4 ms·
HUGE fan of Keycloak! It's an outstanding IAM platform. AuthN/AuthZ? Great! SAML? OIDC? Awesome! Token translation??? (SAML->JWT) Incredible! It's reall
by pharaohgeek 6y ago
HUGE fan of Keycloak! It's an outstanding IAM platform. AuthN/AuthZ? Great! SAML? OIDC? Awesome! Token translation??? (SAML->JWT) Incredible! It's really a delight to work with. If I had one item on my wishlist it would be support for non-SQL datastores. It hums along on our PostgreSQL instance with no problem. We'd love to be able to easily geolocate it as part of our AWS infrastructure using global DynamoDB tables for data storage. That would greatly improve the login experience for our users as they are located all over the world.
- snuxoll 6y agoIdentity solutions cannot tolerate eventual consistency, if a user changes their password it MUST be replicated everywhere immediately, if an offline token is revoked it MUST stop working everywhere. DynamoDB is not an appropriate tool for the job here. That said, Keycloak supports Galera clustering and the Infinispan cache can be configured to work in a multi-DC environment - so there's nothing stopping you from Geo-replicating the setup.