Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

161–170 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#161

Post by vosper »

Is Keycloak a good option if I want to setup a SAML Service Provider using user records from my own MySQL database? I've looked at Okta and Keycloak and it's not really obvious to whether I'm supposed to give up my User table and let the auth system handle it, or whether the user data ends up being spread between my DB and the auth system (I think that's how Okta would be implemented).

I know I could roll my own with PassportJS or something, but I'd like all the nice Okta stuff (MFA, password policies, SAML SSO, maybe federation) but integrated with my existing DB. Or is that just too much to ask?

Re: Keycloak: Open-Source Identity and Access Management

#162

Post by paulmd »

schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

> Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity.

> A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot.

To echo everyone else: the Keycloak documentation does not do a good job of hand-holding you at all, and the number of possible ways you can configure and use the system and the amount of jargon and terminology used is massively overwhelming to someone trying to get started. It would be very helpful to have some "white paper"-esque summaries that walk you through some simple, typical use-cases.

I looked through the docs quickly before making this post and as an example here's a basic task for initial setup ("hook up an IDP", basically giving keycloak its database of users), and it's utterly incomprehensible to any human being who doesn't already know how to work the system and really essentially worthless even then. It's just... reading me the command line options and a couple config files? What do any of those values even mean? This is core functionality for Keycloak, and the documentation consists of "yeah, here's a command line with placeholders and a text file syntax, good luck bitches!".

https://www.keycloak.org/server/configuration-provider

Honestly I feel like you could do better simply by jumping into the UI and playing with options, it's not entirely unintuitive what's going on in the UI, but the docs are basically incomprehensible.

I actually know of several projects that have pretty much bogged down because of Keycloak configuration or role/privilege mis-configuration issues and it's not hard to see why. It's the turing tar-pit of IDP, everything is possible and nothing is easy (or documented). Which is a shame because it seems like an awesome piece of software, just inscrutible to the un-initiated.

As others are noting, I'm sure some of this is due to OAuth2 being an inscrutable piece of shit in general, same thing, it tries to do everything and it's so un-opinionated that you end up with a bunch of basically incompatible implementations that are each effectively their own "standard" anyway.

(posted this on the wrong child, moving it to the parent)

Re: Keycloak: Open-Source Identity and Access Management

#163

Post by password4321 »

mooreds wrote: post #153
password4321 wrote: post #151

Is Keycloak something that is intended to be exposed publicly, or is this something typically used behind a VPN or equivalent protection?

It depends on what your needs are. If you are using it for CIAM (customer identity and access management) then you are probably going to be putting it on the internet. If using it for internal IAM (identity and access management, also known as workforce identity) you can keep it inside your network. I believe Keycloak works either way.

Thanks. I was mostly wondering how comfortable "Hacker News" is exposing it publicly... going on zero experience and just gut feeling I put it at about the same level as RDP.

Re: Keycloak: Open-Source Identity and Access Management

#164

Post by _jal »

freedomben wrote: post #145
password4321 wrote: post #87

Earlier quoted context omitted.

> Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. This is one area where incentives don't align correctly for open source projects that offer commercial support.

Disclaimer: Former Red Hatter but worked on OpenShift, not Keycloak Working as a person providing commercial support for open source projects, I promise it doesn't actually work that way. Incentives are entirely for creating good documentation. Having crappy docs only hurts project adoption for paying and non-paying customers, increases the support burden, and wastes the time of your employees (who are the primary co…

I can tell you that at least as of late last year, the OpenShift install docs omitted key details for setting it up.

We were unable to do so until contacting RH and getting additional instructions - I forget the all the details, part of it involved creating DNS records mentioned nowhere in the docs.

Re: Keycloak: Open-Source Identity and Access Management

#165

Post by smcnally »

password4321 wrote: post #87
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

> Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. This is one area where incentives don't align correctly for open source projects that offer commercial support.

> This is one area where incentives don't align correctly for open source projects that offer commercial support.

This is true in some[0] cases. It's also true that documentation is key source of customer acquisition and retention.

Projects get traction by making it useful out of the box[1] for some use-cases, making it appealing for hackers to config and extend, teasing features the former would pay for and the latter could figure out the buy v build.

Projects that do this well also learn shittons from real-world usage and feedback informing their roadmap and new opportunities to pursue.

[0] True when the perspective is "If we make the docs too good we're losing revenue" / "Everyone using Feature X gratis is a loss in MRR." It's an understandable view that's held widely. It's not often a significant revenue factor in my experience, and ~never when accounting for product and market insights gained by wider adoption.

[1] https://news.ycombinator.com/item?id=31259034

Re: Keycloak: Open-Source Identity and Access Management

#166

Post by eclipsenet »

whazor wrote: post #11

Authentik is also worth checking out: https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.

Looks like it got the internet hug-o-death or something b/c it looks like it's down.

Re: Keycloak: Open-Source Identity and Access Management

#167

Post by pas »

_jal wrote: post #164
freedomben wrote: post #145

Earlier quoted context omitted.

Disclaimer: Former Red Hatter but worked on OpenShift, not Keycloak Working as a person providing commercial support for open source projects, I promise it doesn't actually work that way. Incentives are entirely for creating good documentation. Having crappy docs only hurts project adoption for paying and non-paying customers, increases the support burden, and wastes the time of your employees (who are the primary co…

I can tell you that at least as of late last year, the OpenShift install docs omitted key details for setting it up. We were unable to do so until contacting RH and getting additional instructions - I forget the all the details, part of it involved creating DNS records mentioned nowhere in the docs.

How open is OpenShift? Is there a bug where this is tracked and are people contributing at least through issue comments? And response from committers?

Re: Keycloak: Open-Source Identity and Access Management

#168

Post by deadbunny »

whazor wrote: post #11

Authentik is also worth checking out: https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.

Getting cert errors for me when visiting that link. Using a self signed cert by the looks of it?

Edit: Ok now. Looks like they use Let's Encrypt which will default to a self signed cert if it can't get a LE one for whatever reason IIRC.

Re: Keycloak: Open-Source Identity and Access Management

#169

Post by sn0wf1re »

paulmd wrote: post #156
bayesian_horse wrote: post #21

Earlier quoted context omitted.

keycloak can broker between identity providers. It can use social logins as identity providers, connect to ldap, kerberos and others for user federation, and then provide SAML and OpenIDC to other applications.

As someone who has superficially looked into it a couple times and gotten pushed away by the complexity: what do you recommend for a backend? Is there another container that provides an LDAP service I could use? Or Kerberos? I am rebuilding my homelab soon and I am interested in having centralized auth across all systems and as many applications as feasible, using my centralized fileserver as an IDP source via some a…

Personally I just use Keycloak as the backend(storing the user and group information). I provision it with terraform since I find it easier to use than the webUI.

Re: Keycloak: Open-Source Identity and Access Management

#170

Post by mooreds »

password4321 wrote: post #163
mooreds wrote: post #153

Earlier quoted context omitted.

It depends on what your needs are. If you are using it for CIAM (customer identity and access management) then you are probably going to be putting it on the internet. If using it for internal IAM (identity and access management, also known as workforce identity) you can keep it inside your network. I believe Keycloak works either way.

Thanks. I was mostly wondering how comfortable "Hacker News" is exposing it publicly... going on zero experience and just gut feeling I put it at about the same level as RDP.

Ah, I get what you are asking. I think it's far more secure than RDP because the protocols it's based on have learned lessons from RDP.

Here's a document they have about securing Keycloak: https://www.keycloak.org/docs/latest/server_admin/#mitigatin...

I too would be interested to hear from any folks running this software in prod how they deal with securing a public endpoint.

Post reply on HN