Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak SSO with Docker Compose and Nginx

du.nkel.dev

Post reply on HN
Print view View original

31–40 of 111 posts

Re: Keycloak SSO with Docker Compose and Nginx

#31

Post by ffsm8 »

bvrmn wrote: post #28
ffsm8 wrote: post #17

Earlier quoted context omitted.

> I [...] went with Authelia Great choice! > keycloak [...]'s a behemoth Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables. It starts within Idk, calling that a behemoth is kinda a stretch at that point...? The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it ..…

It would be great to know how you start Keycloak. In our CI it takes 40s-1m to start and consumes 500Mb. We use default docker image.

  > 2024-02-11 17:15:35,764 INFO  [io.quarkus] (Shutdown thread) Keycloak stopped in 0.064s
  > 2024-02-11 17:15:37,754 INFO  [org.keycloak.common.Profile] (main) Preview feature enabled: token_exchange
   ...
  > 2024-02-11 17:15:44,694 INFO  [org.infinispan.CLUSTER] (jgroups-8,a4c127cdee40-48683) ISPN100000: Node 72d48695e84c-46513 joined the cluster
so 7 seconds altogether on that restart, though a lot of that time is spend waiting for other nodes before it bootstraps the cluster. (its single node as its a toy server, as i said before)

this is the dockerfile: https://pastebin.com/rVdXjUkP

which is basically just the officially documented way to make the image, albeit set to use a reverse proxy for https

https://www.keycloak.org/server/containers

your CI pipeline probably downloads the runtime dependencies each time from the internet, as building this image does indeed take around ~40s.

the resulting image is ~620MB.

As I said earlier, making this image has become basically mandatory with their switch to Quarkus. You should really address that ;)

Re: Keycloak SSO with Docker Compose and Nginx

#32

Post by Helmut10001 »

tzahifadida wrote: post #29

I am using keycloak for quite a while. The main problem I have with it is that you can't get a link to reset a password, you have to issue an api that does it for you. In fact that is how most of the product goes. It is very opinionated. Making it a cluster is also not easy, though I did it and it works ok. Another issue is that the realms has a limit. Though you can spin up an instance every 200 realms but it is not…

Is this really true? Reading [1] they say:

> Forgot Password: If you enable it, users are able to reset their credentials if they forget their password or lose their OTP generator. Go to the Realm Settings left menu item, and click on the Login tab. Switch on the Forgot Password switch.

[1]: https://wjw465150.gitbooks.io/keycloak-documentation/content...

Re: Keycloak SSO with Docker Compose and Nginx

#33

Post by reactordev »

The issue with Keycloak is that it’s been around a while and has gone through a ton of changes. While it started as a JBOSS project, its usefulness as an IdP shines in on-prem cluster auth. However, that’s where I would stop. I implemented Keycloak at scale on AWS ECS for a Fortune 500 department and it was unholy war for 1,000 years getting it to cluster properly. DNS discovery didn’t work right. Cluster discovery was over UDP (which didn’t work in our cloud environments). Stateful login on one server was missing from the others so dumb load balancing was off the table - sticky sessions was the only way. While it’s easy to docker run Keycloak and plug it in like Auth0, it’s like buying a 1996 Ford F-150 with 250,000 miles. It runs. It works. But Jesus is it a maintenance madonna.

Re: Keycloak SSO with Docker Compose and Nginx

#34

Post by reactordev »

reactordev wrote: post #33

The issue with Keycloak is that it’s been around a while and has gone through a ton of changes. While it started as a JBOSS project, its usefulness as an IdP shines in on-prem cluster auth. However, that’s where I would stop. I implemented Keycloak at scale on AWS ECS for a Fortune 500 department and it was unholy war for 1,000 years getting it to cluster properly. DNS discovery didn’t work right. Cluster discovery w…

OAuth with OpenID Connect and being able to add apps and clients to a realm was its saving grace and the only reason we kept it around.

Re: Keycloak SSO with Docker Compose and Nginx

#35

Post by silverquiet »

reactordev wrote: post #33

The issue with Keycloak is that it’s been around a while and has gone through a ton of changes. While it started as a JBOSS project, its usefulness as an IdP shines in on-prem cluster auth. However, that’s where I would stop. I implemented Keycloak at scale on AWS ECS for a Fortune 500 department and it was unholy war for 1,000 years getting it to cluster properly. DNS discovery didn’t work right. Cluster discovery w…

I did it at quite small scale, but within an on-prem docker swarm. It was indeed a pain because if I remember correctly the default discovery uses multicast which is not enabled on typical cloud networks or on a Swarm/Kubernetes overlay network. I looked at database pings where they'd use your RDMS for a sort of quorum mechanism, but that seemed very brittle and I got the impression it was more of a last-resort type thing.

I was able to use the kubernetes cluster driver which uses the Swarm cluster's DNS for node discovery. It was indeed quite a pain to get working, but since then has been solid as far as I know. I believe there is also a native ec2 networking driver these days, but that is not something that I explored.

Re: Keycloak SSO with Docker Compose and Nginx

#36

Post by theK »

raziel2p wrote: post #22
ffsm8 wrote: post #17

Earlier quoted context omitted.

> I [...] went with Authelia Great choice! > keycloak [...]'s a behemoth Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables. It starts within Idk, calling that a behemoth is kinda a stretch at that point...? The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it ..…

have you looked at the codebase? it's been a while but I was implementing Keycloak a few years ago and it was shocking how big the codebase is and how difficult it is to change things to add what felt like basic functionality. making plugins didn't seem like a viable option either. oh not to mention the statefulnes of it, it was almost impossible to destroy and re create an instance from scratch without a bunch of ma…

Had a similar experience and even filed a couple of bugs back then. I don't know the current state but back then it felt like having something that looked like halfway modern Java but still carried around large amounts of old school JEE cruft. Probably was the migration to quarkus though. So it probably got better?

Re: Keycloak SSO with Docker Compose and Nginx

#37

Post by bird_person_ »

reactordev wrote: post #33

The issue with Keycloak is that it’s been around a while and has gone through a ton of changes. While it started as a JBOSS project, its usefulness as an IdP shines in on-prem cluster auth. However, that’s where I would stop. I implemented Keycloak at scale on AWS ECS for a Fortune 500 department and it was unholy war for 1,000 years getting it to cluster properly. DNS discovery didn’t work right. Cluster discovery w…

> Cluster discovery was over UDP (which didn’t work in our cloud environments)

Ouch, we are only allowed UDP for DNS.

Re: Keycloak SSO with Docker Compose and Nginx

#39

Post by mooreds »

c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

Disclosure: I work for FusionAuth.

If you are looking for SSO + easy configuration + an admin UI (which admittedly has a mid 2000s UX look and feel), you should check out FusionAuth. It's free to download and run yourself[0], docker friendly[1], has a variety of configuration choices[2] (including terraform[3] to manage your OIDC/other settings).

Worth noting that it is free to use, but not open source[4].

0: https://fusionauth.io/download

1: https://fusionauth.io/docs/get-started/download-and-install/...

2: https://fusionauth.io/docs/operate/deploy/configuration-mana...

3: https://fusionauth.io/docs/operate/deploy/terraform

4: https://fusionauth.io/license-faq#28

Re: Keycloak SSO with Docker Compose and Nginx

#40

Post by mooreds »

reactordev wrote: post #33

The issue with Keycloak is that it’s been around a while and has gone through a ton of changes. While it started as a JBOSS project, its usefulness as an IdP shines in on-prem cluster auth. However, that’s where I would stop. I implemented Keycloak at scale on AWS ECS for a Fortune 500 department and it was unholy war for 1,000 years getting it to cluster properly. DNS discovery didn’t work right. Cluster discovery w…

I've heard there have been improvements since it fully moved to quarkus. When did you do that deployment to ECS?
Post reply on HN