31–40 of 95 posts
Reminder - KeyCloak was donated to CNCF so a safe choice https://www.keycloak.org https://www.cncf.io/blog/2023/04/11/keycloak-joins-cncf-as-a...
Reminder - KeyCloak was donated to CNCF so a safe choice https://www.keycloak.org https://www.cncf.io/blog/2023/04/11/keycloak-joins-cncf-as-a...
how is this related to better auth ? In my understanding, keycloak and better auth are fundamentally different. I would compare keycloak more with Ory for example.
The self-hosted space is another headache. I wasted so much time trying to make smaller self-hosted auth solutions work, since Keycloak has a reputation for being heavyweight.
I looked into the Ory stack extensively trying to actually use it as advertised for self-hosted / open-source auth. It's aggressively gimped and its SSO features are emphatically _not_ open-source and are gated behind licensing, with no way to find out until you're actually running it.
It's also just unfinished. Their "stack" is a lot of cobbled-together Go mixed with incompletely rebranded acquisitions like SAML Jackson (now "Polis"), which they managed to gut so completely it went from a best-in-class OSS library to unusable.
Reminder - KeyCloak was donated to CNCF so a safe choice https://www.keycloak.org https://www.cncf.io/blog/2023/04/11/keycloak-joins-cncf-as-a...
It also really shows its age, imo. The interface is clunky, roles and groups having overlapping responsibilities is confusing, making custom UIs for it makes me feel ancient, etc.
I really can't complain though. There is simply no alternative that's as open atm. It's also not easy to make one ( I tried :( ).
Earlier quoted context omitted.
Yeah, we rolled our own auth as well. Everybody says you shouldn’t, it’s a risk, etc etc. but to me that’s less risk than our auth getting bought by somebody whose business goals don’t necessarily align with mine.
why not instead fork repo just in case but still use better auth until proven wrong? In case they go evil you just build from you forked one. At that point you would still have to either maintain your own auth or better auth fork. With current AI your agents probably still will be better with maintaining a fork. Auth libs have pretty limited API surfaces comparing to e.g. ui frameworks.
im amused that people are still relying on third party for handling auth when you can roll your own now with LLMs
Reminder - KeyCloak was donated to CNCF so a safe choice https://www.keycloak.org https://www.cncf.io/blog/2023/04/11/keycloak-joins-cncf-as-a...
Is keycloak still the only real game in town for open source authorization (not authentication; that part is totally fungible)?
It's Apache 2.0 and a CNCF incubating project.
Auth is not hard to roll yourself. Crypto: don't do it. Auth? Easy peasy.
Rolling auth by yourself is very messy. Storing tokens correctly, rotating and using correct tokens, with correct parameters and so on. Endless footguns.