Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak SSO with Docker Compose and Nginx

du.nkel.dev

Post reply on HN
Print view View original

81–90 of 111 posts

Re: Keycloak SSO with Docker Compose and Nginx

#81

Post by mooreds »

mooreds wrote: post #80
apitman wrote: post #77

Earlier quoted context omitted.

Thanks for the detailed answer. If people are already taking advantage of your free offering, how would it be different if you released the source? If you're worried about another company piggybacking off your work to start a competitor, why not use one of these newfangled non-compete licenses? That still gives users the security of being able to for the project internally if you go under.

The free version of FusionAuth has limits beyond what other licenses have. See https://fusionauth.io/license-faq#3 for more details. I'm afraid that's all the detail I have about the decision to keep FusionAuth closed source.

Sorry, on re-read, this sounds kinda abrupt. My bad.

I think at the end this is a business decision. The executive team has considered options and decided that closed source is the right path for the company.

Re: Keycloak SSO with Docker Compose and Nginx

#82

Post by c0wb0yc0d3r »

BeryJu wrote: post #55
c0wb0yc0d3r wrote: post #14

Earlier quoted context omitted.

For anyone, considering authentik, I want to warn you by saying "here be dragons." To start, I have protected 10+ services at any given time. Both in docker and k8s. Unless you enjoy configuring protection for each service independently, you'll have a bad time in authentik. Authentik suffers from a debilitating bug[0] where when using a single config to protect all services on subdomains (i.e. app1.example.com, app2.…

Hey, authentik CTO here! We’ll be addressing the bug in the release after the next one (march-April)

Good to hear, I think it'll make many users happy. For me, I've migrated back to Authelia. I moved to authentik because at the time Authelia had no user management. After all of authentik's sharp edges, I've found lldap[0], and was able to implement a pilot in a few hours. I haven't looked back, since everything was converted.

[0]: https://github.com/lldap/lldap

Re: Keycloak SSO with Docker Compose and Nginx

#83

Post by ensignavenger »

mooreds wrote: post #74
apitman wrote: post #64

Earlier quoted context omitted.

Genuinely curious, how do you plan to compete with Ory and Zitadel in this space without being open source?

Great question. Appreciate the interest. I can only speak from my perspective as an employee, not the whole company. It is something I've thought about. I will also ask the CEO/founder or other leaders to weigh in. Many devs care about open source when they are evaluating a solution, but many really want "free as in beer". They want to try a product without getting out the credit card or engaging with sales. We cater…

>> It embeds in your system, even if you stick to a standard like OIDC, and is difficult to switch from, especially at scale.

This is precisely why a real, Open Source solution should be a top priority feature for anyone evaluating software like this. We have seen closed source solutions, time and time again, "realign" their business by dropping features, or even entire, free plans. In some cases, closed source software has been removed from the market all together when the company gets bought out. Changes in pricing plans leads to a worse fit for customers... etc. At least when Hashicorp and Elastic abandoned Open Source, the community had the option to say "yeah, good luck, thanks for the good times, but no thanks on your new direction" and fork the product to continue maintaining it. When a closed source products owners decide to "shift gears" on the product line up, customers are left between a rock and a hard place. Maybe if there were no Open Source options, but fortunately, there are several in the auth space.

Re: Keycloak SSO with Docker Compose and Nginx

#84

Post by c-hendricks »

mmcnl wrote: post #63
c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, wh…

> My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns.

I'm a bit concerned about that too. When setting it up, I found a lot of their docs on github mentioned they have `template` and `expand-env` "configuration filters", then it took me entirely too long to realize that while the 4.38 pre-release notes, posted in January 2023, say it's "just around the corner", it's still being worked on.

Having said that, there still seems to be somewhat active development. It may just be one person at this point.

https://hub.docker.com/layers/authelia/authelia/v4.38.0-beta...

https://github.com/authelia/authelia/commits/v4.38.0-beta3/

Re: Keycloak SSO with Docker Compose and Nginx

#85

Post by ciceryadam »

enasterosophes wrote: post #72
ciceryadam wrote: post #70

Earlier quoted context omitted.

Newest arch package is just over 4 months old - Last Updated: 2023-10-09 03:25 (UTC): https://aur.archlinux.org/packages/authelia

That's not a new release of authelia. Authelia's releases are at https://github.com/authelia/authelia/releases The updates to the AUR package were not about new releases since 2022: aur/authelia $ git log ad4e6ca^..HEAD 2c5029d (2023-10-09) Amir Zarrinkafsh ECDB8EF9E77E4EBF (HEAD -> authelia, origin/authelia) Fix frozek lockfile issue with pnpm 246d77c (2023-01-22) Amir Zarrinkafsh ECDB8EF9E77E4EBF Utilise pnpm inste…

I stand corrected, thanks!

Re: Keycloak SSO with Docker Compose and Nginx

#86

Post by bjconlan »

seanieb wrote: post #38

The idea that Keycloak solves security issues makes me giggle. It's CVE's should shed some light on what I mean. - https://www.cvedetails.com/vulnerability-list/vendor_id-25/p...

It's a double edged sword. A closed source non-transparent solution without a reported cve is also laughable as "secure".

Also the most recent release 22.0.2 only has 3 (known) vulnerabilities. https://www.cvedetails.com/vulnerability-list/vendor_id-25/p...

Re: Keycloak SSO with Docker Compose and Nginx

#87

Post by eYrKEC2 »

durable_queue wrote: post #23

A problem I've had trying to do this for local dev is that the DNS name of the Keycloak server is "keycloak" inside of the Docker network, but "localhost" from the the outside. The user's browser will be redirected to localhost (since it's outside of the Docker network) but then there is a mismatch between hosts (it expects "keycloak" not "localhost") when it comes to an API server verifying the token. Anyone figured…

You need to configure the "client" in keyclock that corresponds with you front-end.

Re: Keycloak SSO with Docker Compose and Nginx

#88

Post by epylar »

bjconlan wrote: post #86
seanieb wrote: post #38

The idea that Keycloak solves security issues makes me giggle. It's CVE's should shed some light on what I mean. - https://www.cvedetails.com/vulnerability-list/vendor_id-25/p...

It's a double edged sword. A closed source non-transparent solution without a reported cve is also laughable as "secure". Also the most recent release 22.0.2 only has 3 (known) vulnerabilities. https://www.cvedetails.com/vulnerability-list/vendor_id-25/p...

most recent release is 23.0.6

Re: Keycloak SSO with Docker Compose and Nginx

#89

Post by rendaw »

c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

Tangential, but are there any alternatives to LDAP today? I googled around and found nothing. Simpler schema, JSON, http, etc. I can't believe nobody has attempted to recreate it when people have for basically everything else. AFAICT the only real other standard is Active Directory.

And secondly, is there a standard or protocol for offloading access control? I see Authelia allows you to contol access by url patterns, but I'd expect e.g. a fileserver to instead reach out to the LDAP server and check permissions based on the authenticated user id and keys in the database. This seems like the opposite of oauth2 which is for a server getting access itself to a 3rd party service.

Re: Keycloak SSO with Docker Compose and Nginx

#90

Post by jallbrit »

natrys wrote: post #53
c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

I also went down this road recently. Personally I had gone with caddy-security[1] which is simply a plugin for Caddy. [1] https://github.com/greenpau/caddy-security

I also went down this road recently, and discovered caddy-security, but I have security concerns [0]. Software always has vulnerabilities, but this was enough to scare me off. Something like keycloak or authentia seems more tested and secure.

[0] https://blog.trailofbits.com/2023/09/18/security-flaws-in-an...

Post reply on HN