Is Keycloak something that is intended to be exposed publicly, or is this something typically used behind a VPN or equivalent protection?
Keycloak: Open-Source Identity and Access Management
151–160 of 243 posts
Re: Keycloak: Open-Source Identity and Access Management
#152Earlier quoted context omitted.
Ha ha, fair enough. I've found it better to err on the side of transparency.
I would offer two suggestions that might improve reception: 1. Put that disclaimer at the top 2. Shrink it to no more than a couple sentences and link to a blog post or something for the detailed comparison. It looks pre-canned and kind of spammy the way it is now
Thanks, I appreciate that feedback. I agree that I was over enthusiastic. Unfortunately I can't edit the post now, but will do better next time.
Re: Keycloak: Open-Source Identity and Access Management
#153Is Keycloak something that is intended to be exposed publicly, or is this something typically used behind a VPN or equivalent protection?
It depends on what your needs are. If you are using it for CIAM (customer identity and access management) then you are probably going to be putting it on the internet. If using it for internal IAM (identity and access management, also known as workforce identity) you can keep it inside your network.
I believe Keycloak works either way.
Re: Keycloak: Open-Source Identity and Access Management
#154Does Keycloak or any of the alternatives mentioned here do a good job of supporting localization? What about customization of the email messages for lost password flows?
Ory Kratos and Hydra are API only and so don't provide a UI. Localisation then is entirely up to you.
Re: Keycloak: Open-Source Identity and Access Management
#155I've integrated keycloak for SSO between several self hosted apps and boy I had no idea what I was doing but copy paste config from left and right from various sites which worked in the end but does SSO have to be this complicated? Can someone recommend a simpler solution to integrate SSO with online tools (like NextCloud, Discourse, Wiki.js, Gitea etc)? Does anyone have experience with Authentik?
I've used many solutions, even built my own in the end. Problem is that there's no software that can make SSO easy to understand if you don't know everything about SSO to begin with. SSO is not that complicated to work with, the docs are just stupidly difficult to read and the point of the whole process is rarely explained. Learning how without knowing why is nearly impossible.
> even built my own in the end.
Can you tell me more about this?
Did you end up building your own from the ground up, or leveraging existing libraries?
Is it open source/available for others to use?
Re: Keycloak: Open-Source Identity and Access Management
#156Earlier quoted context omitted.
This fascinated me - where and how does this fit into other identity providers (and thence into SSO). I kind of yearn for client certificates everywhere simply because I can grok how that remains secure as we pass through layer after layer. the rest I just worry about
keycloak can broker between identity providers. It can use social logins as identity providers, connect to ldap, kerberos and others for user federation, and then provide SAML and OpenIDC to other applications.
As someone who has superficially looked into it a couple times and gotten pushed away by the complexity: what do you recommend for a backend? Is there another container that provides an LDAP service I could use? Or Kerberos?
I am rebuilding my homelab soon and I am interested in having centralized auth across all systems and as many applications as feasible, using my centralized fileserver as an IDP source via some application or another, as well as using Keycloak for some one-off projects where I don't really want to write a user layer.
Re: Keycloak: Open-Source Identity and Access Management
#157In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…
> Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. This is one area where incentives don't align correctly for open source projects that offer commercial support.
[deleted]
Re: Keycloak: Open-Source Identity and Access Management
#158Earlier quoted context omitted.
> Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. This is one area where incentives don't align correctly for open source projects that offer commercial support.
Disclaimer: Former Red Hatter but worked on OpenShift, not Keycloak Working as a person providing commercial support for open source projects, I promise it doesn't actually work that way. Incentives are entirely for creating good documentation. Having crappy docs only hurts project adoption for paying and non-paying customers, increases the support burden, and wastes the time of your employees (who are the primary co…
Thank you for taking the time to share your first-hand perspective!
Re: Keycloak: Open-Source Identity and Access Management
#159In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…
> Newer versions are on Quay only
Thanks for mentioning this, I didn't realize Keycloak is a RedHat product. I'll plan to move to something else. Anything RedHat makes turns into a catastrophe.
Re: Keycloak: Open-Source Identity and Access Management
#160My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly…
I knew I could smell Java when I went to their website...
Languages (actually, ecosystems) do have specific smells. You can perceive them on every artifact. It's an interesting observation.