Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak SSO with Docker Compose and Nginx

du.nkel.dev

Post reply on HN
Print view View original

61–70 of 111 posts

Re: Keycloak SSO with Docker Compose and Nginx

#61

Post by mffap »

NeckBeardPrince wrote: post #50
mooreds wrote: post #39

Earlier quoted context omitted.

Disclosure: I work for FusionAuth. If you are looking for SSO + easy configuration + an admin UI (which admittedly has a mid 2000s UX look and feel), you should check out FusionAuth. It's free to download and run yourself[0], docker friendly[1], has a variety of configuration choices[2] (including terraform[3] to manage your OIDC/other settings). Worth noting that it is free to use, but not open source[4]. 0: https:/…

So if you self-host you still have to pay to have 2FA?

If you look for 2FA with otp, email, sms and also passkeys foe self-hosting, then give zitadel a spin. All features are included in the open source version. Should also work nicely with docker compose + nginx. In case you have issues, join the chat. https://github.com/zitadel/zitadel

Re: Keycloak SSO with Docker Compose and Nginx

#62

Post by mffap »

andix wrote: post #2

Keycloak is great but can be quite confusing for starters. It has a lot of features and not the best documentation. I recently tried Zitadel and found it much easier to use. It's a bit harder to self-host though because it can't run on an embedded database.

That's true it requires its own db. Way forward will be postgres as db, which makes it hopefully easier to deploy alongside other tools.

Re: Keycloak SSO with Docker Compose and Nginx

#63

Post by mmcnl »

c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns.

[0] https://github.com/lldap/lldap

[1] https://www.authelia.com/integration/proxies/caddy/

Re: Keycloak SSO with Docker Compose and Nginx

#64

Post by apitman »

mooreds wrote: post #39
c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

Disclosure: I work for FusionAuth. If you are looking for SSO + easy configuration + an admin UI (which admittedly has a mid 2000s UX look and feel), you should check out FusionAuth. It's free to download and run yourself[0], docker friendly[1], has a variety of configuration choices[2] (including terraform[3] to manage your OIDC/other settings). Worth noting that it is free to use, but not open source[4]. 0: https:/…

Genuinely curious, how do you plan to compete with Ory and Zitadel in this space without being open source?

Re: Keycloak SSO with Docker Compose and Nginx

#65

Post by mffap »

makkesk8 wrote: post #30

After working with Keycloak for a couple of years I honestly got fed up with all it's quirks and started to look at alternatives, Authentik and many more looked promising but Zitadel[1] caught my eye and I've never looked back since. [1] https://zitadel.com/blog/zitadel-vs-keycloak

Nice to hear. Glad you like it. What was the winning thing for you?

Re: Keycloak SSO with Docker Compose and Nginx

#66

Post by mmcnl »

mooreds wrote: post #39
c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

Disclosure: I work for FusionAuth. If you are looking for SSO + easy configuration + an admin UI (which admittedly has a mid 2000s UX look and feel), you should check out FusionAuth. It's free to download and run yourself[0], docker friendly[1], has a variety of configuration choices[2] (including terraform[3] to manage your OIDC/other settings). Worth noting that it is free to use, but not open source[4]. 0: https:/…

How do I integrate this with a reverse proxy like Caddy and their forward_auth directive? I want to secure my apps on the proxy layer, not the app layer.

Re: Keycloak SSO with Docker Compose and Nginx

#67

Post by BeryJu »

kodama-lens wrote: post #60
rjzzleep wrote: post #9

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started. [1] https://goauthentik.io/ [2] https://www.authelia.com/

Authentik has completely messed up their implementation of the oauth client credentials grant. It is not fixable without breaking changes and does not work with many tools using the cc grant. After seeing this they were completely off the table for me. https://github.com/goauthentik/authentik/issues/6139

authentik CTO here; we’ll fix this in the next release (match-april), it should be possible in a non backwards incompatible way using the suggestion in this comment https://github.com/goauthentik/authentik/issues/6139#issueco... (which does call that solution a hack but I wouldn’t necessarily agree)

Re: Keycloak SSO with Docker Compose and Nginx

#68

Post by apitman »

diurnalist wrote: post #58
raziel2p wrote: post #22

Earlier quoted context omitted.

have you looked at the codebase? it's been a while but I was implementing Keycloak a few years ago and it was shocking how big the codebase is and how difficult it is to change things to add what felt like basic functionality. making plugins didn't seem like a viable option either. oh not to mention the statefulnes of it, it was almost impossible to destroy and re create an instance from scratch without a bunch of ma…

Keycloak solves a complex problem. It is built on a plugin architecture, so plugins are certainly a viable option and this is documented in more detail here[0]. In general I have found the Keycloak docs thorough and well-written. When I operated Keycloak I built a few plugins to solve specific needs/assumptions we had around IdP when migrating to Keycloak from a bespoke solution. Re: your second point, the docs also…

> Keycloak solves a complex problem.

A lot of problems, actually, and most people don't have many of them. If you just want an OIDC server in front of your self-hosted apps you can solve that with a much simpler and faster tool.

Re: Keycloak SSO with Docker Compose and Nginx

#69

Post by apitman »

alex3305 wrote: post #11

Recently I looked into having a relatively simple SSO setup for my homelab. My main objective is that I could easily login with Google or GitHub auth. At my previous job I used both JetBrains Hub [1] and Keycloak but I found both of them a bit of a PITA to setup. JetBrains Hub was really, really easy to get going. As was my previous experience with them. The only thing that annoyed me was the lack of a latest tag on…

What features does oauth2-proxy provide that Dex is missing?

Re: Keycloak SSO with Docker Compose and Nginx

#70

Post by ciceryadam »

mmcnl wrote: post #63
c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, wh…

Newest arch package is just over 4 months old - Last Updated: 2023-10-09 03:25 (UTC): https://aur.archlinux.org/packages/authelia
Post reply on HN