Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak SSO with Docker Compose and Nginx

du.nkel.dev

Post reply on HN
Print view View original

11–20 of 111 posts

Re: Keycloak SSO with Docker Compose and Nginx

#11

Post by alex3305 »

Recently I looked into having a relatively simple SSO setup for my homelab. My main objective is that I could easily login with Google or GitHub auth. At my previous job I used both JetBrains Hub [1] and Keycloak but I found both of them a bit of a PITA to setup.

JetBrains Hub was really, really easy to get going. As was my previous experience with them. The only thing that annoyed me was the lack of a latest tag on their Docker registry. Don't get me wrong, pinned versions are great, but for my personal use I mostly just want to update all my Docker containers in one go.

On the other hand I found Keycloak very cumbersome to get going. It was pretty easy in dev mode, but I stumbled to get it going in production. AFAIK it had something to do with the wildcard Let's Encrypt cert that I tried to use. But after a couple of hours, I just gave up.

I finally went with Dex [2]. I had previously put it off because of the lack of documentation, but in the end it was extremely easy to setup. It just required some basic YAML, a SQLite database and a (sub)domain. I combined Dex with the excellent OAuth2 Proxy and a custom Nginx (Proxy Manager) template for an easy two line SSO configuration on all of my internal services. I also created an Dex Docker template for unRAID [4].

In addition to this setup, I also added Cloudflare Access and WAF outside of my home to add some security. I only want to add some CrowdSec to get a little more insights.

1. https://www.jetbrains.com/hub/

2. https://dexidp.io/

3. https://github.com/oauth2-proxy/oauth2-proxy

4. https://github.com/alex3305/unraid-docker-templates

Re: Keycloak SSO with Docker Compose and Nginx

#12

Post by raffraffraff »

My boss recently called Keycloak "the gift that keeps on giving", but he was actually commenting on how there's a new ticket in jira for figuring out how the f*?k to do something.

Having said that, I have terraform that creates an EKS cluster, deploys Keycloak , creates clients (SAML/OIDC), adds external identity providers, sets up an AWS IAM Identity Provider for it etc. That makes it extremely easy to use once you've figured out (a) what it can do, (b) how to do it in the ui, (c) how to get mrparkers Terraform provider to do it for you.

Re: Keycloak SSO with Docker Compose and Nginx

#13

Post by lakomen »

You don't need a bazillion keycloak instances, it has realms.

1 keycloak instance can have many realms.

I won't get into the nonsense of having a single database server per any instance (not limited to keycloak). Such a waste of resources.

You can have a system, postgres in this case, and make it listen on the docker iface, set it up to launch after and require docker.service.

The nginx conf was interesting and I'll adjust mine.

Re: Keycloak SSO with Docker Compose and Nginx

#14

Post by c0wb0yc0d3r »

rjzzleep wrote: post #9

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started. [1] https://goauthentik.io/ [2] https://www.authelia.com/

For anyone, considering authentik, I want to warn you by saying "here be dragons."

To start, I have protected 10+ services at any given time. Both in docker and k8s. Unless you enjoy configuring protection for each service independently, you'll have a bad time in authentik.

Authentik suffers from a debilitating bug[0] where when using a single config to protect all services on subdomains (i.e. app1.example.com, app2.example.com, etc.) your users will be randomly redirected to a different service when reauthenticating after the session expires.

[0]: https://github.com/goauthentik/authentik/issues/6886

Re: Keycloak SSO with Docker Compose and Nginx

#15

Post by risson »

rjzzleep wrote: post #9

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started. [1] https://goauthentik.io/ [2] https://www.authelia.com/

Authentik dev here, AMA

Re: Keycloak SSO with Docker Compose and Nginx

#17

Post by ffsm8 »

c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

> I [...] went with Authelia

Great choice!

> keycloak [...]'s a behemoth

Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables.

It starts within Idk, calling that a behemoth is kinda a stretch at that point...?

The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it .. but you're kinda forced to with how they've designed their docker image. Not an issue for enterprise as they're gonna be doing that anyway, but annoying for home servers

Re: Keycloak SSO with Docker Compose and Nginx

#18

Post by c-hendricks »

ffsm8 wrote: post #17
c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

> I [...] went with Authelia Great choice! > keycloak [...]'s a behemoth Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables. It starts within Idk, calling that a behemoth is kinda a stretch at that point...? The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it ..…

Behemoth may be a bit of a stretch, but the container is 20x the size of authelia, it's minimum recommendations are 512mb ram, and 1g of disk space. Compared to Authelia, which is using 30mb of ram and 500k disk space, yeah it's big.

Not to mention, only the admin user being configurable via environment variables isn't enough. With Authelia, I can share my homelab setup and with a couple of environment variable changes, people can have SSO integrated. There's no need to write guides or grab screenshots to help them get set up.

Re: Keycloak SSO with Docker Compose and Nginx

#19

Post by topspin »

lakomen wrote: post #13

You don't need a bazillion keycloak instances, it has realms. 1 keycloak instance can have many realms. I won't get into the nonsense of having a single database server per any instance (not limited to keycloak). Such a waste of resources. You can have a system, postgres in this case, and make it listen on the docker iface, set it up to launch after and require docker.service. The nginx conf was interesting and I'll…

Some additional things that someone might find useful:

Keycloak supports separating token endpoints (the OAUTH2/OIDC URLS used for tokens) and the built-in login challenge pages from Keycloak's admin console and the REST API. In other words, you can offer the token endpoints and login service to the public and isolate all the admin and backend stuff to a different hostname and/or URL scheme. Have a look at the KC_HOSTNAME_ADMIN[_URL] config option(s).

Keycloak has a capability called Authorization Services, an implementation of User Managed Access (UMA2). It's opt-in and probably 99% of Keycloak users don't know it exists. It can be used to implement fine-grained authorization schemes on top of OAUTH.

Post reply on HN