Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keycloak: Open-Source Identity and Access Management

keycloak.org

Post reply on HN
Print view View original

221–230 of 243 posts

Re: Keycloak: Open-Source Identity and Access Management

#221

Post by littlecranky67 »

easrng wrote: post #207
littlecranky67 wrote: post #110

Earlier quoted context omitted.

The problem with the authorization code flow is, it was not build with SPAs in mind. I.e. you always need a server-side component that obtains those tokens. So a 100% client/FE solution based on NextJS/React/angular/vue etc. can not simply be deployed to a CDN and then use Auth0/AWS Cognito/Azure AD whatever without running and hosting your own server-side component.

It depends on the provider. For Mastodon and Pleroma, there's an endpoint to get generate a client ID/secret that you can call on the client. The flow is basically 1. Prompt for an instance name 2. Get a client id/secret from the instance and put it in localStorage 3. Redirect to the login page 4. Once you get the callback, get the token using the code and the client ID/secret from localStorage 5. You're done. No ser…

But this is surely non-standard OAuth 2.0, is it?

Re: Keycloak: Open-Source Identity and Access Management

#222

Post by ffo »

doctor_eval wrote: post #217
ffo wrote: post #215

Earlier quoted context omitted.

Thank, we hear you! Currently we are discussing two things for this subject. 1) We think providing an embedded DB of some kind for easy to use cases with ZITADEL might be favourable to some of you (think Sqlite or an embedded CockroachDB ) 2) To allow plain Postgresql besides CockroachDB should be an easy thing to do since we already make use of PG wire protocol. We plan to address this in a 2.X release What do you t…

Thanks for taking the time to answer everyone's questions, and for asking me this one. My own personal preference would be if you could please support PG, because in that case I could be confident of going into production with what I configure, even if it's less scaleable than CockroachDB. I'd really prefer to be learning about how Zitadel works, rather than learning CDB or trying to remember sqlite cli commands. I'm…

Well thank you for your time. Let me check with the team. I am certain we can release 2.X with a Postgresql support ;-)

I created an issue for further tracking https://github.com/zitadel/zitadel/issues/3598

Re: Keycloak: Open-Source Identity and Access Management

#223

Post by littlecranky67 »

mooreds wrote: post #120
littlecranky67 wrote: post #116

Earlier quoted context omitted.

I just checked prices of FusionAuth, and clearly your company is not interested in smaller side-gig like customers or self-funded startup that need to grow. Basic, production cloud options (non-eval) start at $162/mo for 10.000 MAUs. Once I move the slide to over 10.000MAUs the basic option is gone, and the cheapest option suddenly jumps to $1062/mo.

Thanks for taking a look. For your use case, I'd probably recommend self hosting community edition. FusionAuth price: $0. You could do this on ec2, etc, or there's a heroku 'one click deploy': https://elements.heroku.com/buttons/mickeymond/fusion-auth-h... This is the path most folks using FusionAuth for side-gig use. You can download the community edition here: https://fusionauth.io/download For smaller companies, w…

> For your use case, I'd probably recommend self hosting community edition. FusionAuth price: $0.

But self-hosting has the same issue as Keycloak: Email inboxing. You do not want your signup verification emails to land in spam folders. So you end up paying for an email mailboxing provider, at which point I'd rather go with a hosted auth solution that takes care of that.

Re: Keycloak: Open-Source Identity and Access Management

#224

Post by doctor_eval »

ffo wrote: post #222
doctor_eval wrote: post #217

Earlier quoted context omitted.

Thanks for taking the time to answer everyone's questions, and for asking me this one. My own personal preference would be if you could please support PG, because in that case I could be confident of going into production with what I configure, even if it's less scaleable than CockroachDB. I'd really prefer to be learning about how Zitadel works, rather than learning CDB or trying to remember sqlite cli commands. I'm…

Well thank you for your time. Let me check with the team. I am certain we can release 2.X with a Postgresql support ;-) I created an issue for further tracking https://github.com/zitadel/zitadel/issues/3598

That rocks. Thank you. I’ve been hanging out for a more lightweight IAM/IDP solution, quite literally for years. I really hope yours is it.

Re: Keycloak: Open-Source Identity and Access Management

#225

Post by ffo »

doctor_eval wrote: post #224
ffo wrote: post #222

Earlier quoted context omitted.

Well thank you for your time. Let me check with the team. I am certain we can release 2.X with a Postgresql support ;-) I created an issue for further tracking https://github.com/zitadel/zitadel/issues/3598

That rocks. Thank you. I’ve been hanging out for a more lightweight IAM/IDP solution, quite literally for years. I really hope yours is it.

We too ;-)

Re: Keycloak: Open-Source Identity and Access Management

#226

Post by evrflx »

ffo wrote: post #215
doctor_eval wrote: post #199

Earlier quoted context omitted.

If CockroachDB supports the PG wire protocol and appears to be a functional subset of PG then in theory we might be able to just point it at a PG database and it might work :) I too would prefer to use PG than Cockroach, if only because I have ops experience with PG. But Cockroach is certainly intriguing.

Thank, we hear you! Currently we are discussing two things for this subject. 1) We think providing an embedded DB of some kind for easy to use cases with ZITADEL might be favourable to some of you (think Sqlite or an embedded CockroachDB ) 2) To allow plain Postgresql besides CockroachDB should be an easy thing to do since we already make use of PG wire protocol. We plan to address this in a 2.X release What do you t…

I would love to have the embedded db option as well. Reason: for demos on conferences but more importantly in a training/workshop or Tutorial scenario it should be easy to get it running and let students replicate the setup. I assume that this can be a nice multiplier and is underrated by many „modern“ projects. (Elastic apm 8.x: I am looking at you)

Re: Keycloak: Open-Source Identity and Access Management

#227

Post by unixhero »

jonkoops wrote: post #94
schipplock wrote: post #20

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. I…

We're actually working on a new version of the Administration UI at the moment (I'm one of the devs) so this is useful feedback. We're looking for folks to try it out, so take a look at https://github.com/keycloak/keycloak-admin-ui/ . You can try it out on the latest Keycloak by passing the --features=admin2 flag on startup.

I come from cybersec and I want to give you mad props for this product and project. It fills gaps in many places!

Re: Keycloak: Open-Source Identity and Access Management

#228

Post by Loic »

francislavoie wrote: post #218
Loic wrote: post #52

Slightly out of topic, but based on Caddy, has anybody experience with Caddy Security[0]? It is very easy to install but hard to find other users. [0]: https://github.com/greenpau/caddy-security

(Caddy maintainer here) I don't use that plugin myself but AFAICT most users ask questions on the GitHub repo so probably best to ask for help there if you need it. As an aside, I've been working on making the Forward Auth usecase viable with Caddy, and we just got it working today https://github.com/caddyserver/caddy/pull/4739

Thank you, my question was more a kind of bottle to the sea, if anybody was using it. I was able to configure the plugin nicely and get gitea as a source of users and groups to control access to other applications.

And by the way, thank you, I am really impressed by the quality of Caddy.

Re: Keycloak: Open-Source Identity and Access Management

#229

Post by easrng »

littlecranky67 wrote: post #221
easrng wrote: post #207

Earlier quoted context omitted.

It depends on the provider. For Mastodon and Pleroma, there's an endpoint to get generate a client ID/secret that you can call on the client. The flow is basically 1. Prompt for an instance name 2. Get a client id/secret from the instance and put it in localStorage 3. Redirect to the login page 4. Once you get the callback, get the token using the code and the client ID/secret from localStorage 5. You're done. No ser…

But this is surely non-standard OAuth 2.0, is it?

Other than the initial request to get the client ID/secret it's standard I think

Re: Keycloak: Open-Source Identity and Access Management

#230

Post by advaitruia »

offminded wrote: post #140

I had to decide between Keycloak and Supertokens just last week.. Gone through both of their documentation and repos and decided to go with Supertokens. Backend and Frontend flexibility and their instant Discord support to my questions was a huge plus for me.

Awesome! One of the project creators here, glad to hear you're having a good experience so far
Post reply on HN