Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kratos - Cloud native Auth0 open-source alternative (self-hosted)

github.com

Post reply on HN
Print view View original

81–90 of 99 posts

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#81

Post by nijave »

rirze wrote: post #8
nja wrote: post #4

I've used [Keycloak]( https://www.keycloak.org/ ) in the past for "open-source Auth0" -- though I'm not sure it has ever described itself that way. Keycloak ended up being quite extensible and powerful, but the UI and data model both sometimes made things more difficult than they had to be... this could be an interesting project to look at. One bonus (for us) for Keycloak was that it was JVM-based, meaning it was eas…

I'm very familiar with Keycloak, and I don't see this replacing it any time soon. As soon as I read: > The Ory Enterprise License (OEL) layers on top of self-hosted Kratos and provides: Additional enterprise features that are not available in the open source version such as SCIM, SAML, organization login ("SSO"), CAPTCHAs and more I knew it couldn't compete. Good luck to this product.

Imo a bit of a red flag. Sounds like one of those rug pull licenses when the VCs coming look for their returns

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#82

Post by vinckr »

brulard wrote: post #62
vinckr wrote: post #11

Earlier quoted context omitted.

Yea part of the motivation to create Ory Kratos was that Keycloak was too clunky and cumbersome for us to use, also hard to scale and a bunch of other issues - so we wrote our own basically. (i work for Ory as DevRel)

Oh, I wanted to escape the Kratos hell by migrating to Keycloak and you say Kratos was created to actually be a better alternative? Well I have to say I had a very hard time implementing browser flows, configuration is a mess, not everything working through yaml configs works as env var. Documentation is a mess. All in all, it took months what should have been weeks at most. Sorry for the negativity, but it is one of…

sorry to hear that, hope you have a better experience going forward. if you feel like it send me some details on what was most painful and we'll fix it.

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#83

Post by nijave »

otabdeveloper4 wrote: post #12

Storing auth data in MySQL or Postgres is insane and defeats the purpose of trying to be secure. Note to self: if I ever need a retirement project, open sourcing a properly architected auth solution would be it.

Both have options for column/field level encryption

Besides that, you can encrypt in the app regardless of the data storage

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#84

Post by conception »

caleblloyd wrote: post #19
fady0 wrote: post #3

Earlier quoted context omitted.

Aren’t these codes supposed to have a timeout, like you have to use them within 10 minutes or they become invalid?

Sure, but say the implementation lets you try 5 codes in that 10 minutes with a 30 minute lockout. An attacker could trigger Account Recovery, blindly try 5 six-digit codes immediately, and have a 0.0005% chance getting into your account. They could script this to run over a long period of time targeting 1 account, or they could target many accounts at once, and would probably have success.

It’s probably easier to just have an exception log when someone(s) have 100 bad password attempts in a day or whatever.

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#85

Post by bogomipblips »

vinckr wrote: post #82
brulard wrote: post #62

Earlier quoted context omitted.

Oh, I wanted to escape the Kratos hell by migrating to Keycloak and you say Kratos was created to actually be a better alternative? Well I have to say I had a very hard time implementing browser flows, configuration is a mess, not everything working through yaml configs works as env var. Documentation is a mess. All in all, it took months what should have been weeks at most. Sorry for the negativity, but it is one of…

sorry to hear that, hope you have a better experience going forward. if you feel like it send me some details on what was most painful and we'll fix it.

Just from looking right now, I'm a bit puzzled by being told right away that it has all open APIs in a warning in the install guide. Would I really want to tell someone to try starting something for our security that is an immediate attack vector?

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#87

Post by throwaway894345 »

AlphaSite wrote: post #42
throwaway894345 wrote: post #15

Earlier quoted context omitted.

I've often wondered why there isn't a simpler identity provider service that does the thing that ~90% of applications need without all of the complex configuration.

Honestly. We used dex. It worked pretty well.

Thanks for the rec. I’ll look into that.

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#88

Post by ffo »

grinich wrote: post #86
adammiribyan wrote: post #31

Does OpenAI use Ory? I thought they’re using Auth0.

OpenAI uses WorkOS for SSO and SCIM. https://help.openai.com/en/articles/9627404-openai-chatgpt-s...

I lost track what they use … Auth0, Ory, WorkOS… sounds like they should go ahead and finally acquire something #scnr

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#89

Post by esseph »

pojzon wrote: post #67
ikiris wrote: post #57

Earlier quoted context omitted.

Aka "yep there's a sso tax"

Yup lack of sso is instant “no-go” for anyone willing to host own solution.

This is a nightmare for security for companies that aren't big enough to pay the tax - which is most companies.

Every product, every fucking product, if it does anything, should have RBAC and SSO. These are the bare minimum. You want to hold off on SCIM for large customers, fine. Do that.

Re: Kratos - Cloud native Auth0 open-source alternative (self-hosted)

#90

Post by trenchpilgrim »

trollbridge wrote: post #77
trenchpilgrim wrote: post #53

Earlier quoted context omitted.

Ironically, their hard dependency on Docker is a showstopper for me - none of my systems run Docker Engine, they use containerd and Podman, neither of which are supported.

I run Authentik in podman; you could also in theory just run it without containers, although that would be obnoxious to set up.

Do you have a repo or example somewhere I can look at? Thanks
Post reply on HN