101–110 of 111 posts
I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you'r…
Earlier quoted context omitted.
I also went down this road recently. Personally I had gone with caddy-security[1] which is simply a plugin for Caddy. [1] https://github.com/greenpau/caddy-security
I also went down this road recently, and discovered caddy-security, but I have security concerns [0]. Software always has vulnerabilities, but this was enough to scare me off. Something like keycloak or authentia seems more tested and secure. [0] https://blog.trailofbits.com/2023/09/18/security-flaws-in-an...
Yeah, that's an unfortunate reality, but
> The caddy-security plugin maintainers confirmed that there were no near-term plans to act on the reported vulnerabilities.
Ouch. That's a red flag, thanks for pointing it out. I guess it's time to check out Authelia (I think that's what you meant by authentia?).
Earlier quoted context omitted.
Disclosure: I work for FusionAuth. If you are looking for SSO + easy configuration + an admin UI (which admittedly has a mid 2000s UX look and feel), you should check out FusionAuth. It's free to download and run yourself[0], docker friendly[1], has a variety of configuration choices[2] (including terraform[3] to manage your OIDC/other settings). Worth noting that it is free to use, but not open source[4]. 0: https:/…
How do I integrate this with a reverse proxy like Caddy and their forward_auth directive? I want to secure my apps on the proxy layer, not the app layer.
You have very granular options to customize the experience allowing multiple sites to have the same or different rules, which can alter the authentication requirements based on remote ip, users, groups, paths, domains, etc.
After looking for a solution for my home lab for a while I ended up with Authentik. It's a comparatively new kid, but it was very easy to set up and the documentation is really excellent!
Earlier quoted context omitted.
have you looked at the codebase? it's been a while but I was implementing Keycloak a few years ago and it was shocking how big the codebase is and how difficult it is to change things to add what felt like basic functionality. making plugins didn't seem like a viable option either. oh not to mention the statefulnes of it, it was almost impossible to destroy and re create an instance from scratch without a bunch of ma…
Keycloak solves a complex problem. It is built on a plugin architecture, so plugins are certainly a viable option and this is documented in more detail here[0]. In general I have found the Keycloak docs thorough and well-written. When I operated Keycloak I built a few plugins to solve specific needs/assumptions we had around IdP when migrating to Keycloak from a bespoke solution. Re: your second point, the docs also…
My boss recently called Keycloak "the gift that keeps on giving", but he was actually commenting on how there's a new ticket in jira for figuring out how the f*?k to do something. Having said that, I have terraform that creates an EKS cluster, deploys Keycloak , creates clients (SAML/OIDC), adds external identity providers, sets up an AWS IAM Identity Provider for it etc. That makes it extremely easy to use once you'…
By any chance, is that Terraform open sourced somewhere? It's for a friend :)
Earlier quoted context omitted.
The free version of FusionAuth has limits beyond what other licenses have. See https://fusionauth.io/license-faq#3 for more details. I'm afraid that's all the detail I have about the decision to keep FusionAuth closed source.
Sorry, on re-read, this sounds kinda abrupt. My bad. I think at the end this is a business decision. The executive team has considered options and decided that closed source is the right path for the company.
Earlier quoted context omitted.
I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, wh…
Hey one of the Authelia developers here. We're very actively working on a very large release (it's just going through the peer review process and it should be good to go) and we currently have a pre-release for users to dive into. I can understand the security concerns but we are regularly taking measures to ensure no zero-day vulnerabilities exist, there are no known vulnerabilities with Authelia at the present time…
Earlier quoted context omitted.
By any chance, is that Terraform open sourced somewhere? It's for a friend :)
haha, nope unfortunately. But I also use an odd method of keeping my terraform code dry via Hiera (yes, the Puppet thing). If you're interested I can find out if it's ok to open source it.
FYI, SSO=Single Sign-On