Keycloak SSO with Docker Compose and Nginx
du.nkel.dev
Keycloak SSO with Docker Compose and Nginx
1–10 of 111 posts
Re: Keycloak SSO with Docker Compose and Nginx
#2Keycloak is great but can be quite confusing for starters. It has a lot of features and not the best documentation. I recently tried Zitadel and found it much easier to use. It's a bit harder to self-host though because it can't run on an embedded database.
Re: Keycloak SSO with Docker Compose and Nginx
#3I did something similar, though picked Apache with mod_auth_openidc, which is a certified Relying Party implementation: https://github.com/OpenIDC/mod_auth_openidc
In other words, I can protect arbitrary applications through my reverse proxy and require either certain claims/roles, or simplify auth to the point where my downstream app/API will just receive a bunch of headers like OIDC_CLAIM_sub, OIDC_CLAIM_name, OIDC_CLAIM_email through the internal network, not making me bother with configuring OIDC libraries for all of my APIs and configure them in each stack that I might use, but rather contain all of that complexity in the reverse proxy. Handling headers in pretty much every stack is trivial, be it something with .NET, Java, Node, Python and so on...
Basically:
user Apache (with mod_auth_openidc) API (with OIDC_ headers, if logged in and authorized)
OR Keycloak (for logging in/registration, followed by redirect)
Now, right now I'm moving away from storing groups in the Keycloak DB because it's actually easier to do that in the app DB and only allow Keycloak to reason about who users are, not what they can do (since interacting with Keycloak's API to manage users is cumbersome), especially when I want custom permissions: like users being assigned to companies, but also having specific permissions for each of those companies, your typical granular system.
Personally, I'd definitely say that OIDC feels overcomplicated to work with, so I'm glad that I discovered something like this. There's a whole list of other Relying Party implementations, but nobody really seems to be talking about them: https://openid.net/developers/certified-openid-connect-imple...
Also, in regards to Keycloak in particular, most likely you really want to build the "optimized" image, because otherwise the startup times will be annoyingly long: https://www.keycloak.org/server/containers (like the article already points out, but that was a pain point until I got it over with)
Oh, and Keycloak is known to be a bit odd in how it sometimes works behind a reverse proxy, I actually needed to put this in the configuration because otherwise connections would sometimes break:
SetEnv proxy-initial-not-pooled 1
SetEnv proxy-nokeepalive 1Re: Keycloak SSO with Docker Compose and Nginx
#4Love keycloak. What I would do differently though is run it on a host (or in a k8s pod) & have it serving via http to localhost, then use cloudflared to tunnel & present it as https. Saves messing around with certificates etc, it's all automatic.
Re: Keycloak SSO with Docker Compose and Nginx
#5Love keycloak. What I would do differently though is run it on a host (or in a k8s pod) & have it serving via http to localhost, then use cloudflared to tunnel & present it as https. Saves messing around with certificates etc, it's all automatic.
My go to is always this instead:
https://github.com/lucaslorentz/caddy-docker-proxy
Single label to a docker container and with correct DNS you’ll have an automatically managed certificate right away.
Re: Keycloak SSO with Docker Compose and Nginx
#6If nothing else, that posts mention of https://www.keycloakify.dev/ is very handy - looks like a great alternative to the standard approach!
Re: Keycloak SSO with Docker Compose and Nginx
#7Love keycloak. What I would do differently though is run it on a host (or in a k8s pod) & have it serving via http to localhost, then use cloudflared to tunnel & present it as https. Saves messing around with certificates etc, it's all automatic.
My go to is always this instead: https://github.com/lucaslorentz/caddy-docker-proxy Single label to a docker container and with correct DNS you’ll have an automatically managed certificate right away.
I had this discussion before and thought long about using Caddy, but then decided for nginx, directly on the host, basically following this reasoning [1].
My main motivation is that there is just more information available for nginx due to its wider use. And when you need to customize Caddy due to different requirements by services, you end up with the same or worse complexity compared to an nginx .conf. Nginx is just very robust and the configuration is not so hard to get used to.
[1]: https://nickjanetakis.com/blog/why-i-prefer-running-nginx-on...
Re: Keycloak SSO with Docker Compose and Nginx
#8Earlier quoted context omitted.
My go to is always this instead: https://github.com/lucaslorentz/caddy-docker-proxy Single label to a docker container and with correct DNS you’ll have an automatically managed certificate right away.
I had this discussion before and thought long about using Caddy, but then decided for nginx, directly on the host, basically following this reasoning [1]. My main motivation is that there is just more information available for nginx due to its wider use. And when you need to customize Caddy due to different requirements by services, you end up with the same or worse complexity compared to an nginx .conf. Nginx is jus…
Very reasonable!
My go-to for anything more complicated is definitely NGINX, but for ease of use in a very straightforward docker containers running HTTP services, it’s hard to beat the ease of use of the modified version of Caddy I linked
Re: Keycloak SSO with Docker Compose and Nginx
#9I've been eyeing authentik[1] and authelia[2].
Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started.
Re: Keycloak SSO with Docker Compose and Nginx
#10I recently went down this road for my home lab and went with Authelia
Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth.
Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you're just looking to add auth to some services, and SSO to those that can work with it, I'd suggest starting with Authelia.