7 ms·

Waiting for "I can build this over a weekend" comment on Hacker News :)

by wenbin 6y ago

manishsharan 6y ago
since you asked for it : https://developers.redhat.com/blog/2017/01/05/spring-boot-and-oauth2-with-keycloak/ https://developers.redhat.com/blog/2017/01/05/spring-boot-an...
- moooo99 6y ago
  Honestly, properly configuring, maintaining and scaling Keycloak is an absolute pain in my experience. Keyclaok does not come close to the ease of use of Okta and Auth0 imho
  - turtlebits 6y ago
    Can you please elaborate on the issues you are seeing? I just got started, but so far my experience setting Keycloak up has been the best I've experienced for an open source project in a while. I was up and running within a few hours- Got a simple JS app working, and was able to secure all my existing services by integrating with my ingress controller.
    - thinkharderdev 6y ago
      Recently moved away from Keycloak (which I think overall is a great piece of software but was just a PITA for our use case) and my observations: * Zero-downtime deployments don't really work. They kinda-sorta do but it was too clunky for us to do it effectively during periods when we had significant traffic. Not generally an issue if you are just using out-of-the-box components but if you are deploying custom components (Storage providers, authenticators, etc) then it doesn't work that well. * It uses an in-memory distributed cache for authentication sessions so if your instance goes down (or you need to shut it down for a major version upgrade) then everyone is logged out. It also seems to have a lot of trouble scaling out to more than ~8 nodes. At the minimum you have to do a lot of tuning of infinispan parameters to get it to work at scale. * Configuration is kind of a pain because it has to be done through the UI. There is a REST API but it is really hard to work with if you want to do something like deploy a change to an authentication flow configuration. So forget about managing your configs in source control (and prepare for the inevitable issues that happen when configs aren't properly updated with deployment because someone fat-fingers something in the configuration UI). * There is a LOT of stuff that is hard-coded in the core Keycloak engine that makes customization impossible short of modifying the actual Keycloak source itself and running your own build (not recommended!). * One small thing that nonetheless drove me crazy is the Keycloak injects a JS snippet into rendered templates to munge the browser history and has no way for you to insert a nonce in the script tag, so setting up CSP headers was way harder than it should have been. All that said, it was more that Keycloak was not the right tool for our use case (an always-on user-facing identity provider) but if you just need a basic login/registration screen and are fine using Keycloak's built-in components (with maybe just some thumbing) then it works great.
      - sirius87 6y ago
        > Configuration is kind of a pain The REST API is pretty sufficient in my experience. Beyond that for realm management, we use ansible modules [1]. [1] https://docs.ansible.com/ansible/latest/collections/community/general/keycloak_client_module.html https://docs.ansible.com/ansible/latest/collections/communit...
- thesimon 6y ago
  Spring Security is really pleasant to work with. Keycloak is also quite nice, but configuration is rather annoying at times. Should be workable.
nailer 6y ago
Honestly, if you're doing AD, SAML, etc - sure go with Auth0. If you want oauth2 + OpenID connect, use a damn library. Auth0 will make it more complicated not less.
andybak 6y ago
I would do but I'm not even sure I understand what any of this does.
akvadrako 6y ago
If somebody would write an Auth0 replacement over the weekend, that would be great. Coincidentally I was looking for a self-hosted auth solution today and I can say there isn't anything that's close to as easy to use as just paying for Auth0. Some decent one's I found where keyclock, glewlwyd and ory, but they where too heavy or complex. I ended up going for caddy-auth-portal, which doesn't even do user management yet.
- mooreds 6y ago
  Would love your feedback on FusionAuth (full disclosure, I work there). Free to download and run (but not open source, if that matters to you): https://fusionauth.io/download/ https://fusionauth.io/download/ I don't know your exact use case but would be happy to chat.
  - runako 6y ago
    Not OP but I wouldn't consider using this because it doesn't say what you said "Free to download and run." The language on the site makes it look like a free trial of some sort.
  - nightski 6y ago
    As indicated by another commenter I found the product messaging/pricing really confusing. There's "Cloud", "Editions", "Reactor" with little way to see how the relate and it's not immediately obvious there is a self hosted version. This turned me off as I just saw $75/month for a development/test version (which isn't really the case). After diving in deeper the pricing calculator really cleared things up, but I think the menu structure and front page messaging could be vastly improved to help guide the user.
  - akvadrako 6y ago
    I might consider something closed source but I find your offering quite confusing. Is the download a standalone auth server? I notice it isn't mentioned on the pricing page so I don't really get it. It would also depend what the minimum RAM requirements are.
  - 6y ago
redis_mlc 6y ago
I talked to one of the founders several years ago. An experienced programmer probably could but: - writing an app doesn't mean it's a business - Okta has thousands of partner integrations, with the development costs borne by the partners. Fun fact: Okta, an auth database company, did not have a DBA until around 200 employees. Then they ran into technical issues and started interviewing for one, but nobody was qualified to do the interviews. (They do have a DBA team now.)
nickysielicki 6y ago
The question isn't whether there's value here. They've got revenue and you can't dispute that. The question is whether they're worth 13x more than a valuation of 500 million dollars.

Waiting for "I can build this over a weekend" comment on Hacker News :)

by wenbin 6y ago

Waiting for "I can build this over a weekend" comment on Hacker News :)

since you asked for it : https://developers.redhat.com/blog/2017/01/05/spring-boot-and-oauth2-with-keycloak/ https://developers.redhat.com/blog/2017/01/05/spring-boot-an...

moooo99 6y ago
Honestly, properly configuring, maintaining and scaling Keycloak is an absolute pain in my experience. Keyclaok does not come close to the ease of use of Okta and Auth0 imho
- turtlebits 6y ago
  Can you please elaborate on the issues you are seeing? I just got started, but so far my experience setting Keycloak up has been the best I've experienced for an open source project in a while. I was up and running within a few hours- Got a simple JS app working, and was able to secure all my existing services by integrating with my ingress controller.
  - thinkharderdev 6y ago
    Recently moved away from Keycloak (which I think overall is a great piece of software but was just a PITA for our use case) and my observations: * Zero-downtime deployments don't really work. They kinda-sorta do but it was too clunky for us to do it effectively during periods when we had significant traffic. Not generally an issue if you are just using out-of-the-box components but if you are deploying custom components (Storage providers, authenticators, etc) then it doesn't work that well. * It uses an in-memory distributed cache for authentication sessions so if your instance goes down (or you need to shut it down for a major version upgrade) then everyone is logged out. It also seems to have a lot of trouble scaling out to more than ~8 nodes. At the minimum you have to do a lot of tuning of infinispan parameters to get it to work at scale. * Configuration is kind of a pain because it has to be done through the UI. There is a REST API but it is really hard to work with if you want to do something like deploy a change to an authentication flow configuration. So forget about managing your configs in source control (and prepare for the inevitable issues that happen when configs aren't properly updated with deployment because someone fat-fingers something in the configuration UI). * There is a LOT of stuff that is hard-coded in the core Keycloak engine that makes customization impossible short of modifying the actual Keycloak source itself and running your own build (not recommended!). * One small thing that nonetheless drove me crazy is the Keycloak injects a JS snippet into rendered templates to munge the browser history and has no way for you to insert a nonce in the script tag, so setting up CSP headers was way harder than it should have been. All that said, it was more that Keycloak was not the right tool for our use case (an always-on user-facing identity provider) but if you just need a basic login/registration screen and are fine using Keycloak's built-in components (with maybe just some thumbing) then it works great.
    - sirius87 6y ago
      > Configuration is kind of a pain The REST API is pretty sufficient in my experience. Beyond that for realm management, we use ansible modules [1]. [1] https://docs.ansible.com/ansible/latest/collections/community/general/keycloak_client_module.html https://docs.ansible.com/ansible/latest/collections/communit...
thesimon 6y ago
Spring Security is really pleasant to work with. Keycloak is also quite nice, but configuration is rather annoying at times. Should be workable.

nailer 6y ago

Honestly, if you're doing AD, SAML, etc - sure go with Auth0. If you want oauth2 + OpenID connect, use a damn library. Auth0 will make it more complicated not less.

andybak 6y ago

I would do but I'm not even sure I understand what any of this does.

akvadrako 6y ago

If somebody would write an Auth0 replacement over the weekend, that would be great. Coincidentally I was looking for a self-hosted auth solution today and I can say there isn't anything that's close to as easy to use as just paying for Auth0. Some decent one's I found where keyclock, glewlwyd and ory, but they where too heavy or complex. I ended up going for caddy-auth-portal, which doesn't even do user management yet.

mooreds 6y ago
Would love your feedback on FusionAuth (full disclosure, I work there). Free to download and run (but not open source, if that matters to you): https://fusionauth.io/download/ https://fusionauth.io/download/ I don't know your exact use case but would be happy to chat.
- runako 6y ago
  Not OP but I wouldn't consider using this because it doesn't say what you said "Free to download and run." The language on the site makes it look like a free trial of some sort.
- nightski 6y ago
  As indicated by another commenter I found the product messaging/pricing really confusing. There's "Cloud", "Editions", "Reactor" with little way to see how the relate and it's not immediately obvious there is a self hosted version. This turned me off as I just saw $75/month for a development/test version (which isn't really the case). After diving in deeper the pricing calculator really cleared things up, but I think the menu structure and front page messaging could be vastly improved to help guide the user.
- akvadrako 6y ago
  I might consider something closed source but I find your offering quite confusing. Is the download a standalone auth server? I notice it isn't mentioned on the pricing page so I don't really get it. It would also depend what the minimum RAM requirements are.
- 6y ago

redis_mlc 6y ago

I talked to one of the founders several years ago. An experienced programmer probably could but: - writing an app doesn't mean it's a business - Okta has thousands of partner integrations, with the development costs borne by the partners. Fun fact: Okta, an auth database company, did not have a DBA until around 200 employees. Then they ran into technical issues and started interviewing for one, but nobody was qualified to do the interviews. (They do have a DBA team now.)

nickysielicki 6y ago

The question isn't whether there's value here. They've got revenue and you can't dispute that. The question is whether they're worth 13x more than a valuation of 500 million dollars.