4 ms·

I know it doesn't cover everything Auth0 and Okta presumably provide, but Keycloak is OSS and has RedHat support, and is honestly one of the best IDPs I've ever

I know it doesn't cover everything Auth0 and Okta presumably provide, but Keycloak is OSS and has RedHat support, and is honestly one of the best IDPs I've ever used in terms of capabilities and friendliness. I know there's also the ory suite in the more cloud-native/recent space, though I can't personally speak to its maturity. Maybe I'm biased by the large bank I currently work at, but in general, it seems like IAM is the last thing we really want outsourced/closed source and monocultured. If they lose the motivation to stay ahead of the competition, and stop responding to vulnerabilities as quickly as they ought to, it's not just their company that loses.

octopoc 6y ago
I’ve started using KeyCloak by default for my personal projects. Once you know how to integrate it and configure it, you never have to worry about users or roles again. I haven’t used the groups feature yet but I’m optimistic considering how easy Keycloak is to configure. Overall it’s a great tool to have in your tool belt.
- andrewstuart2 6y ago
  There's just so much value in the fact that I can run it locally, deploy it wherever, play with it and learn it for free and even feel safe enough to expose it publicly due to its maturity and backing. As long as I stick with the standards (remind yourself and your users "you build OpenID Connect clients, not 'keycloak' clients," I can even (easily) move somewhere else if I want, and now I understand Oauth2/OIDC better and probably have a much more scalable authn/z system in place thanks to the way federated authn asks you to design your (fine-grained) authz.
- wp381640 6y ago
  Lack of webauthn might be a stopper for some, but it's in the pipeline: https://github.com/keycloak/keycloak-community/blob/master/design/web-authn-two-factor.md https://github.com/keycloak/keycloak-community/blob/master/d...
  - p_l 6y ago
    Huh, I'm pretty sure it's present by default (not behind a flag) in current versions of Keycloak - would have liked to use it but our setup is so heavily firewalled tokens wouldn't make it over ;)
    - wp381640 6y ago
      I'm going to check it out again today because last eval I did with this requirement was ~10 months ago
      - octopoc 6y ago
        Yeah there’s a tab for it in the latest docker images, although I’ve never configured it
        wp381640 6y ago
        It's there! Awesome. Thank you.
        p_l 6y ago
        Please make a write up about using it - my current use of keycloak doesn't fit webauthn (clients access it from virtual workstations that don't have usb access) but I'd like to incorporate it further in my toolbox for future projects
        wp381640 6y ago
        I may do just that and add it to the docs - thanks for the tip

octopoc 6y ago

I’ve started using KeyCloak by default for my personal projects. Once you know how to integrate it and configure it, you never have to worry about users or roles again. I haven’t used the groups feature yet but I’m optimistic considering how easy Keycloak is to configure. Overall it’s a great tool to have in your tool belt.

andrewstuart2 6y ago
There's just so much value in the fact that I can run it locally, deploy it wherever, play with it and learn it for free and even feel safe enough to expose it publicly due to its maturity and backing. As long as I stick with the standards (remind yourself and your users "you build OpenID Connect clients, not 'keycloak' clients," I can even (easily) move somewhere else if I want, and now I understand Oauth2/OIDC better and probably have a much more scalable authn/z system in place thanks to the way federated authn asks you to design your (fine-grained) authz.
wp381640 6y ago
Lack of webauthn might be a stopper for some, but it's in the pipeline: https://github.com/keycloak/keycloak-community/blob/master/design/web-authn-two-factor.md https://github.com/keycloak/keycloak-community/blob/master/d...
- p_l 6y ago
  Huh, I'm pretty sure it's present by default (not behind a flag) in current versions of Keycloak - would have liked to use it but our setup is so heavily firewalled tokens wouldn't make it over ;)
  - wp381640 6y ago
    I'm going to check it out again today because last eval I did with this requirement was ~10 months ago
    - octopoc 6y ago
      Yeah there’s a tab for it in the latest docker images, although I’ve never configured it
      - wp381640 6y ago
        It's there! Awesome. Thank you.
        p_l 6y ago
        Please make a write up about using it - my current use of keycloak doesn't fit webauthn (clients access it from virtual workstations that don't have usb access) but I'd like to incorporate it further in my toolbox for future projects
        wp381640 6y ago
        I may do just that and add it to the docs - thanks for the tip