I have been using Keycloak for the past couple of years in my homelab for SSO. It works really well, but there's a bit of a learning curve.
Keycloak: Open-Source Identity and Access Management
51–60 of 243 posts
Re: Keycloak: Open-Source Identity and Access Management
#52Slightly out of topic, but based on Caddy, has anybody experience with Caddy Security[0]? It is very easy to install but hard to find other users.
Re: Keycloak: Open-Source Identity and Access Management
#53Earlier quoted context omitted.
This fascinated me - where and how does this fit into other identity providers (and thence into SSO). I kind of yearn for client certificates everywhere simply because I can grok how that remains secure as we pass through layer after layer. the rest I just worry about
keycloak can broker between identity providers. It can use social logins as identity providers, connect to ldap, kerberos and others for user federation, and then provide SAML and OpenIDC to other applications.
Exactly this. OIDC and SAML integrations with customers IdP's. Map identity metadata from the customer into our realm so they can provide data in any way they want and we map it down to our standard which allows our applications to stay clean when using this metadata for business logic.
We have also added an event plugin to keycloak to push login events to a queue for other services to consume.
We also offer local keycloak identities in case a customer does not or can not provide their own identities, and have added haveibeenpwnd logic to check password strength/reuse for these local keycloak identities.
Re: Keycloak: Open-Source Identity and Access Management
#54As others mentioned, Keycloak is a good choice if you need a self-hosted IAM solution and are familiar with Java development. If you don't need selfhosted, I can recommend using Amazon AWS Cognito as a OAuth2/IAM solution - it is included in the free tier for up to 50.000 MAUs, plus the signup/lost password mails etc. are sent through Amazon SES, which heavily increases the inboxing rate. You could always transition…
What are your main reasons for recommending Cognito? That it is free and easy to get going with?
Have you customized the user login experience?
I only ask because I've heard folks talk about how Cognito does the basics right (which is great, no one should roll their own auth) and is quick to get started with, and is serverless and free (unless you want SAML connections).
But once you get past the basics, it turns into a ton of hassle. And there's been little progress in feature set/docs/etc (though last year they did do a UI refresh).
* https://twitter.com/zackkanter/status/1488297503455956992
* https://fusionauth.io/blog/2020/11/18/reconinfosec-fusionaut...
They also don't let you export your password hashes, so when you transition to a self hosted solution, you must force your users to reset their passwords (or perform a drip migration). I wrote about these options here: https://fusionauth.io/blog/2022/02/07/how-to-migrate-from-co...
Disclosure, I work for a Cognito competitor, FusionAuth.
Re: Keycloak: Open-Source Identity and Access Management
#55Keycloak is a great piece of software if you have to authenticate against AD (on prem, not Azure AD). It's the best way to isolate all the crap like "user accounts live in this OU, but admin accounts live only in that OU. Oh, and we also have another domain where contractors live in the same OUs. And the groups that map to application roles are the same, but live in differently named OUs" and provide a simple OAuth 2.0/OIDC authentication/authorization interface to all this mess.
Re: Keycloak: Open-Source Identity and Access Management
#56I like IdentityServer4 even though is not supported anymore
Re: Keycloak: Open-Source Identity and Access Management
#57My biggest issue in the version I was evaluating: Some service providers use “email” as username (in fact many do.) Keycloak doesn’t make it easy to prohibit users from changing their own email, making it trivial to impersonate someone else and gain access one shouldn’t have. https://keycloak.discourse.group/t/hide-disable-email-change...
Did they offer some kind of verification path?
So you could only allow an email change if the user proved they owned the new email account by clicking a link or entering a code sent to that account?
Seems like a natural option.
Of course, allowing you to disallow email changes seems pretty reasonable too.
Re: Keycloak: Open-Source Identity and Access Management
#58I have been using Keycloak for the past couple of years in my homelab for SSO. It works really well, but there's a bit of a learning curve.
What would you say have been the positives and negatives of it? Is the learning curve above and beyond OIDC/OAuth? How much did you have to customize it?
Re: Keycloak: Open-Source Identity and Access Management
#59Does someone here know how Keycloak compares to Gluu?
From what I've heard, Keycloak is better supported and has a bigger community that Gluu (12k stars vs 300 stars on GH). They are both open source and in Java. I've heard from users that Gluu can be a resource hog.
Re: Keycloak: Open-Source Identity and Access Management
#60We are currently using Shibboleth, and would love to get away from using java/Tomcat. It looks like Keycloak also uses java. Is there an alternative to this that doesn't require it?
FusionAuth uses Java to, but if you use Docker/kubernetes, you don't really have to think about it: https://fusionauth.io/docs/v1/tech/installation-guide/docker
And even if you don't, we install our own Java and manage it for you, so there's no Tomcat WAR file installation or anything like that.
Disclosure: I work for FusionAuth.