Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kratos - Cloud native Auth0 open-source alternative (self-hosted)

github.com

Post reply on HN
Print view View original

51–60 of 99 posts

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#51

Post by vinckr »

solarkraft wrote: post #47
Sytten wrote: post #38

We are using ory kratos in production. - It works and does the job. I appreciate that we got this piece of tech for free when we needed with quickly. - The doc is clearly written in a way to steer you toward their cloud (fair enough everybody needs to eat). Setting things up is not straight forward even after years of using it. - Backend driven UI is just weird. - The founder used to be very opinionated on some thing…

Oh my. The list of supported things is so long I just assumed it would obviously support SAML. That’s a big blind spot and possibly a deal breaker if somebody is looking for a versatile option.

Ory Kratos itself doesn't support SAML that is correct.

However the newest addition to the Ory ecosystem, called Ory Polis (formerly known as BoxyHQ) does close that gap. It is also Apache2 licensed, do check it out here: https://github.com/ory/polis

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#52

Post by vinckr »

Sytten wrote: post #38

We are using ory kratos in production. - It works and does the job. I appreciate that we got this piece of tech for free when we needed with quickly. - The doc is clearly written in a way to steer you toward their cloud (fair enough everybody needs to eat). Setting things up is not straight forward even after years of using it. - Backend driven UI is just weird. - The founder used to be very opinionated on some thing…

you should check out Ory Polis if you are looking for SAML support in the OSS version: https://github.com/ory/polis

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#53

Post by trenchpilgrim »

snowfield wrote: post #44
throwaway894345 wrote: post #15

Earlier quoted context omitted.

I've often wondered why there isn't a simpler identity provider service that does the thing that ~90% of applications need without all of the complex configuration.

You can host authentik with one click in docker. It's super easy to set up

Ironically, their hard dependency on Docker is a showstopper for me - none of my systems run Docker Engine, they use containerd and Podman, neither of which are supported.

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#54

Post by vinckr »

rirze wrote: post #8
nja wrote: post #4

I've used [Keycloak]( https://www.keycloak.org/ ) in the past for "open-source Auth0" -- though I'm not sure it has ever described itself that way. Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be... this could be an interesting project to look at. One bonus (for us) for Keycloak was that it was JVM-based, meaning it was eas…

I'm very familiar with Keycloak, and I don't see this replacing it any time soon. As soon as I read: > The Ory Enterprise License (OEL) layers on top of self-hosted Kratos and provides: Additional enterprise features that are not available in the open source version such as SCIM, SAML, organization login ("SSO"), CAPTCHAs and more I knew it couldn't compete. Good luck to this product.

You can use other parts of the Ory ecosystem to add these features, such as Ory Polis for SAML/SCIM support: https://github.com/ory/polis

CAPTCHAs aren’t a big help anymore in my personal opinion, but you can easily integrate them on the frontend when using Kratos. The commercial offering just bundles all of this out of the box for you.

If Keycloak fits your needs well and you see no room for improvement, that’s perfectly fine; by all means use what works best for you.

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#55

Post by danudey »

mariusor wrote: post #41
otabdeveloper4 wrote: post #12

Storing auth data in MySQL or Postgres is insane and defeats the purpose of trying to be secure. Note to self: if I ever need a retirement project, open sourcing a properly architected auth solution would be it.

For the rest of us that have less experience, what is the problem that you're seeing with that? You didn't really make an argument.

My first read is that 'storing auth data in a relational database is bad' or 'storing critical auth data in a system where only one node can write' is bad, but thinking about the possibilities a bit it could be a factor of data-at-rest as well?

Two factors: the first, that (given the right system permissions) auth data could be fetched from a backup without having access to the system (MySQL/Postgres) directly. Theoretically not a problem if you're salting everything, etc., since you're presumably not storing auth data in plaintext anyway.

Second, no cryptographic verification that nothing has been tampered with? Theoretically possible for someone to e.g. modify the auth data on-disk for the DB to then read and allow auth when it shouldn't.

So I guess at that point the 'solution' would be some form of storage which provides cryptographic verification of its contents so that you can detect tampering, as well as a distributed system with consensus so that if auth data is changed out-of-band then it can be detected and corrected by the other nodes.

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#56

Post by parliament32 »

> Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more.

Sounds great! But buried further in the page,

> Additional enterprise features that are not available in the open source version such as SCIM, SAML, organization login ("SSO"), CAPTCHAs and more

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#57

Post by ikiris »

vinckr wrote: post #54
rirze wrote: post #8

Earlier quoted context omitted.

I'm very familiar with Keycloak, and I don't see this replacing it any time soon. As soon as I read: > The Ory Enterprise License (OEL) layers on top of self-hosted Kratos and provides: Additional enterprise features that are not available in the open source version such as SCIM, SAML, organization login ("SSO"), CAPTCHAs and more I knew it couldn't compete. Good luck to this product.

You can use other parts of the Ory ecosystem to add these features, such as Ory Polis for SAML/SCIM support: https://github.com/ory/polis CAPTCHAs aren’t a big help anymore in my personal opinion, but you can easily integrate them on the frontend when using Kratos. The commercial offering just bundles all of this out of the box for you. If Keycloak fits your needs well and you see no room for improvement, that’s perf…

Aka "yep there's a sso tax"

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#58

Post by lxdlam »

We self hosted Kratos only as our IdP: three million total users, about 200k login/logout/session/jwt queries a day, using only four 1C 2G k8s pods with one extra for courier, a standard proxied 4c8g Postgres, everything works fine. Really easy to maintain with simple configuration and fully featured API.

But their documentation is really bad, especially in OSS suites. I generally use Claude Code to read their code, find the matching implementation, and try to figure out how to properly configure.

Anyway, if you need self host your IdP, just go for it, you cannot go wrong.

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#59

Post by dizhn »

It might be poor taste to hijack another product's post but I would check out Authentik before commiting to any idP.

It recently started to have enterprise only features lately but its licence ensures they are added to the open source product after a set time period. Super nice developer too.

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#60

Post by vinckr »

parliament32 wrote: post #56

> Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Sounds great! But buried further in the page, > Additional enterprise features that are not available in the open source version such as SCIM, SAML, organization login ("SSO"), CAPTCHAs and more

Check out Ory Polis if you want SAML/SCIM support: https://github.com/ory/polis

CAPTCHA is not in scope for Kratos, there are already great solutions out there that you can use

Post reply on HN