2 ms·

Would you mind comparing Vault to Keycloak? https://www.keycloak.org/ https://www.keycloak.org/ I need an equivalent to Windows' Active Directory in Linux wor

Would you mind comparing Vault to Keycloak? https://www.keycloak.org/ https://www.keycloak.org/ I need an equivalent to Windows' Active Directory in Linux world that ideally can also federate with/masquerade as AD. Can Vault be such thing?

dharmab 7y ago
Vault and Keycloak serve entirely separate use cases. Vault is for storing secrets (passwords, API keys, keypairs and the like). If you can use public cloud, have you considered Azure Active Directory? We're a Linux shop using it very successfully for on-prem and cloud systems.
- polskibus 7y ago
  I need a self sufficient component, that can be deployed on prem alongside other components, without public cloud dependency.
  - nisa 7y ago
    keycloak is pretty nice for that. You can just drop some docker-compose somewhere (or k8s) or plain wildfly/tomcat and you have saml idp + oauth2 (openid connect) out of the box including ui and self-service for users - it's also completly themeable (that's what I'm doing at the moment for a project)... you don't even need a ldap/ad in the background but you can connect to one. however it's strictly for authentication and authorization - basically users + roles vault is different usecase but can probably be connected.
jsiepkes 7y ago
> I need an equivalent to Windows' Active Directory in Linux world that ideally can also federate with/masquerade as AD. Can Vault be such thing? Vault is not such a thing. AD is basically LDAP + Kerberos. Neither Vault nor Keycloak can fill that role. You would need Samba 4 setup as a domain controller [1] for that. If you need AD but for Linux desktops you could take a look at FreeIPA [2]. If your feeling brave you can combine an LDAP server (like Wren:DS, 389 or OpenLDAP) with a Kerberos implementation like MIT Kerberos and create an AD like experience yourself. Though I would not recommend that. [1] https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Acti... [2] https://www.freeipa.org/ https://www.freeipa.org/
yrro 6y ago
You might find FreeIPA useful. Its CA component (dogtag) has a KRA component that FreeIPA exposes as 'vaults' for secret storage. You can even do cross-forest trust to AD, log into your Linux systems as users who live in AD...

dharmab 7y ago

Vault and Keycloak serve entirely separate use cases. Vault is for storing secrets (passwords, API keys, keypairs and the like). If you can use public cloud, have you considered Azure Active Directory? We're a Linux shop using it very successfully for on-prem and cloud systems.

polskibus 7y ago
I need a self sufficient component, that can be deployed on prem alongside other components, without public cloud dependency.
- nisa 7y ago
  keycloak is pretty nice for that. You can just drop some docker-compose somewhere (or k8s) or plain wildfly/tomcat and you have saml idp + oauth2 (openid connect) out of the box including ui and self-service for users - it's also completly themeable (that's what I'm doing at the moment for a project)... you don't even need a ldap/ad in the background but you can connect to one. however it's strictly for authentication and authorization - basically users + roles vault is different usecase but can probably be connected.

jsiepkes 7y ago

> I need an equivalent to Windows' Active Directory in Linux world that ideally can also federate with/masquerade as AD. Can Vault be such thing? Vault is not such a thing. AD is basically LDAP + Kerberos. Neither Vault nor Keycloak can fill that role. You would need Samba 4 setup as a domain controller [1] for that. If you need AD but for Linux desktops you could take a look at FreeIPA [2]. If your feeling brave you can combine an LDAP server (like Wren:DS, 389 or OpenLDAP) with a Kerberos implementation like MIT Kerberos and create an AD like experience yourself. Though I would not recommend that. [1] https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Acti... [2] https://www.freeipa.org/ https://www.freeipa.org/

yrro 6y ago

You might find FreeIPA useful. Its CA component (dogtag) has a KRA component that FreeIPA exposes as 'vaults' for secret storage. You can even do cross-forest trust to AD, log into your Linux systems as users who live in AD...