I had to work with this at my old job(forked, messy-patched and outdated version). Honestly, I wasn't a big fan, mostly because of the horrible patches to make it do things it was never meant to do but also to some degree because of how unnecessarily over-complicated it was.
Kratos - Cloud native Auth0 open-source alternative (self-hosted)
21–30 of 99 posts
Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)
#22Do I need to use the other services from the Ory stack to have this be complete? I tried reading the Ory docs a couple of times when I needed an auth solution but it was indecipherable to me as someone not living in the auth world
It depends what your requirements are.
If you are "just" doing first-party login, session, and user mgmt then Ory Kratos is all you need. I would say in the majority of cases you would be fine with just Ory Kratos.
If you want 3rd party integrations, or become an IDP (think "login with $yourcorp"), or you migrate an existing system that relies on OAuth2 that you want to keep, or you have more complex auth flows where OAuth2 shines, then you want Ory Hydra.
If you want a "fine-grained" global, centralized authz system, complex and scalable authz as described by Google Zanzibar, then you want Ory Keto.
If you want to support SAML as well, you want Ory Polis.
If you want a "zero trust" setup, then you want Ory Oathkeeper.
That being said in almost all cases Kratos will be fine and you can pick and choose what you actually need.
Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)
#23I've used [Keycloak]( https://www.keycloak.org/ ) in the past for "open-source Auth0" -- though I'm not sure it has ever described itself that way. Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be... this could be an interesting project to look at. One bonus (for us) for Keycloak was that it was JVM-based, meaning it was eas…
> One bonus (for us) for Keycloak was that it was JVM-based, meaning it was easier to integrate our existing JVM libraries. Though its use of Hibernate was frustrating at times, heh I'm pretty frightened of running Java services, not because of the JVM, but because every Java app I've had to operate is infinitely configurable via some poorly documented XML file, and trying to reverse engineer the XML file is often di…
I've used environment variables to configure keycloak. Worked for me.
Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)
#24I tried to use Ory for my company and cannot recommend it. Zitadel has been far better
Hey, if you want to share a bit more feedback would love to hear it!
feel free to also message me directly if you don't want to share it here.
tbh i don't know too much about it other than that they moved away from the apache2 license recently
(disclaimer: I'm working for Ory)
Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)
#25I tried to use Ory for my company and cannot recommend it. Zitadel has been far better
Thank you for your trust.
Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)
#26I've used [Keycloak]( https://www.keycloak.org/ ) in the past for "open-source Auth0" -- though I'm not sure it has ever described itself that way. Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be... this could be an interesting project to look at. One bonus (for us) for Keycloak was that it was JVM-based, meaning it was eas…
I'm very familiar with Keycloak, and I don't see this replacing it any time soon. As soon as I read: > The Ory Enterprise License (OEL) layers on top of self-hosted Kratos and provides: Additional enterprise features that are not available in the open source version such as SCIM, SAML, organization login ("SSO"), CAPTCHAs and more I knew it couldn't compete. Good luck to this product.
Yeah that’s very disappointing and basically kills my interest in the product.
Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)
#27I've tried Keycloak and quite a few other IAM solutions, and finally settled on Kanidm. Not because it was written in Rust but because the project was easy to learn and understand and it wasn't that hard to hook things up to it. It has it's quirks, but it's been phenomenal so far. The fact that it's super lightweight from my experience is also a big bonus.
Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)
#28I tried to use Ory for my company and cannot recommend it. Zitadel has been far better
Hey, if you want to share a bit more feedback would love to hear it! feel free to also message me directly if you don't want to share it here. tbh i don't know too much about it other than that they moved away from the apache2 license recently (disclaimer: I'm working for Ory)
Well we moved Zitadel from Apache to AGPL (some parts are still Apache and MIT, like SDKs and the login UI) in order to commit even more to OSS.
Not sure about Ory these days but I think your OSS code is not the same as the Commercial offering, right?
Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)
#29Storing auth data in MySQL or Postgres is insane and defeats the purpose of trying to be secure. Note to self: if I ever need a retirement project, open sourcing a properly architected auth solution would be it.
authn or authz?
Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)
#30I tried to use Ory for my company and cannot recommend it. Zitadel has been far better
I tried setting up Zitadel and couldn't because for whatever reason it's Nix build isn't reproduceable. So Nix always breaks when trying to verify that it, you know, actually built correctly. So I eventually gave up.