Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Obligator – An OpenID Connect server for self-hosters

github.com

Post reply on HN
Print view View original

121–130 of 134 posts

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#121

Post by ffo »

apitman wrote: post #117
ffo wrote: post #108

Earlier quoted context omitted.

I think both products could even coexist ;-) SQLlite would be super nice, but we lack engineering capacity right now to get that done.

> I think both products could even coexist Fair enough, but developers and sysadmins don't want to choose between two great options. They want one obvious best option and a second option that is good enough and can be made better if option one turns evil.

Sure, there needs to be a „de facto“ OSS player in the space. Let me tell you that is what we definitely aspire to become.

I always think there was not yet the „gitlab“ effect in the identity space.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#122

Post by ffo »

lakomen wrote: post #99
snappysnap wrote: post #62

Earlier quoted context omitted.

How about KeyCloak? We use it for OIDC and it's feature rich with support for private key signing and back channel logout. https://www.keycloak.org/docs/latest/securing_apps/

I use keycloak, but it's Java and I need Go or better performance. With the new UI mass admin tasks are no longer possible. At least version upgrades are better now. Keycloak has no ed25519 support. Louketo proxy or whatever it's called nowadays only supports RS256, so I had to write my own OIDC middleware. At least they stopped generating UUIDv4 secrets. Hydra is too complex. Dex is too simple. Identity Server lacks…

> Zitadel, heard but not tried yet. The keycloak vs zitadel page doesn't help. Is the Zitadel access token also jwt like in keycloak and included role membership?

By default Zitadel uses opaque tokens but you can switch to JWT and use an piece of JS code (actions) to insert whatever claim you want into the tokens

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#123

Post by rescbr »

BodyCulture wrote: post #95
rescbr wrote: post #57

Earlier quoted context omitted.

I’ve found running Samba as a Domain Controller pretty straightforward for this exact use case.

As userdb for keycloak? Please write about it!

Haven't tried specifically with keycloak, but it should work. Keycloak advertises LDAP and MS Active Directory compatibility.

If I find the time, I can test and write up about this integration.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#124

Post by TrickardRixx »

bennyp101 wrote: post #92
TrickardRixx wrote: post #61

Earlier quoted context omitted.

I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.

I've found https://zitadel.com/ to be a light weight version of keycloak. Lots of options that are useful, and pretty good UI for setting things up

Thanks for the recommendation. At a 30 second glance this looks the most promising so far!

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#125

Post by apitman »

ffo wrote: post #121
apitman wrote: post #117

Earlier quoted context omitted.

> I think both products could even coexist Fair enough, but developers and sysadmins don't want to choose between two great options. They want one obvious best option and a second option that is good enough and can be made better if option one turns evil.

Sure, there needs to be a „de facto“ OSS player in the space. Let me tell you that is what we definitely aspire to become. I always think there was not yet the „gitlab“ effect in the identity space.

Gitlab is a great example of what I'm saying. Few use it today but that's probably where we would all go. You know, because we never actually learn the lessons of centralization.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#126

Post by eriksjolund »

apitman wrote: post #119
throwaway67743 wrote: post #109

Earlier quoted context omitted.

Podman makes this better, as it doesn't trash my ipt/nft rules in the process, and its essentially stateless amongst other useful things

How's the network performance on podman? It defaults to slirp4netns right?

Rootless Podman uses slirp4netns by default. The default will soon change to pasta. Pasta has better performance than slirp4netns. For best performance if your container supports it, use systemd socket activation because the traffic over the activated socket will have native network performance.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#127

Post by apitman »

eriksjolund wrote: post #126
apitman wrote: post #119

Earlier quoted context omitted.

How's the network performance on podman? It defaults to slirp4netns right?

Rootless Podman uses slirp4netns by default. The default will soon change to pasta. Pasta has better performance than slirp4netns. For best performance if your container supports it, use systemd socket activation because the traffic over the activated socket will have native network performance.

I'd never heard of that systemd trick. Interesting, thanks.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#128

Post by jupp0r »

Phrodo_00 wrote: post #54
KRAKRISMOTT wrote: post #50

Earlier quoted context omitted.

If you believe email to be the weakest link in the chain, then you have to get rid of email password resets too and use reset codes instead. Lose your codes, lose your account.

You could let users use end to end encrypted protocols for it (like signal, telegram or supposedly whatsapp)

Even SMS would be vastly more secure, as sim swap or SS7 attacks are costly.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#129

Post by eriksjolund »

apitman wrote: post #127
eriksjolund wrote: post #126

Earlier quoted context omitted.

Rootless Podman uses slirp4netns by default. The default will soon change to pasta. Pasta has better performance than slirp4netns. For best performance if your container supports it, use systemd socket activation because the traffic over the activated socket will have native network performance.

I'd never heard of that systemd trick. Interesting, thanks.

Here are some documentation and demos from me and others if you're interested:

https://github.com/eriksjolund/podman-networking-docs https://github.com/eriksjolund/podman-nginx-socket-activatio... https://github.com/eriksjolund/socket-activate-httpd https://github.com/eriksjolund/mariadb-podman-socket-activat... https://github.com/PhracturedBlue/podman-socket-activated-se...

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#130

Post by hatf0 »

apitman wrote: post #72
hatf0 wrote: post #63

Earlier quoted context omitted.

The comparison with simply just Hydra is rather unfair too as the strength with Ory products is when they work in tandem (e.g. oathkeeper & hydra). Hydra is as barebones as you can get for a OAuth2 provider - that’s all it does & is meant to do. Stack it with Oathkeeper and you have a dynamic way of enforcing endpoint authentication that can entirely be managed using Kubernetes custom resources. Nothing I’ve found co…

The Ory stack looks to be very high quality for sure. But so far in this thread there's been mentioned Hydra, Kratos, and Oathkeeper in order to run an OIDC server. You say Hydra is as barebones as you can get, but by itself it has 58 direct dependencies. I'm sorry, it just seems to be targeted at a completely different demographic.

When has the number of dependencies ever directly correlated with the feature set of an application? Have you ever looked at a node_modules folder? More over, how is that relevant in any way? This argument against dependencies has always felt like weird NIH-ism spawned out of the same crowd who still thinks that C is a good programming language. Have fun reinventing the wheel, but I’ll take my dependencies to go.

Additionally, you’re conflating an OIDC server with a full IdP, which Hydra explicitly is not. I don’t need a full identity provider with support for user profile pictures and a pretty UI if all I’m doing is controlling access to API endpoints via OAuth2 client credentials. I already have an identity provider, and I’m not foolish enough to think that I should host one myself.

You’re completely correct in that you are not the intended demographic if you don’t understand the utility of the Ory stack, and that’s okay.

Post reply on HN