth 2.1 will simplify this mess by forcing almost everyone to use a simple setup: authorization code + PKCE + dPoP. No "implicit flow" madness. Another big problem with OAuth is the lack of quality client/server libraries. For example, in JS/Node, there's just one lone hero ( https://github.com/panva ) doing great work against an…

The problem with the authorization code flow is, it was not build with SPAs in mind. I.e. you always need a server-side component that obtains those tokens. So a 100% client/FE solution based on NextJS/React/angular/vue etc. can not simply be deployed to a CDN and then use Auth0/AWS Cognito/Azure AD whatever without running and hosting your own server-side component.

SPA is HTML/JS served by the server. We don't need client-only solutions. We need devs to understand how HTTP and browsers work.

It means that we simply keep using what actually works, i.e. serverside component that obtains authorization and we use simple mechanisms to ensure token stays at the server and FE speaks to the server which in turn speaks to the target app. Proxying is not that difficult of a problem and we don't have to run in circles, inventing different flows only to cater to devs who can't learn their field.

Re: Keycloak: Open-Source Identity and Access Management

#125

Post by zmxz »

mekster wrote: post #123

I've integrated keycloak for SSO between several self hosted apps and boy I had no idea what I was doing but copy paste config from left and right from various sites which worked in the end but does SSO have to be this complicated? Can someone recommend a simpler solution to integrate SSO with online tools (like NextCloud, Discourse, Wiki.js, Gitea etc)? Does anyone have experience with Authentik?

I've used many solutions, even built my own in the end. Problem is that there's no software that can make SSO easy to understand if you don't know everything about SSO to begin with.

SSO is not that complicated to work with, the docs are just stupidly difficult to read and the point of the whole process is rarely explained. Learning how without knowing why is nearly impossible.

Re: Keycloak: Open-Source Identity and Access Management

#126

Post by voidcommonstock »

doctor_eval wrote: post #24

My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…

Another OAuth2 server, that's well on the other side of the heavyweight spectrum vs. keycloak:

https://github.com/curveball/a12n-server

Re: Keycloak: Open-Source Identity and Access Management

#127

Post by jbaczuk »

doctor_eval wrote: post #24

My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…

I knew I could smell Java when I went to their website...

Re: Keycloak: Open-Source Identity and Access Management

#128

Post by mooreds »

pax wrote: post #90

Slightly off-topic: Could anybody recommend a lightweight, self-hosted php IAM that would handle new accounts (with email confirmation), password recovery, maybe user groups? I've been using Wordpress a couple of times just for the user management, not very proud of that but I didn't know better :/

Geez, I don't know of any. If you have to stick with PHP (as opposed to using some of the other solutions mentioned in comments), I'd probably look to a framework. For example, here's Laravel's offering: https://laravel.com/docs/9.x/authentication#authentication-q...

Re: Keycloak: Open-Source Identity and Access Management

#129

Post by schipplock »

sascha_sl wrote: post #76
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

You should really be building your own multi-stage container so you can prebake KC_FEATURES and KC_DB into the image. https://www.keycloak.org/server/containers

We still use an old version without Quarkus :). But yes, that's the way to go.

Re: Keycloak: Open-Source Identity and Access Management

#130

Post by hamandcheese »

whazor wrote: post #11

Authentik is also worth checking out: https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.

I was interested in Authentik, but I was perusing the docs and was extremely put off by the way in which Authentik manages itself as well as additional “outposts”.

> The docker integration will automatically deploy and manage outpost containers using the Docker HTTP API.

> This integration has the advantage over manual deployments of automatic updates (whenever authentik is updated, it updates the outposts)

NO. I do not want software I use to update itself automatically in prod. And I especially do not want to give a docker socket to it so that it can automatically add new components.

https://goauthentik.io/docs/outposts/integrations/docker

Post reply on HN