91–100 of 134 posts
Cool, but I looks like the creator didn't really look deep in the competition. Many of the question marks in the comparison table can be replaced by a checkmark.
Earlier quoted context omitted.
If you're looking for something but more production ready, Authelia seems like a good option. Vouch and oauth2-proxy are even simpler but more specific in what they do. If you can provide more details of what you're trying to accomplish I might be able to give more specific advice.
I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.
Lots of options that are useful, and pretty good UI for setting things up
Cool, but I looks like the creator didn't really look deep in the competition. Many of the question marks in the comparison table can be replaced by a checkmark.
Indeed. It is slightly misleading at first glance. But the author has stated that it is incomplete. ZITADEL( https://zitadel.com/ ), for example, pretty much checks almost all the boxes.
Earlier quoted context omitted.
I think I did and when I couldn't find useful installation details I gave up, I don't use docker or kubernetes, so if projects can't be bothered to make information available for a generic install, I immediately lose interest.
I do plenty of native installs, and I find Docker based instructions to be a pretty nice universal codex for how things work. Docker entryscripts sometimes have significant magic baked in (alas), but quite often Docker is a distribution mechanism more than anything else. The Docker guides are - 9 times out of 10 - more than informative enough to show how to DIY in any other of the dozens if not hundreds of other syst…
Apt rules!
Ohh, looks extremely promising, I've been after something with a bit more flexibility than Dex while not being Keycloak/Java etc, an LDAP backend would be awesome as well though (another thing thats lacking is a simple ldap server, perhaps with sql as db, openldap is excessive and glauth isn't there)
I’ve found running Samba as a Domain Controller pretty straightforward for this exact use case.
Earlier quoted context omitted.
Indeed. It is slightly misleading at first glance. But the author has stated that it is incomplete. ZITADEL( https://zitadel.com/ ), for example, pretty much checks almost all the boxes.
Which not? Thank you!
As for Forward Auth, the concept can be a bit fuzzy, and from what I gather, ZITADEL doesn't really support that.
Trusted Header Auth might work in some scenarios, but that definition is also a bit fuzzy, so hard to say for sure.
Earlier quoted context omitted.
I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.
I've found https://zitadel.com/ to be a light weight version of keycloak. Lots of options that are useful, and pretty good UI for setting things up
Thank you for the nice words you describe well what we try to achieve!
With ZITADEL we aspire to become the best of Auth0 and Keycloak in more modern package. Or in other words are a end-to-end open source identity infrastructure. I know this sounds a little unspecific but our goals are:
1) Have AuthN/AuthZ, Login, SSO as Turnkey features but also allow people to build their own UIs
2) Have an audit trail that allows people to see all changes ever made
3) Give devs the ability to extend zitadel with custom code (actions)
4) Support well given standards (OIDC/Oauth/SAML/LDAP) with certification if possible
5) Be ease to operate and scale
6) Provide APIs for everything ;-)
Btw. its always nice to see other projects to solve problems in the identity space. To me it feels like Obligator can, at the moment, be best compared to Dex since it feels a lot like a façade service that has little user management capabilities (not that this is a bad thing) but wraps them for easier usage in multiple services. But please take this observation with a lot of salt since I have not used or tinkered with Obligator.
Cheers Florian
I recently came across Caddy Security[1], and while it's not an OIDC IdP itself, it does serve as a good authentication gateway that's easy to get up and running and maintain. 1: https://authp.github.io/
Earlier quoted context omitted.
I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.
How about KeyCloak? We use it for OIDC and it's feature rich with support for private key signing and back channel logout. https://www.keycloak.org/docs/latest/securing_apps/
With the new UI mass admin tasks are no longer possible. At least version upgrades are better now.
Keycloak has no ed25519 support. Louketo proxy or whatever it's called nowadays only supports RS256, so I had to write my own OIDC middleware. At least they stopped generating UUIDv4 secrets.
Hydra is too complex.
Dex is too simple.
Identity Server lacks performance because C#.
Zitadel, heard but not tried yet. The keycloak vs zitadel page doesn't help. Is the Zitadel access token also jwt like in keycloak and included role membership?
I use a Vue client specifically for Keycloak. The generic openid-connect-client is unmaintained. The TS fork doesn't have a working, maintained, reactive implementation.
Why does OIDC have to be so complicated? I know why... so you, like with k8s, trust external, paid for (expensively), companies with your work and data.
The old "make it complicated so people would rather pay for our services".
Remember the story about the oauth1 creator quitting the oauth2 project?
https://www.wired.com/2012/07/developer-quits-oauth-2-0-spec...
Keycloak ed25519 issue https://github.com/keycloak/keycloak/issues/15714
Wouldn't that effectively grant access to your user data to everyone, regardless of their intentions? Meta, for instance, has very strict TOS and privacy policy checks before approving a client_id. And those checks are on-going.
https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web