7 ms·

I've had a very positive experience with Keycloak and given its low barrier to deploy I don't really get why Auth as a service exists. I've seen more install/s

I've had a very positive experience with Keycloak and given its low barrier to deploy I don't really get why Auth as a service exists. I've seen more install/setup magic invoked just getting vscode configured. (slightly tongue in cheek). Mind you, data residence and provenance may be more important in the use cases/applications I'm familiar with. Then again, it is good to see a healthy standards based Authn/z ecosystem - good luck to all. EDIT: After reviewing the site closer I'm not seeing anything about standards compliance.

fuzzy2 5y ago
I’d argue that Keycloak is also Auth as a Service. Even if you may be hosting that service yourself. If you only have a single web application (yes, that still exists) you don't need any of this. Use your backend framework's "native" auth package and you're good to go.
blue_cookeh 5y ago
Working for $veryBigOrg passing all the compliance stuff off to Auth0/Okta/whoever is a big plus. Besides, they'll probably do better securing and auditing their user databases than we ever could.
- mosdl 5y ago
  Even working for small/medium org it's nice to outsource compliance. Plus they have robot detection, mfa, captcha, etc out if the box.
  - p_l 5y ago
    Until part of the compliance is "no external services" :3
okhuman 5y ago
What are your thoughts on something like this: https://github.com/authcompanion/authcompanion https://github.com/authcompanion/authcompanion
- latchkey 5y ago
  No 2FA?
AllModules 5y ago
> I'm not seeing anything about standards compliance Thanks! We'll make a section to highlight them. We use the JWT standard (not sure if that is what you mean?), Oauth 2.0, SAML, etc... there are lots of standards in this space
- dljsjr 5y ago
  I believe that they actually meant more like NIST/FIPS compliance type stuff so that big orgs that have to meet certain certifications will know if they can use your product or not. EDIT: for example: https://auth0.com/security https://auth0.com/security. SOC 2 is a big one.

fuzzy2 5y ago

I’d argue that Keycloak is also Auth as a Service. Even if you may be hosting that service yourself. If you only have a single web application (yes, that still exists) you don't need any of this. Use your backend framework's "native" auth package and you're good to go.

blue_cookeh 5y ago

Working for $veryBigOrg passing all the compliance stuff off to Auth0/Okta/whoever is a big plus. Besides, they'll probably do better securing and auditing their user databases than we ever could.

mosdl 5y ago
Even working for small/medium org it's nice to outsource compliance. Plus they have robot detection, mfa, captcha, etc out if the box.
- p_l 5y ago
  Until part of the compliance is "no external services" :3

okhuman 5y ago

What are your thoughts on something like this: https://github.com/authcompanion/authcompanion https://github.com/authcompanion/authcompanion

latchkey 5y ago
No 2FA?

AllModules 5y ago

> I'm not seeing anything about standards compliance Thanks! We'll make a section to highlight them. We use the JWT standard (not sure if that is what you mean?), Oauth 2.0, SAML, etc... there are lots of standards in this space

dljsjr 5y ago
I believe that they actually meant more like NIST/FIPS compliance type stuff so that big orgs that have to meet certain certifications will know if they can use your product or not. EDIT: for example: https://auth0.com/security https://auth0.com/security. SOC 2 is a big one.