41–50 of 111 posts
If nothing else, that posts mention of https://www.keycloakify.dev/ is very handy - looks like a great alternative to the standard approach!
A problem I've had trying to do this for local dev is that the DNS name of the Keycloak server is "keycloak" inside of the Docker network, but "localhost" from the the outside. The user's browser will be redirected to localhost (since it's outside of the Docker network) but then there is a mismatch between hosts (it expects "keycloak" not "localhost") when it comes to an API server verifying the token. Anyone figured…
I am using keycloak for quite a while. The main problem I have with it is that you can't get a link to reset a password, you have to issue an api that does it for you. In fact that is how most of the product goes. It is very opinionated. Making it a cluster is also not easy, though I did it and it works ok. Another issue is that the realms has a limit. Though you can spin up an instance every 200 realms but it is not…
Is this really true? Reading [1] they say: > Forgot Password: If you enable it, users are able to reset their credentials if they forget their password or lose their OTP generator. Go to the Realm Settings left menu item, and click on the Login tab. Switch on the Forgot Password switch. [1]: https://wjw465150.gitbooks.io/keycloak-documentation/content...
I did something similar, though picked Apache with mod_auth_openidc, which is a certified Relying Party implementation: https://github.com/OpenIDC/mod_auth_openidc In other words, I can protect arbitrary applications through my reverse proxy and require either certain claims/roles, or simplify auth to the point where my downstream app/API will just receive a bunch of headers like OIDC_CLAIM_sub, OIDC_CLAIM_name, OIDC…
Have you thought about extracting your authorization to a separate server? It might be overkill if you only have one application, but I've seen demos/had conversations with the folks at cerbos and permit, which both offer open source authorization as a service. That way your user authentication is done by Keycloak, your authorization is done by cerbos/permit/etc, and your application only is responsible for application data/functionality.
You don't need a bazillion keycloak instances, it has realms. 1 keycloak instance can have many realms. I won't get into the nonsense of having a single database server per any instance (not limited to keycloak). Such a waste of resources. You can have a system, postgres in this case, and make it listen on the docker iface, set it up to launch after and require docker.service. The nginx conf was interesting and I'll…
For people not familiar with keycloak, keycloak realms are equivalent to what other auth providers call tenants (Auth0, FusionAuth [which I work for]) or user pools (Cognito). Basically a segmented set of users and configuration related to those users.
The issue with Keycloak is that it’s been around a while and has gone through a ton of changes. While it started as a JBOSS project, its usefulness as an IdP shines in on-prem cluster auth. However, that’s where I would stop. I implemented Keycloak at scale on AWS ECS for a Fortune 500 department and it was unholy war for 1,000 years getting it to cluster properly. DNS discovery didn’t work right. Cluster discovery w…
I've heard there have been improvements since it fully moved to quarkus. When did you do that deployment to ECS?
If nothing else, that posts mention of https://www.keycloakify.dev/ is very handy - looks like a great alternative to the standard approach!
Currently it officially supports only apps made with create-react-app, but there is a vite branch in development and personally we use it with vite since a while.
I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…
Disclosure: I work for FusionAuth. If you are looking for SSO + easy configuration + an admin UI (which admittedly has a mid 2000s UX look and feel), you should check out FusionAuth. It's free to download and run yourself[0], docker friendly[1], has a variety of configuration choices[2] (including terraform[3] to manage your OIDC/other settings). Worth noting that it is free to use, but not open source[4]. 0: https:/…