Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

171–180 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#171

Post by js4ever »

stebenz wrote: post #102
jordemort wrote: post #85

Earlier quoted context omitted.

I was interested in Zitadel, but because it requires Kubernetes, it can't replace Keycloak in my docker-compose managed homelab setup. If you could just run it as a standalone container, I'd give it a shot.

Sounds like you would be interested in v2 ( https://zitadel.ch/v2 ) as in it will be provided as single binary, which you should be able to use in our homelab setup. There are a lot of other improvements, but if that's the only dealbreaker, v2 should take care of it.

Wow I was not expecting that! Usually offering only a Kubernetes version is the new way to force small users to the SaaS version.

Re: Keycloak: Open-Source Identity and Access Management

#172

Post by 0xbadcafebee »

sirmike_ wrote: post #63

Have used and brought keycloak into many companies over the years as a solution. Steep learning curve a little. But it essentially works as designed either as the IDP (rare in my exp) or as a IAM broker more common. Big companies need it because their hands are tied to old and inflexible vendor's APIs. However they can with some effort craft a branded and modern UI/UX. Backend works with just about anything old Auth…

RedHat never needed anyone's help to ruin things. Their solutions are poorly designed bloated crap that "can get the job done" if you run them within a RedHat platform and don't mind banging your head against a brick wall. Just because they're open source darlings doesn't mean we can't call a spade a spade.

Re: Keycloak: Open-Source Identity and Access Management

#173

Post by mooreds »

vosper wrote: post #161

Is Keycloak a good option if I want to setup a SAML Service Provider using user records from my own MySQL database? I've looked at Okta and Keycloak and it's not really obvious to whether I'm supposed to give up my User table and let the auth system handle it, or whether the user data ends up being spread between my DB and the auth system (I think that's how Okta would be implemented). I know I could roll my own with…

Are you asking if you can use Keycloak with your own user table? Typically these identity providers want to own the user, so would expect you to port the user info, including password hashes, into them.

If you have data that is user related but not auth related (application specific data), I've seen a few patterns:

* Push it all into the auth provider. Not sure about keycloak, but some providers have the ability to store arbitrary data (a blob, basically) about a user.

* Create a table in your database with an identifier provided by Keycloak, preferably an immutable one. Then when a user logs in, you can find their identifier, then look up the application specific data.

If you want to have all PII in one place, the former option is best. If you want to maximize your flexibility, the latter is what I'd suggest.

If you want to keep the user data in your database, I'd look at a library (as you suggest). It's a different class of solution than a standalone auth provider like Keycloak.

Re: Keycloak: Open-Source Identity and Access Management

#174

Post by dwaite »

littlecranky67 wrote: post #110
e1g wrote: post #97

Earlier quoted context omitted.

You're right about the complexity and the steep learning curve, but there's hope that OAuth 2.1 will simplify this mess by forcing almost everyone to use a simple setup: authorization code + PKCE + dPoP. No "implicit flow" madness. Another big problem with OAuth is the lack of quality client/server libraries. For example, in JS/Node, there's just one lone hero ( https://github.com/panva ) doing great work against an…

The problem with the authorization code flow is, it was not build with SPAs in mind. I.e. you always need a server-side component that obtains those tokens. So a 100% client/FE solution based on NextJS/React/angular/vue etc. can not simply be deployed to a CDN and then use Auth0/AWS Cognito/Azure AD whatever without running and hosting your own server-side component.

There is a document meant for best practices for browser-based apps such as SPA/PWA, which includes use of code flow.

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-brows...

(disclaimer - co-author)

The catch is that since the client web origin and AS web origin are often different sites, the AS has to actually implement CORS on their token endpoint.

Some implementations unfortunately (perhaps due to a misunderstanding about what CORS is meant to accomplish) make this a per-tenant/per-installation allowlist of origins on the AS.

Auth0 and Ping Identity (my employer) document CORS settings for products. I'm not sure about AWS and you might need to add CORS via API gateway. Azure AD supports CORS for the token endpoint, but they may limit domains in some manner (such as redirect uri of registered clients).

FWIW, I created a demo ages ago (at https://github.com/pingidentity/angular-spa-sample), which by default is configured to target Google for OpenID Connect and uses localhost for local development/testing. It hasn't aged particularly well in terms of library choices, but I do keep it running.

A deployment based on older Angular is also at https://angular-appauth.herokuapp.com to try - IIRC I used a node server just to deal with wildcard path resolution of the index file, but there's otherwise no local logic.

Re: Keycloak: Open-Source Identity and Access Management

#175

Post by adlerhurst »

s1mon wrote: post #84

Does Keycloak or any of the alternatives mentioned here do a good job of supporting localization? What about customization of the email messages for lost password flows?

zitadel allows to change the texts of emails and login texts, but at the moment only for languages already supported at the moment of writing en, it, de

disclaimer: I'm one of the authors of ZITADEL

Re: Keycloak: Open-Source Identity and Access Management

#176

Post by pax »

mekster wrote: post #136
pax wrote: post #90

Slightly off-topic: Could anybody recommend a lightweight, self-hosted php IAM that would handle new accounts (with email confirmation), password recovery, maybe user groups? I've been using Wordpress a couple of times just for the user management, not very proud of that but I didn't know better :/

SSO is not a blogging system. You don't choose by the language.

I'm not looking for SSO. Did I use IAM wrongly? I'm talking about tiny apps that do require a protected back-end access, generally for somewhat bootstrapped CSOs. Not looking for anything fancy, but rather quick and dirty. For example, updating a SQLite db via gSheets API. PHP as that's default for shared hosting.

Re: Keycloak: Open-Source Identity and Access Management

#178

Post by doctor_eval »

stebenz wrote: post #102
jordemort wrote: post #85

Earlier quoted context omitted.

I was interested in Zitadel, but because it requires Kubernetes, it can't replace Keycloak in my docker-compose managed homelab setup. If you could just run it as a standalone container, I'd give it a shot.

Sounds like you would be interested in v2 ( https://zitadel.ch/v2 ) as in it will be provided as single binary, which you should be able to use in our homelab setup. There are a lot of other improvements, but if that's the only dealbreaker, v2 should take care of it.

Apache 2.0 and golang. Thank you! That’s exactly what I was looking for. I’ll check out v2 asap.

Re: Keycloak: Open-Source Identity and Access Management

#179

Post by gabereiser »

dugite-code wrote: post #18
gabereiser wrote: post #14

Earlier quoted context omitted.

I’ve been a keycloak advocate since my jboss days (really the only good thing that came out of jboss). I have never heard of authentik and I’m so glad you mentioned it, it looks amazing! I had been contemplating doing a similar project but this would satisfy that need. Thank you.

Just be careful with Athentik, it is an extremely young, rapidly developing project. So expect the odd pitfall

Yeah, needs battle hardening, but I like what they are doing and the features it offers so bookmarked and starred!
Post reply on HN