4 ms·

Thank you. Keeping those thousands of predefined integrations aside, do you know of any good combination of user-management/access-management/federated-access

by vittore 10y ago

Thank you. Keeping those thousands of predefined integrations aside, do you know of any good combination of user-management/access-management/federated-access system beside GLUU?

willow9886 10y ago
ForgeRock has a pretty comprehensive suite of open source IAM software [1] but you have to buy a subscription before you can put it into production. There's also the open source KeyCloak project from RedHat. [2] Also I believe Connect2ID is FOSS. [3] [1] https://www.forgerock.com/ https://www.forgerock.com/ [2] http://www.keycloak.org/ http://www.keycloak.org/ [3] http://connect2id.com/ http://connect2id.com/
- cyberpunk 10y ago
  You don't, actually, but you need to build it yourself instead of using their binaries (it's OSS). Friends don't let friends OpenAM though, don't bother with WSO2 either. I'd do everything possible to make this someone else's problem, and if you absolutely have to do it in house then ping's the easiest I've worked with thus far.
  - vittore 10y ago
    Ping being PingFederate?
  - vittore 10y ago
    So chooseing among GLUU and those mentioned above (and OpenAM/WSO2 that you trashed =)) which one you'd go with ?
    - cyberpunk 10y ago
      Given any sort of control on such a project; I'd push as hard as possible to outsource that component and make it someone else's problem and try to stay as far away as possible from the whole show. Making a SSO, even with nice friendly software (hint: none of it is, it's really really complex and easy to fuck up, and the stakes are pretty high) is a horrible, horrible, experience and if you've been through it you'll probably never want to do it again. I've done it twice, perhaps I was just unlucky but it'll take a lot to convince me that the smarter plan isn't just to outsource that whole requirement instead of trying to build it / OSS it in house. It's pretty generic and can be a 'black box' on your arch diagram, your time is probably better spent building business specific things instead... If I was absolutely forced to pick something to run on prem for IDP/Fed/Entitlement, I'd get the pingidentity onsite and have them build it for me (trust me, this will be cheaper than trying to do it yourself even if their day rate makes your eyes bleed). I'd quit before seeing the OpenAM mgt console again.
      - vittore 10y ago
        I got your point. Makes me rethink the whole thing we might otherwise get ourselves into.
- chayesfss 10y ago
  can't leave out mitreid connect http://mitreid-connect.github.io/ http://mitreid-connect.github.io/
- idm_guru 10y ago
  One thing to keep in mind is that Gluu is an IAM platform, not just an OpenID Connect Provider. It's a comprehensive suite that includes both central authentication, authorization, FIDO authentication (and support for many two factor technologies), mobile software, client software. Starting in version 3.0, we will bundle a special version of OpenLDAP, provided by Symas (another great FOSS vendor), specifically optimized for the Gluu Server. An IAM platform is many products integrated together, and operationally scalable to meet mission critical requirements. An OpenID Provider is just one element of an IAM platform!

by vittore 10y ago

Thank you. Keeping those thousands of predefined integrations aside, do you know of any good combination of user-management/access-management/federated-access system beside GLUU?

willow9886 10y ago

ForgeRock has a pretty comprehensive suite of open source IAM software [1] but you have to buy a subscription before you can put it into production. There's also the open source KeyCloak project from RedHat. [2] Also I believe Connect2ID is FOSS. [3] [1] https://www.forgerock.com/ https://www.forgerock.com/ [2] http://www.keycloak.org/ http://www.keycloak.org/ [3] http://connect2id.com/ http://connect2id.com/

cyberpunk 10y ago
You don't, actually, but you need to build it yourself instead of using their binaries (it's OSS). Friends don't let friends OpenAM though, don't bother with WSO2 either. I'd do everything possible to make this someone else's problem, and if you absolutely have to do it in house then ping's the easiest I've worked with thus far.
- vittore 10y ago
  Ping being PingFederate?
- vittore 10y ago
  So chooseing among GLUU and those mentioned above (and OpenAM/WSO2 that you trashed =)) which one you'd go with ?
  - cyberpunk 10y ago
    Given any sort of control on such a project; I'd push as hard as possible to outsource that component and make it someone else's problem and try to stay as far away as possible from the whole show. Making a SSO, even with nice friendly software (hint: none of it is, it's really really complex and easy to fuck up, and the stakes are pretty high) is a horrible, horrible, experience and if you've been through it you'll probably never want to do it again. I've done it twice, perhaps I was just unlucky but it'll take a lot to convince me that the smarter plan isn't just to outsource that whole requirement instead of trying to build it / OSS it in house. It's pretty generic and can be a 'black box' on your arch diagram, your time is probably better spent building business specific things instead... If I was absolutely forced to pick something to run on prem for IDP/Fed/Entitlement, I'd get the pingidentity onsite and have them build it for me (trust me, this will be cheaper than trying to do it yourself even if their day rate makes your eyes bleed). I'd quit before seeing the OpenAM mgt console again.
    - vittore 10y ago
      I got your point. Makes me rethink the whole thing we might otherwise get ourselves into.
chayesfss 10y ago
can't leave out mitreid connect http://mitreid-connect.github.io/ http://mitreid-connect.github.io/
idm_guru 10y ago
One thing to keep in mind is that Gluu is an IAM platform, not just an OpenID Connect Provider. It's a comprehensive suite that includes both central authentication, authorization, FIDO authentication (and support for many two factor technologies), mobile software, client software. Starting in version 3.0, we will bundle a special version of OpenLDAP, provided by Symas (another great FOSS vendor), specifically optimized for the Gluu Server. An IAM platform is many products integrated together, and operationally scalable to meet mission critical requirements. An OpenID Provider is just one element of an IAM platform!