Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak SSO with Docker Compose and Nginx

du.nkel.dev

Post reply on HN
Print view View original

51–60 of 111 posts

Re: Keycloak SSO with Docker Compose and Nginx

#51

Post by durable_queue »

mooreds wrote: post #42
durable_queue wrote: post #23

A problem I've had trying to do this for local dev is that the DNS name of the Keycloak server is "keycloak" inside of the Docker network, but "localhost" from the the outside. The user's browser will be redirected to localhost (since it's outside of the Docker network) but then there is a mismatch between hosts (it expects "keycloak" not "localhost") when it comes to an API server verifying the token. Anyone figured…

I haven't tried this, but could you modify your /etc/hosts file (or analogous file on whatever operating system) to have `keycloak` as a valid hostname on your local computer? So that both within the docker container and in your host computer, `keycloak` was the hostname of the keycloak server?

Always an option, but I dislike changing global settings on the system. It makes it harder to hop between projects and it's slower when onboarding.

Re: Keycloak SSO with Docker Compose and Nginx

#52

Post by mooreds »

NeckBeardPrince wrote: post #50
mooreds wrote: post #39

Earlier quoted context omitted.

Disclosure: I work for FusionAuth. If you are looking for SSO + easy configuration + an admin UI (which admittedly has a mid 2000s UX look and feel), you should check out FusionAuth. It's free to download and run yourself[0], docker friendly[1], has a variety of configuration choices[2] (including terraform[3] to manage your OIDC/other settings). Worth noting that it is free to use, but not open source[4]. 0: https:/…

So if you self-host you still have to pay to have 2FA?

TOTP 2FA is free. SMS and email MFA are part of the paid plans.

From https://fusionauth.io/docs/lifecycle/authenticate-users/mult...

> However, the Authenticator/TOTP implementation is not a premium feature.

Re: Keycloak SSO with Docker Compose and Nginx

#53

Post by natrys »

c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

I also went down this road recently. Personally I had gone with caddy-security[1] which is simply a plugin for Caddy.

[1] https://github.com/greenpau/caddy-security

Re: Keycloak SSO with Docker Compose and Nginx

#54

Post by slenk »

rjzzleep wrote: post #9

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started. [1] https://goauthentik.io/ [2] https://www.authelia.com/

I am trying to make the same decision right now. Authentik looked better to me but that bug mentioned in another reply sounds bad

Re: Keycloak SSO with Docker Compose and Nginx

#55

Post by BeryJu »

c0wb0yc0d3r wrote: post #14
rjzzleep wrote: post #9

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started. [1] https://goauthentik.io/ [2] https://www.authelia.com/

For anyone, considering authentik, I want to warn you by saying "here be dragons." To start, I have protected 10+ services at any given time. Both in docker and k8s. Unless you enjoy configuring protection for each service independently, you'll have a bad time in authentik. Authentik suffers from a debilitating bug[0] where when using a single config to protect all services on subdomains (i.e. app1.example.com, app2.…

Hey, authentik CTO here!

We’ll be addressing the bug in the release after the next one (march-April)

Re: Keycloak SSO with Docker Compose and Nginx

#56

Post by BeryJu »

c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

Authelia has a very unique advantage of its small footprint, which is something that neither Keycloak nor authentik (which I work for as a disclaimer) can really fit into. It’s a very good usecase for a homelab environment and if you don’t need/want features of the “bigger” solutions!

Re: Keycloak SSO with Docker Compose and Nginx

#58

Post by diurnalist »

raziel2p wrote: post #22
ffsm8 wrote: post #17

Earlier quoted context omitted.

> I [...] went with Authelia Great choice! > keycloak [...]'s a behemoth Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables. It starts within Idk, calling that a behemoth is kinda a stretch at that point...? The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it ..…

have you looked at the codebase? it's been a while but I was implementing Keycloak a few years ago and it was shocking how big the codebase is and how difficult it is to change things to add what felt like basic functionality. making plugins didn't seem like a viable option either. oh not to mention the statefulnes of it, it was almost impossible to destroy and re create an instance from scratch without a bunch of ma…

Keycloak solves a complex problem.

It is built on a plugin architecture, so plugins are certainly a viable option and this is documented in more detail here[0]. In general I have found the Keycloak docs thorough and well-written. When I operated Keycloak I built a few plugins to solve specific needs/assumptions we had around IdP when migrating to Keycloak from a bespoke solution.

Re: your second point, the docs also describe this in detail[1]. Having the realm data exist in a simple form that can be exported/imported was very useful. However, I would have liked if they thought more about how to do live backup/restore; perhaps that is easier now than it was at the time.

[0]: https://www.keycloak.org/docs/latest/server_development/inde... [1]: https://www.keycloak.org/server/importExport#_importing_a_re...

Re: Keycloak SSO with Docker Compose and Nginx

#59

Post by edgurgel »

raziel2p wrote: post #22
ffsm8 wrote: post #17

Earlier quoted context omitted.

> I [...] went with Authelia Great choice! > keycloak [...]'s a behemoth Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables. It starts within Idk, calling that a behemoth is kinda a stretch at that point...? The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it ..…

have you looked at the codebase? it's been a while but I was implementing Keycloak a few years ago and it was shocking how big the codebase is and how difficult it is to change things to add what felt like basic functionality. making plugins didn't seem like a viable option either. oh not to mention the statefulnes of it, it was almost impossible to destroy and re create an instance from scratch without a bunch of ma…

Interesting... I had the exact opposite impression. The codebase is big but very easy to understand and their SPIs[1] enable to customise Keycloak's behaviour quite easily.

For the statefulness using terraform[2] solves the problem for me.

[1] - https://www.keycloak.org/docs/latest/server_development/#_pr... [2] - https://github.com/mrparkers/terraform-provider-keycloak

Re: Keycloak SSO with Docker Compose and Nginx

#60

Post by kodama-lens »

rjzzleep wrote: post #9

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started. [1] https://goauthentik.io/ [2] https://www.authelia.com/

Authentik has completely messed up their implementation of the oauth client credentials grant. It is not fixable without breaking changes and does not work with many tools using the cc grant.

After seeing this they were completely off the table for me.

https://github.com/goauthentik/authentik/issues/6139

Post reply on HN