4 ms·

Keycloak has nearly all of this built in. You don’t need to be a crack sysadmin to set it up. If all you need is a 2FA-enabled OIDC endpoint federating to AD/LD

Keycloak has nearly all of this built in. You don’t need to be a crack sysadmin to set it up. If all you need is a 2FA-enabled OIDC endpoint federating to AD/LDAP to serve as SSO you can be up and running quite quickly. [1] 2FA/Time based OTP: https://www.keycloak.org/docs/12.0/server_admin/keycloak-images/otp-policy.png https://www.keycloak.org/docs/12.0/server_admin/keycloak-ima... [2] LDAP/AD (Kerberos) https://dmc.datical.com/z_resources/images/assets/screenshots/administer/keycloak-ldap.png https://dmc.datical.com/z_resources/images/assets/screenshot... [3] SCIM (third party) https://github.com/Captain-P-Goldfish/scim-for-keycloak https://github.com/Captain-P-Goldfish/scim-for-keycloak

paranoidrobot 5y ago
Re SCIM: That plugin is adding a SCIM provider to Keycloak. i.e provisioning/managing users in KeyCloak Most of the time I'm talking about SCIM outbound, so provisioning/managing users in some other random service (like Trello, Github, whatever). That's the major value-add for Okta.
- matt123456789 5y ago
  I see. Thank you for clarifying. Here’s the author of the Keycloak SCIM plugin on that functionality: https://stackoverflow.com/questions/58566587/does-keycloak-support-scim#comment124235777_61884365 https://stackoverflow.com/questions/58566587/does-keycloak-s... So will likely require some changes to Keycloak internals in order to address that reliability issue, which will enable building a reliable interface for your use case.