61–70 of 99 posts
Storing auth data in MySQL or Postgres is insane and defeats the purpose of trying to be secure. Note to self: if I ever need a retirement project, open sourcing a properly architected auth solution would be it.
I've used [Keycloak]( https://www.keycloak.org/ ) in the past for "open-source Auth0" -- though I'm not sure it has ever described itself that way. Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be... this could be an interesting project to look at. One bonus (for us) for Keycloak was that it was JVM-based, meaning it was eas…
Yea part of the motivation to create Ory Kratos was that Keycloak was too clunky and cumbersome for us to use, also hard to scale and a bunch of other issues - so we wrote our own basically. (i work for Ory as DevRel)
> Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Sounds great! But buried further in the page, > Additional enterprise features that are not available in the open source version such as SCIM, SAML, organization login ("SSO"), CAPTCHAs and more
Check out Ory Polis if you want SAML/SCIM support: https://github.com/ory/polis CAPTCHA is not in scope for Kratos, there are already great solutions out there that you can use
> Organizations that require advanced features, enhanced security, and enterprise-grade support for Ory's identity and access management solutions benefit from the Ory Enterprise License (OEL) as a self-hosted, premium offering including: Additional features not available in the open-source version, Regular releases that address CVEs and security vulnerabilities, with strict SLAs for patching based on severity, Support for advanced scaling and multi-tenancy features.
I've used [Keycloak]( https://www.keycloak.org/ ) in the past for "open-source Auth0" -- though I'm not sure it has ever described itself that way. Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be... this could be an interesting project to look at. One bonus (for us) for Keycloak was that it was JVM-based, meaning it was eas…
The sheer complexity of Keycloak's configuration and deployment vs. something like ORY's Hydra was night and day.
And the fact that I could intercept the auth flow through a callback and use their RESTful API to drive it was amazing. No more "package this JAR" and hope that it works. Hydra would run on its own and I don't have to touch it, except when I have to upgrade it.
It might be poor taste to hijack another product's post but I would check out Authentik before commiting to any idP. It recently started to have enterprise only features lately but its licence ensures they are added to the open source product after a set time period. Super nice developer too.
Does OpenAI use Ory? I thought they’re using Auth0.
Earlier quoted context omitted.
You can use other parts of the Ory ecosystem to add these features, such as Ory Polis for SAML/SCIM support: https://github.com/ory/polis CAPTCHAs aren’t a big help anymore in my personal opinion, but you can easily integrate them on the frontend when using Kratos. The commercial offering just bundles all of this out of the box for you. If Keycloak fits your needs well and you see no room for improvement, that’s perf…
Aka "yep there's a sso tax"
I tried to use Ory for my company and cannot recommend it. Zitadel has been far better
Without any arguments you bring absolutely zero to the conversation. For example, in a head to head I would prefer Ory because Go is more compatible with the stack I'm working with.
I'm just sharing this as a datapoint. Btw we hired someone who worked at Ory and use Go as well
Earlier quoted context omitted.
You can host authentik with one click in docker. It's super easy to set up
Ironically, their hard dependency on Docker is a showstopper for me - none of my systems run Docker Engine, they use containerd and Podman, neither of which are supported.
Kratos is awesome, especially alongside Hydra, OathKeeper, and Keto. Super powerful combo, if not a little intimidating at first. There’s a LOT of configuration involved, but that’s to be expected if you want to host your own Auth0 replacement. Their dynamic forms stuff is really cool too, always liked how they chose to go about that. Only complaint I really ever had is that while their docs were overall serviceable,…
I've often wondered why there isn't a simpler identity provider service that does the thing that ~90% of applications need without all of the complex configuration.
Obviously you can make a product that only does really good username/password auth for example, but there's always more pressure to implement more things for another use case.