Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak SSO with Docker Compose and Nginx

du.nkel.dev

Post reply on HN
Print view View original

91–100 of 111 posts

Re: Keycloak SSO with Docker Compose and Nginx

#91

Post by apitman »

ensignavenger wrote: post #83
mooreds wrote: post #74

Earlier quoted context omitted.

Great question. Appreciate the interest. I can only speak from my perspective as an employee, not the whole company. It is something I've thought about. I will also ask the CEO/founder or other leaders to weigh in. Many devs care about open source when they are evaluating a solution, but many really want "free as in beer". They want to try a product without getting out the credit card or engaging with sales. We cater…

>> It embeds in your system, even if you stick to a standard like OIDC, and is difficult to switch from, especially at scale. This is precisely why a real, Open Source solution should be a top priority feature for anyone evaluating software like this. We have seen closed source solutions, time and time again, "realign" their business by dropping features, or even entire, free plans. In some cases, closed source softw…

I've been thinking lately how important it is that software be not only open source, but simple enough to be forkable. The fact that Keycloak is open source almost seems irrelevant given how massive the codebase is.

Browsers represent an extreme case.

Re: Keycloak SSO with Docker Compose and Nginx

#92

Post by mnming »

alex3305 wrote: post #11

Recently I looked into having a relatively simple SSO setup for my homelab. My main objective is that I could easily login with Google or GitHub auth. At my previous job I used both JetBrains Hub [1] and Keycloak but I found both of them a bit of a PITA to setup. JetBrains Hub was really, really easy to get going. As was my previous experience with them. The only thing that annoyed me was the lack of a latest tag on…

I use obligator with ephemeral storage, no db, 100% code driven setup.

In my opinion this is the simplist option.

https://github.com/lastlogin-io/obligator

Re: Keycloak SSO with Docker Compose and Nginx

#93

Post by turtles3 »

Klathmon wrote: post #25
lakomen wrote: post #13

You don't need a bazillion keycloak instances, it has realms. 1 keycloak instance can have many realms. I won't get into the nonsense of having a single database server per any instance (not limited to keycloak). Such a waste of resources. You can have a system, postgres in this case, and make it listen on the docker iface, set it up to launch after and require docker.service. The nginx conf was interesting and I'll…

I've found that the realms in keycloak doesn't scale quite as well as we would have wanted. There is some kind of slowdown, and after around 200 realms things start breaking and startup time starts growing uncontrollably. There's a good chance it's an issue in our setup (which is fairly complex), but every time we look at it we trace the slowdown back into keycloak itself

Just letting you know it's not you - this is a well known long standing issue with keycloak. Typically users see a significant performance cliff at around 300-400 realms. While one realm is not necessarily the same as one tenant in keycloak, it does make it a significantly larger headache to support multi tenant with SSO integrations in a single realm.

I'm afraid I can't give you more details than that, we just moved on from keycloak at that point.

Re: Keycloak SSO with Docker Compose and Nginx

#94

Post by alex3305 »

mnming wrote: post #92
alex3305 wrote: post #11

Recently I looked into having a relatively simple SSO setup for my homelab. My main objective is that I could easily login with Google or GitHub auth. At my previous job I used both JetBrains Hub [1] and Keycloak but I found both of them a bit of a PITA to setup. JetBrains Hub was really, really easy to get going. As was my previous experience with them. The only thing that annoyed me was the lack of a latest tag on…

I use obligator with ephemeral storage, no db, 100% code driven setup. In my opinion this is the simplist option. https://github.com/lastlogin-io/obligator

Great addition. I remember that I also looked at Obligator and saved it to my bookmarks. But I decided against it because IMHO the project was just a bit too young. Normally I tend to ignore that, but I really didn't want to switch auth/SSO solutions in a couple of months time because of a lack of maintenance or something like that.

Re: Keycloak SSO with Docker Compose and Nginx

#95

Post by alex3305 »

apitman wrote: post #78
alex3305 wrote: post #75

Earlier quoted context omitted.

Dex only acts as a federated identity provider. Unlike oauth2-proxy which acts as a service provider for services that don't have authentication themselves.

Ah so no forward auth?

AFAIK no. Dex only seem to act as a federated IdP.

Re: Keycloak SSO with Docker Compose and Nginx

#96

Post by davidgf »

raffraffraff wrote: post #12

My boss recently called Keycloak "the gift that keeps on giving", but he was actually commenting on how there's a new ticket in jira for figuring out how the f*?k to do something. Having said that, I have terraform that creates an EKS cluster, deploys Keycloak , creates clients (SAML/OIDC), adds external identity providers, sets up an AWS IAM Identity Provider for it etc. That makes it extremely easy to use once you'…

By any chance, is that Terraform open sourced somewhere? It's for a friend :)

Re: Keycloak SSO with Docker Compose and Nginx

#97

Post by james_d_elliott »

mmcnl wrote: post #63
c-hendricks wrote: post #10

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, wh…

Hey one of the Authelia developers here. We're very actively working on a very large release (it's just going through the peer review process and it should be good to go) and we currently have a pre-release for users to dive into.

I can understand the security concerns but we are regularly taking measures to ensure no zero-day vulnerabilities exist, there are no known vulnerabilities with Authelia at the present time either directly or via the code-paths of dependencies we actually use.

Re: Keycloak SSO with Docker Compose and Nginx

#98

Post by james_d_elliott »

c-hendricks wrote: post #84
mmcnl wrote: post #63

Earlier quoted context omitted.

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, wh…

> My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns. I'm a bit concerned about that too. When setting it up, I found a lot of their docs on github mentioned they have `template` and `expand-env` "configuration filters", then it took me entirely too long to realize that while the 4.38 pre-release notes, posted in January 2023, say it's "just around the corne…

It's me and two others though I'm definitely the most active. We put a lot of effort into security best practices and one of my co-developers is currently reviewing the 4.38.0 release. It's a fairly major release with a lot of important code paths that have been improved for the future.

Our official docs can be found at https://www.authelia.com and you can find docs for a particular PR in the relevant PR. We've also linked the pre-release docs in the pre-release discussions which can be found here: https://github.com/authelia/authelia/discussions/categories/...

Re: Keycloak SSO with Docker Compose and Nginx

#99

Post by james_d_elliott »

rjzzleep wrote: post #9

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started. [1] https://goauthentik.io/ [2] https://www.authelia.com/

One of the Authelia principle maintainers here. If there's anything we can do to help with the configuration of Angular we'd be more than happy to via the GitHub discussions.

Re: Keycloak SSO with Docker Compose and Nginx

#100

Post by james_d_elliott »

ciceryadam wrote: post #70
mmcnl wrote: post #63

Earlier quoted context omitted.

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, wh…

Newest arch package is just over 4 months old - Last Updated: 2023-10-09 03:25 (UTC): https://aur.archlinux.org/packages/authelia

If you'd like a newer build of the pre-release they are available. Feel free to reach out on GitHub Discussions (may not see it here but see how we go).
Post reply on HN