4 ms·

I’ve started using KeyCloak by default for my personal projects. Once you know how to integrate it and configure it, you never have to worry about users or role

I’ve started using KeyCloak by default for my personal projects. Once you know how to integrate it and configure it, you never have to worry about users or roles again. I haven’t used the groups feature yet but I’m optimistic considering how easy Keycloak is to configure. Overall it’s a great tool to have in your tool belt.

andrewstuart2 6y ago
There's just so much value in the fact that I can run it locally, deploy it wherever, play with it and learn it for free and even feel safe enough to expose it publicly due to its maturity and backing. As long as I stick with the standards (remind yourself and your users "you build OpenID Connect clients, not 'keycloak' clients," I can even (easily) move somewhere else if I want, and now I understand Oauth2/OIDC better and probably have a much more scalable authn/z system in place thanks to the way federated authn asks you to design your (fine-grained) authz.
wp381640 6y ago
Lack of webauthn might be a stopper for some, but it's in the pipeline: https://github.com/keycloak/keycloak-community/blob/master/design/web-authn-two-factor.md https://github.com/keycloak/keycloak-community/blob/master/d...
- p_l 6y ago
  Huh, I'm pretty sure it's present by default (not behind a flag) in current versions of Keycloak - would have liked to use it but our setup is so heavily firewalled tokens wouldn't make it over ;)
  - wp381640 6y ago
    I'm going to check it out again today because last eval I did with this requirement was ~10 months ago
    - octopoc 6y ago
      Yeah there’s a tab for it in the latest docker images, although I’ve never configured it
      - wp381640 6y ago
        It's there! Awesome. Thank you.
        p_l 6y ago
        Please make a write up about using it - my current use of keycloak doesn't fit webauthn (clients access it from virtual workstations that don't have usb access) but I'd like to incorporate it further in my toolbox for future projects
        wp381640 6y ago
        I may do just that and add it to the docs - thanks for the tip

andrewstuart2 6y ago

There's just so much value in the fact that I can run it locally, deploy it wherever, play with it and learn it for free and even feel safe enough to expose it publicly due to its maturity and backing. As long as I stick with the standards (remind yourself and your users "you build OpenID Connect clients, not 'keycloak' clients," I can even (easily) move somewhere else if I want, and now I understand Oauth2/OIDC better and probably have a much more scalable authn/z system in place thanks to the way federated authn asks you to design your (fine-grained) authz.

wp381640 6y ago

Lack of webauthn might be a stopper for some, but it's in the pipeline: https://github.com/keycloak/keycloak-community/blob/master/design/web-authn-two-factor.md https://github.com/keycloak/keycloak-community/blob/master/d...

p_l 6y ago
Huh, I'm pretty sure it's present by default (not behind a flag) in current versions of Keycloak - would have liked to use it but our setup is so heavily firewalled tokens wouldn't make it over ;)
- wp381640 6y ago
  I'm going to check it out again today because last eval I did with this requirement was ~10 months ago
  - octopoc 6y ago
    Yeah there’s a tab for it in the latest docker images, although I’ve never configured it
    - wp381640 6y ago
      It's there! Awesome. Thank you.
      - p_l 6y ago
        Please make a write up about using it - my current use of keycloak doesn't fit webauthn (clients access it from virtual workstations that don't have usb access) but I'd like to incorporate it further in my toolbox for future projects
        wp381640 6y ago
        I may do just that and add it to the docs - thanks for the tip