3 ms·

I'd love it even at home but there seem to be no good FOSS IDP systems. I wish.... At work we use PingID which is not very expensive compared to industry stand

I'd love it even at home but there seem to be no good FOSS IDP systems. I wish.... At work we use PingID which is not very expensive compared to industry standard ones like Okta. But it's very poor in my opinion. It seems they're always lagging years behind competitors in terms of features.

spacemanmatt 5y ago
I'm pretty close to deploying Keycloak at home
- GekkePrutser 5y ago
  Thanks also. I had a look about 2 years ago during the big Corona lockdown bore and didn't come across it.
- dmm 5y ago
  I'm thinking about doing the same thing. I just found out about "authenticating proxies", like traefik-forward-auth, and I'm hoping something like that plus keycloak would allow me to easily add 2fa/webauthn support to a couple of applications I host at home. [0] https://github.com/mesosphere/traefik-forward-auth https://github.com/mesosphere/traefik-forward-auth [1] https://brianturchyn.net/traefik-forwardauth-support-with-keycloak/ https://brianturchyn.net/traefik-forwardauth-support-with-ke...
  - spacemanmatt 5y ago
    When I looked around, Keycloak stood out for being a credible enterprise OAUTH2 server with a free edition truly aimed at making me like the product as a user rather than aimed at roping me into eventually purchasing a support contract or buying premium extensions. The most recent version of Keycloak jettisons JBoss in favor of Quarkus and everything about it is roundly better as a result. I'd been running a version from 2018 until this month!
dijit 5y ago
for an iDP there's always Keycloak and Authentik; both incredibly viable. The problem is not the hosting of it; it's that nothing will integrate with your iDP, so you can't use your personal keycloak/traefik instance with, say, your github or gitlab profile. Mozilla Persona was a good idea of handling this[0] but sadly was retired. [0]: https://en.wikipedia.org/wiki/Mozilla_Persona https://en.wikipedia.org/wiki/Mozilla_Persona
- GekkePrutser 5y ago
  Thanks, I didn't know that these existed. I will have a look at them. I don't care about integrating with online services, it's more for my home stuff. I self-host everything of importance anyway. And most external services only integrate with IDPs on their most expensive corporate plans anyway (unless they integrate with Google, Apple or Microsoft consumer accounts which I don't use). Kinda looking for a personal PKI as well (which can overlap a lot with IDP) but I'll see what these can provide. I looked about 2 years ago and didn't come across either of them.
- GekkePrutser 5y ago
  PS: I did look exclusively for stuff that supported full passwordless Fido2 though, and perhaps this didn't at the time.

spacemanmatt 5y ago

I'm pretty close to deploying Keycloak at home

GekkePrutser 5y ago
Thanks also. I had a look about 2 years ago during the big Corona lockdown bore and didn't come across it.
dmm 5y ago
I'm thinking about doing the same thing. I just found out about "authenticating proxies", like traefik-forward-auth, and I'm hoping something like that plus keycloak would allow me to easily add 2fa/webauthn support to a couple of applications I host at home. [0] https://github.com/mesosphere/traefik-forward-auth https://github.com/mesosphere/traefik-forward-auth [1] https://brianturchyn.net/traefik-forwardauth-support-with-keycloak/ https://brianturchyn.net/traefik-forwardauth-support-with-ke...
- spacemanmatt 5y ago
  When I looked around, Keycloak stood out for being a credible enterprise OAUTH2 server with a free edition truly aimed at making me like the product as a user rather than aimed at roping me into eventually purchasing a support contract or buying premium extensions. The most recent version of Keycloak jettisons JBoss in favor of Quarkus and everything about it is roundly better as a result. I'd been running a version from 2018 until this month!

dijit 5y ago

for an iDP there's always Keycloak and Authentik; both incredibly viable. The problem is not the hosting of it; it's that nothing will integrate with your iDP, so you can't use your personal keycloak/traefik instance with, say, your github or gitlab profile. Mozilla Persona was a good idea of handling this[0] but sadly was retired. [0]: https://en.wikipedia.org/wiki/Mozilla_Persona https://en.wikipedia.org/wiki/Mozilla_Persona

GekkePrutser 5y ago
Thanks, I didn't know that these existed. I will have a look at them. I don't care about integrating with online services, it's more for my home stuff. I self-host everything of importance anyway. And most external services only integrate with IDPs on their most expensive corporate plans anyway (unless they integrate with Google, Apple or Microsoft consumer accounts which I don't use). Kinda looking for a personal PKI as well (which can overlap a lot with IDP) but I'll see what these can provide. I looked about 2 years ago and didn't come across either of them.
GekkePrutser 5y ago
PS: I did look exclusively for stuff that supported full passwordless Fido2 though, and perhaps this didn't at the time.