4 ms·

If somebody would write an Auth0 replacement over the weekend, that would be great. Coincidentally I was looking for a self-hosted auth solution today and I ca

If somebody would write an Auth0 replacement over the weekend, that would be great. Coincidentally I was looking for a self-hosted auth solution today and I can say there isn't anything that's close to as easy to use as just paying for Auth0. Some decent one's I found where keyclock, glewlwyd and ory, but they where too heavy or complex. I ended up going for caddy-auth-portal, which doesn't even do user management yet.

mooreds 6y ago
Would love your feedback on FusionAuth (full disclosure, I work there). Free to download and run (but not open source, if that matters to you): https://fusionauth.io/download/ https://fusionauth.io/download/ I don't know your exact use case but would be happy to chat.
- runako 6y ago
  Not OP but I wouldn't consider using this because it doesn't say what you said "Free to download and run." The language on the site makes it look like a free trial of some sort.
- nightski 6y ago
  As indicated by another commenter I found the product messaging/pricing really confusing. There's "Cloud", "Editions", "Reactor" with little way to see how the relate and it's not immediately obvious there is a self hosted version. This turned me off as I just saw $75/month for a development/test version (which isn't really the case). After diving in deeper the pricing calculator really cleared things up, but I think the menu structure and front page messaging could be vastly improved to help guide the user.
- akvadrako 6y ago
  I might consider something closed source but I find your offering quite confusing. Is the download a standalone auth server? I notice it isn't mentioned on the pricing page so I don't really get it. It would also depend what the minimum RAM requirements are.
- mooreds 6y ago
  Thanks everyone for the feedback about the muddy message. I'll see what I can do to clear it up, now and later on the website. If you want the basic community edition (you can see the features here: https://fusionauth.io/pricing/editions/ https://fusionauth.io/pricing/editions/ by expanding the 'Full Feature Breakdown' table) and want to self host, you can download this free as in beer standalone executable: https://fusionauth.io/download/ https://fusionauth.io/download/ If you want us to host the basic community edition for you, you can purchase a single tenant instance managed by us: https://fusionauth.io/pricing/cloud/ https://fusionauth.io/pricing/cloud/ If you want premium features (LDAP connectivity, breached password detection, and others), you can buy a paid edition; some of these include support: https://fusionauth.io/pricing/editions/ https://fusionauth.io/pricing/editions/ If you want us to host for you and you need the premium edition, you can buy both a license. Additionally, for some uses (if you resell FusionAuth to your customers, for instance) you will need to talk to us: https://fusionauth.io/license-faq/ https://fusionauth.io/license-faq/ Wow, writing that makes it clear to me how unclear that is. I'll see if we can't simplify or make this clearer. Thanks again for your feedback!
  - akvadrako 6y ago
    That does clarify things. To be honest I thought "Editions" was a product alongside "Cloud". So Fusionauth looks pretty good - it does a lot more than I need. Though the lack of a "public path" setting is the first roadblock: https://github.com/FusionAuth/fusionauth-issues/issues/88 https://github.com/FusionAuth/fusionauth-issues/issues/88
    - mooreds 6y ago
      There are some workarounds in that thread, but please do comment with your use case and/or vote for the issue with a thumbs up. However, if FusionAuth does a lot more than you need, it may not be the right solution for you. :) Right tool for the job and all that.
AlbinoDrought 6y ago
We're using Ory Hydra and a modified version of Ory Oathkeeper in production, but our usecase might be a bit different (we already had a user database and auth system). Compared to implementing them from scratch, setup was simple and the end product is fantastic. We're looking at migrating to Ory Kratos eventually. It seems to offer the things we would've wanted from Auth0, but selfhosted. Granted, you're right - I'm sure it's much more complex to selfhost Kratos than to pay for Auth0.
- alexeldeib 6y ago
  How mature do you feel the Ory ecosystem is? Any major speedbumps?
  - sebmellen 6y ago
    Would love to know as well. Considering a switch from Cognito here.
  - thinkharderdev 6y ago
    We are using Ory Hydra now (but not any of the other components like Kratos, Oathkeeper, etc) and no real complaints so far. It is important to understand though the Hydra is just a component and not an out-of-the-box solution. You still have to implement your own user interface is you plan on doing OIDC login (and not just client_credentials for service authentication). Basically Hydra just takes a self-hosted login/registration/etc UI which you build yourself and wraps it in an OIDC provider. Which is great if you need to build an OIDC provider and want tight control over the user experience and user management (our use case) but don't want to implement all the fussy details of the OAuth2 protocol.
  - AlbinoDrought 6y ago
    Hydra feels mature. I think it's their longest-developed product so far. Besides breaking changes during big upgrades(v0 -> v1beta -> v1), everything has been painless: - It runs anywhere with or without containers - API makes sense, good SDKs are available in all my used languages - RAM usage is surprisingly low compared to usage and has been great for resource-constrained environments - Stateless means horizontal scaling is as easy as `replicas++` - Sub-millisecond response times for some calls, much faster than our previous setup With Hydra, I know it's the client's fault when OAuth calls fail and not just a buggy server implementation. This is reinforced in dev mode with great errors like: - The authorization code has already been used - The request is missing the response_type parameter - Parameter "nonce" must be set when using the implicit flow - Redirect URL "https://example.com/callback https://example.com/callback" does not match On the flipside, Oathkeeper is not a mature product and has not yet reached v1. There are breaking changes planned [1]. It lacks support for at least one popular usecase (mine) out of the box [2]. Rules can be hard to create and debug. I wouldn't recommend Oathkeeper in its current state unless you're ready to dive in and fix things yourself. Once configured it sticks with the Ory trend: fast, lean, and stable. Depending on your usecase, Oathkeeper could be swapped out with any IAP like Pomerium or just with your reverse proxy's auth request support + some small custom shim. I haven't tried Keto (access control) or Kratos (user management) yet. Kratos is on my todo list. [1] https://github.com/ory/oathkeeper/issues/441 https://github.com/ory/oathkeeper/issues/441 [2] https://github.com/ory/oathkeeper/issues/521 https://github.com/ory/oathkeeper/issues/521
advaitruia 6y ago
What do you think about Supertokens.io? Granted its not as mature but its open source, easy to implement (decouples features based on your use case), really customizable frontend UI and great support (ping me anytime!)
sirius87 6y ago
Keycloak has been solid for us. The last major version upgrade wasn't super smooth, but I'm glad it exists so I don't have to think about auth any more.
kiwicopple 6y ago
Check out Netlify’s GoTrue server. It’s what we use at Supabase, after trying out almost all the others listed in this thread. It’s the most simple self-hosted solution IMO

mooreds 6y ago

Would love your feedback on FusionAuth (full disclosure, I work there). Free to download and run (but not open source, if that matters to you): https://fusionauth.io/download/ https://fusionauth.io/download/ I don't know your exact use case but would be happy to chat.

runako 6y ago
Not OP but I wouldn't consider using this because it doesn't say what you said "Free to download and run." The language on the site makes it look like a free trial of some sort.
nightski 6y ago
As indicated by another commenter I found the product messaging/pricing really confusing. There's "Cloud", "Editions", "Reactor" with little way to see how the relate and it's not immediately obvious there is a self hosted version. This turned me off as I just saw $75/month for a development/test version (which isn't really the case). After diving in deeper the pricing calculator really cleared things up, but I think the menu structure and front page messaging could be vastly improved to help guide the user.
akvadrako 6y ago
I might consider something closed source but I find your offering quite confusing. Is the download a standalone auth server? I notice it isn't mentioned on the pricing page so I don't really get it. It would also depend what the minimum RAM requirements are.
mooreds 6y ago
Thanks everyone for the feedback about the muddy message. I'll see what I can do to clear it up, now and later on the website. If you want the basic community edition (you can see the features here: https://fusionauth.io/pricing/editions/ https://fusionauth.io/pricing/editions/ by expanding the 'Full Feature Breakdown' table) and want to self host, you can download this free as in beer standalone executable: https://fusionauth.io/download/ https://fusionauth.io/download/ If you want us to host the basic community edition for you, you can purchase a single tenant instance managed by us: https://fusionauth.io/pricing/cloud/ https://fusionauth.io/pricing/cloud/ If you want premium features (LDAP connectivity, breached password detection, and others), you can buy a paid edition; some of these include support: https://fusionauth.io/pricing/editions/ https://fusionauth.io/pricing/editions/ If you want us to host for you and you need the premium edition, you can buy both a license. Additionally, for some uses (if you resell FusionAuth to your customers, for instance) you will need to talk to us: https://fusionauth.io/license-faq/ https://fusionauth.io/license-faq/ Wow, writing that makes it clear to me how unclear that is. I'll see if we can't simplify or make this clearer. Thanks again for your feedback!
- akvadrako 6y ago
  That does clarify things. To be honest I thought "Editions" was a product alongside "Cloud". So Fusionauth looks pretty good - it does a lot more than I need. Though the lack of a "public path" setting is the first roadblock: https://github.com/FusionAuth/fusionauth-issues/issues/88 https://github.com/FusionAuth/fusionauth-issues/issues/88
  - mooreds 6y ago
    There are some workarounds in that thread, but please do comment with your use case and/or vote for the issue with a thumbs up. However, if FusionAuth does a lot more than you need, it may not be the right solution for you. :) Right tool for the job and all that.

AlbinoDrought 6y ago

We're using Ory Hydra and a modified version of Ory Oathkeeper in production, but our usecase might be a bit different (we already had a user database and auth system). Compared to implementing them from scratch, setup was simple and the end product is fantastic. We're looking at migrating to Ory Kratos eventually. It seems to offer the things we would've wanted from Auth0, but selfhosted. Granted, you're right - I'm sure it's much more complex to selfhost Kratos than to pay for Auth0.

alexeldeib 6y ago
How mature do you feel the Ory ecosystem is? Any major speedbumps?
- sebmellen 6y ago
  Would love to know as well. Considering a switch from Cognito here.
- thinkharderdev 6y ago
  We are using Ory Hydra now (but not any of the other components like Kratos, Oathkeeper, etc) and no real complaints so far. It is important to understand though the Hydra is just a component and not an out-of-the-box solution. You still have to implement your own user interface is you plan on doing OIDC login (and not just client_credentials for service authentication). Basically Hydra just takes a self-hosted login/registration/etc UI which you build yourself and wraps it in an OIDC provider. Which is great if you need to build an OIDC provider and want tight control over the user experience and user management (our use case) but don't want to implement all the fussy details of the OAuth2 protocol.
- AlbinoDrought 6y ago
  Hydra feels mature. I think it's their longest-developed product so far. Besides breaking changes during big upgrades(v0 -> v1beta -> v1), everything has been painless: - It runs anywhere with or without containers - API makes sense, good SDKs are available in all my used languages - RAM usage is surprisingly low compared to usage and has been great for resource-constrained environments - Stateless means horizontal scaling is as easy as `replicas++` - Sub-millisecond response times for some calls, much faster than our previous setup With Hydra, I know it's the client's fault when OAuth calls fail and not just a buggy server implementation. This is reinforced in dev mode with great errors like: - The authorization code has already been used - The request is missing the response_type parameter - Parameter "nonce" must be set when using the implicit flow - Redirect URL "https://example.com/callback https://example.com/callback" does not match On the flipside, Oathkeeper is not a mature product and has not yet reached v1. There are breaking changes planned [1]. It lacks support for at least one popular usecase (mine) out of the box [2]. Rules can be hard to create and debug. I wouldn't recommend Oathkeeper in its current state unless you're ready to dive in and fix things yourself. Once configured it sticks with the Ory trend: fast, lean, and stable. Depending on your usecase, Oathkeeper could be swapped out with any IAP like Pomerium or just with your reverse proxy's auth request support + some small custom shim. I haven't tried Keto (access control) or Kratos (user management) yet. Kratos is on my todo list. [1] https://github.com/ory/oathkeeper/issues/441 https://github.com/ory/oathkeeper/issues/441 [2] https://github.com/ory/oathkeeper/issues/521 https://github.com/ory/oathkeeper/issues/521

advaitruia 6y ago

What do you think about Supertokens.io? Granted its not as mature but its open source, easy to implement (decouples features based on your use case), really customizable frontend UI and great support (ping me anytime!)

sirius87 6y ago

Keycloak has been solid for us. The last major version upgrade wasn't super smooth, but I'm glad it exists so I don't have to think about auth any more.

kiwicopple 6y ago

Check out Netlify’s GoTrue server. It’s what we use at Supabase, after trying out almost all the others listed in this thread. It’s the most simple self-hosted solution IMO