Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

131–140 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#131

Post by schipplock »

yrro wrote: post #96
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

Can you disclose the number of users & apps you have? Are you using Keycloak or do you pay for Red Hat Single Sign-On (for context, that's the name of the downstream product that Red Hat sell subscriptions for).

We are using keycloak, not SSO. There is no long-term-support keycloak version available, so we are considering buying into Redhat SSO.

Re: Keycloak: Open-Source Identity and Access Management

#132

Post by mooreds »

s1mon wrote: post #84

Does Keycloak or any of the alternatives mentioned here do a good job of supporting localization? What about customization of the email messages for lost password flows?

Can't speak for Keycloak, but FusionAuth supports localization of both user facing HTML and email/SMS messages. (Not the admin screens, alas.)

More details here: https://fusionauth.io/docs/v1/tech/core-concepts/localizatio...

15 languages have user facing translations: https://github.com/FusionAuth/fusionauth-localization/

Disclosure: I work for FusionAuth.

Re: Keycloak: Open-Source Identity and Access Management

#134

Post by e1g »

littlecranky67 wrote: post #110
e1g wrote: post #97

Earlier quoted context omitted.

You're right about the complexity and the steep learning curve, but there's hope that OAuth 2.1 will simplify this mess by forcing almost everyone to use a simple setup: authorization code + PKCE + dPoP. No "implicit flow" madness. Another big problem with OAuth is the lack of quality client/server libraries. For example, in JS/Node, there's just one lone hero ( https://github.com/panva ) doing great work against an…

The problem with the authorization code flow is, it was not build with SPAs in mind. I.e. you always need a server-side component that obtains those tokens. So a 100% client/FE solution based on NextJS/React/angular/vue etc. can not simply be deployed to a CDN and then use Auth0/AWS Cognito/Azure AD whatever without running and hosting your own server-side component.

Even for 100% FE solutions, the current best practice from OAuth authors [1][2] is to use authorization code + PKCE (optionally, +dPoP). The implicit flow is deprecated (since PKCE), and from OAuth 2.1 it will be removed entirely.

[1] https://datatracker.ietf.org/doc/html/draft-ietf-oauth-secur...

[2] https://auth0.com/docs/get-started/authentication-and-author...

Re: Keycloak: Open-Source Identity and Access Management

#135

Post by kirbyfan64sos »

CGamesPlay wrote: post #66
whazor wrote: post #11

Authentik is also worth checking out: https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.

This looks awesome! I dropped Keycloak because it's 2 GiB of RAM was too much for me to commit to SSO on my tiny VPS, so I just switched to static htpasswd management. But this looks like it might be a great replacement. It seems to support groups/selective access to services through group membership, which is great. Does it support username authentication or does it require that an LDAP server or other OIDP is used…

Do note that Authentik, being a Python project, still uses a decent amount of RAM IMO.

I think Keycloak 18 should use less memory? Might be worth a try.

Re: Keycloak: Open-Source Identity and Access Management

#136

Post by mekster »

pax wrote: post #90

Slightly off-topic: Could anybody recommend a lightweight, self-hosted php IAM that would handle new accounts (with email confirmation), password recovery, maybe user groups? I've been using Wordpress a couple of times just for the user management, not very proud of that but I didn't know better :/

SSO is not a blogging system. You don't choose by the language.

Re: Keycloak: Open-Source Identity and Access Management

#137

Post by mekster »

advaitruia wrote: post #92

Other open source auth solutions: Ory, SuperTokens.com , Supabase / GoTrue If anyone has evaluated these / Keycloak, I'd be happy to have a discussion on it

What are your experiences?

There are also Authentik, Authelia, Dex and gluu.

There was a bad review of gluu in Reddit.

https://www.reddit.com/r/selfhosted/comments/fxotbi/experien...

Re: Keycloak: Open-Source Identity and Access Management

#138

Post by JacobiX »

I've integrated keycloak for SSO in our apps, we have a one-to-one mapping between keycloak realms and the tenants in our apps, works great and it can glue together many disparate IdP/auth solutions: onelogin, LDAP/AD, etc. At one moment we needed to implement a custom OTP method, so we developed a plugin by implementing a simple SPI (the auth flow is configurable). It is a very stable piece of software, we have a combination of Terraform+ansible scripts to deploy it, and once it is done we forget about it until we need to upgrade the version using the same scripts. The biggest drawback IMHO is the documentation quality ...
Post reply on HN