4 ms·
as the resident keeper of the keycloak (aka RedHat SSO) which can and does do both SAML and OIDC (what google uses) in our organization I only sort of agree. SA
by sascha_sl 7y ago
as the resident keeper of the keycloak (aka RedHat SSO) which can and does do both SAML and OIDC (what google uses) in our organization I only sort of agree. SAML is overcomplicated, but OIDC also has a lot of bloat, although it's more optional there. It's just trying to solve too many problems for too many parties at once. Back and front channel logout, your choice of symmetric or asymmetric crypto, at least 3 types of different tokens, and 3 ways to get subsets of them with various subtypes, depending on if you're a client application, a web application that can redirect, a web application that can't redirect, an app on a TV... Oh, and did I tell you about the authorization framework? With assessment servers? There's that too!
Thankfully in the real world both seem to be implemented in the absolute minimal way to get things working.
- Edmond 7y agoCheers for keycloak, title pun intended :) We use it for Solvent (https://codesolvent.com https://codesolvent.com) login to product instances and it works excellently.
- i_haz_rabies 7y agoHow have you guys solved "from scratch" configuration for keycloak? I've worked with it a bit over the years and I've never found a way to get it into a state I want programmatically without hacky bash scripts and modifying the json templates.
- Edmond 7y agoMaybe we got lucky with the configuration but we use the approach documented for the keycloak-saml-adapter with Jetty as the app server. There is still a lot work done to ensure keys are generated in the proper locations and that necessary product id values (corresponds to SAML SP entityID) are generated. In short, it is not a simple plug-n-play, lots of hacking to get the result we needed but the adapter itself does what it needs to do.
- sascha_sl 7y agobelieve it or not, but we do FROM jboss/keycloak:9.0.0, add a theme jar, throw it on k8s with 2 pods and a postgres behind it and that's it. Our clients are mostly SAML SaaS software and our own implementation of gatekeeper (which is also a kubernetes ingress) with short lifetime OIDC ID tokens, long lifetime refresh tokens and seamless background refreshing.