19 ms·

Keycloak: Open-Source Identity and Access Management

388 points by memorable 5y ago

cbsmith 5y ago
Odd name... no relation to KeyWhiz? https://square.github.io/keywhiz/ https://square.github.io/keywhiz/
psankar 5y ago
We tried using keycloak in a startup where I worked. It needed a loooooooot of memory and was very slow to start. It probably needed some JVM tuning, but we were just deploying as a stateful set (for the postgres). The docker images were also huge. We had to use another FOSS project called Gatekeeper as an authentication software along with keycloak, which got obsoleted and replaced with a different project (lukedo proxy or some such). The community support was also relatively not that active like other FOSS project that we used (for other areas of the stack). Overall, the experience was not so great that we decided to ditch both keycloak and gatekeeper. This was about a couple of years back. Not sure what the current status is. Some other alternatives that we wanted to try were from the Ory project (Kratos etc.) But we just went with some proprietary AUTH solution in our startup.
- Datagenerator 5y ago
  Which?
- sz4kerto 5y ago
  Keycloak is now running on Quarkus, so startup times are much faster (few seconds). But -- KC is not something you start up often (in production). It's reliable, flexible and actively developed, so not a bad choice as a self-hosted IAM solution.
  - vetinari 5y ago
    With Quarkus, they went into other extreme -- if you are using docker, to get as fast startup as possible, you have to build your image with your configuration/modules used baked in. Overall, I'm pretty satisfied. There are some bumps, but they are not Keycloak fault (having two different keytabs for two different host names for two different container images sharing same IP and reverse name not matching is kind of difficult).
    - pharmakom 5y ago
      There is an auto-build option so building a custom Docker image is an optimisation.
- nird 5y ago
  We have been using it for 6-7 years now. Have been able to run very stable and integrated a lot of external IdP's to offer proper SSO on mulitple of our software stacks. Added a lot of other open source pieces of software we run for our backoffice needs (hashi vault, adminbro, etc.). So far very happy with it. Running in clustered mode without issues and as such little issues with the startup times. It probably helps that we have a solid background in Java based development and deployment and are less worried about the amount of memory it uses for the full suite.
  - lifeisstillgood 5y ago
    This fascinated me - where and how does this fit into other identity providers (and thence into SSO). I kind of yearn for client certificates everywhere simply because I can grok how that remains secure as we pass through layer after layer. the rest I just worry about
    - bayesian_horse 5y ago
      keycloak can broker between identity providers. It can use social logins as identity providers, connect to ldap, kerberos and others for user federation, and then provide SAML and OpenIDC to other applications.
      - nird 5y ago
        Exactly this. OIDC and SAML integrations with customers IdP's. Map identity metadata from the customer into our realm so they can provide data in any way they want and we map it down to our standard which allows our applications to stay clean when using this metadata for business logic. We have also added an event plugin to keycloak to push login events to a queue for other services to consume. We also offer local keycloak identities in case a customer does not or can not provide their own identities, and have added haveibeenpwnd logic to check password strength/reuse for these local keycloak identities.
      - paulmd 5y ago
        As someone who has superficially looked into it a couple times and gotten pushed away by the complexity: what do you recommend for a backend? Is there another container that provides an LDAP service I could use? Or Kerberos? I am rebuilding my homelab soon and I am interested in having centralized auth across all systems and as many applications as feasible, using my centralized fileserver as an IDP source via some application or another, as well as using Keycloak for some one-off projects where I don't really want to write a user layer.
- RandomBK 5y ago
  In my experience, Keycloak is best treated as a "pet" in the "pet v.s. cattle" spectrum. It takes a while to warm up, so you don't want to be constantly restarting it. I deployed it out-of-sync with the main application deployments. As an open source option, it's quite powerful and full-featured. It's also quite configurable. If I had one feature ask, it's that it doesn't play well with infrastructure-as-code ideas. While you can load a new realm from a JSON, it's harder to keep changes synced after that.
base698 5y ago
Recently been using it and have been happy with it. Being able to plug some of our existing providers in and have one solution to integrate with has been the big win.
maxbaines 5y ago
Using Keycloak for all authentication both in the cloud under Linux and within Windows Enterprise Environments. Use it for SSO for Node-RED, Grafana, Aspnet & VueJS apps. Was fairly easy to move from Auth0.
xupybd 5y ago
I've been investigating an authorization application to use with the SAFE stack. I'm testing Keycloak and it looks good so far.
- pharmakom 5y ago
  Similar scenario here. Drop me a comment if you want to share anything learned.
pharmakom 5y ago
My biggest complaint with Keycloak is that the documentation is poor. You will need to set various flags to fit your use-case. Lots of googling and SO to get things running. Some of the options have changed since 17.x so many guides are outdated.
- sascha_sl 5y ago
  This was definitely true for the Wildfly/JBoss version, but on Quarkus configuring Keycloak is mostly trivial now[1]. The only options I had to set outside environment variables in production are related to Infinispan discovery. [1]: https://www.keycloak.org/server/all-config https://www.keycloak.org/server/all-config
whazor 5y ago
Authentik is also worth checking out: https://goauthentik.io/ https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.
- gabereiser 5y ago
  I’ve been a keycloak advocate since my jboss days (really the only good thing that came out of jboss). I have never heard of authentik and I’m so glad you mentioned it, it looks amazing! I had been contemplating doing a similar project but this would satisfy that need. Thank you.
  - dugite-code 5y ago
    Just be careful with Athentik, it is an extremely young, rapidly developing project. So expect the odd pitfall
    - gabereiser 5y ago
      Yeah, needs battle hardening, but I like what they are doing and the features it offers so bookmarked and starred!
- p_l 5y ago
  Arguably best is to not have proxied oauth at all and instead implement oauth in your software.
- CGamesPlay 5y ago
  This looks awesome! I dropped Keycloak because it's 2 GiB of RAM was too much for me to commit to SSO on my tiny VPS, so I just switched to static htpasswd management. But this looks like it might be a great replacement. It seems to support groups/selective access to services through group membership, which is great. Does it support username authentication or does it require that an LDAP server or other OIDP is used as a source of truth?
  - 5y ago
davidcollantes 5y ago
We are currently using Shibboleth, and would love to get away from using java/Tomcat. It looks like Keycloak also uses java. Is there an alternative to this that doesn't require it?
- yawniek 5y ago
  possibly https://www.ory.sh/ https://www.ory.sh/
  - sascha_sl 5y ago
    ORY is amazing, but it also requires significiant investment. It's a headless API (so you never have to touch OAuth/OIDC internals) for building your own IdP.
- bfm 5y ago
  We are currently evaluating self hosting supabase auth.
- ffo 5y ago
  Maybe https://github.com/zitadel/zitadel https://github.com/zitadel/zitadel could be an alternative to you. Its written in Go, can be self-hosted or used from a cloud service. It will also soon (end of May) provide SAML 2.0 support besides the current OpenID Connect and OAuth support. Disclaimer: I am one of the authors ;-)
  - sigzero 5y ago
    Make sure you get v2 on the HN front page!
    - ffo 5y ago
      Will do ;-)
  - francislavoie 5y ago
    Does it/will it support Forward Auth style usage for plugging in with reverse proxies? Asking as a Caddy maintainer, I'm working on this right now and we've been working with Authelia to test it out, would be cool to get it working with another Go auth server! See https://github.com/caddyserver/caddy/pull/4739 https://github.com/caddyserver/caddy/pull/4739
brightball 5y ago
Does it support webAuthn?
- bayesian_horse 5y ago
  Yes
- jeroenhd 5y ago
  Yes, I've seen it used both as primary factor and as a second authentication factor (I'm not sure you would ever need it as 2FA, but whatever). Requires some setup, though.
- mooreds 5y ago
  Yup. Here's the doco for configuring it: https://www.keycloak.org/docs/latest/server_admin/#_webauthn https://www.keycloak.org/docs/latest/server_admin/#_webauthn
  - brightball 5y ago
    Thanks! Didn’t see it when I was browsing.
schipplock 5y ago
In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. It never failed for me. Even upgrading from 7.x.x to 16.x.x somehow just worked. Yes, their docker image is fat, but it's also very flexible. Now that they are basing Keycloak on Quarkus instead on Wildfly, the docker image should shrink in size. quay.io/keycloak/keycloak 18.0.0 a6bd0f949af0 15 hours ago 562MB quay.io/keycloak/keycloak 18.0.0-legacy 421e95f49589 46 hours ago 753MB ok, still big :). Beware: they aren't using Docker Hub anymore. Newer versions are on Quay only (https://quay.io/repository/keycloak/keycloak https://quay.io/repository/keycloak/keycloak). I'm happy with Keycloak. Also nice folks around Keycloak.
- imglorp 5y ago
  We're still on the older one and looking forward to the Quarkus improvement specifically for boot times. Even with an empty DB, the old one takes several minutes to load and come up. It's the long pole in our install. Very happy with KC otherwise. We make heavy use of its nice API to create providers and clients at install time.
- chrisoverzero 5y ago
  > Beware: they aren't using Docker Hub anymore. Newer versions are on Quay only Oh, right, Quaycloak.
  - zeepzeep 5y ago
    Quaaludes... what?
- mooreds 5y ago
  > Beware: they aren't using Docker Hub anymore. Do you know why? Is it because of the docker hub pricing changes? I found this discussion on the mailing list but didn't see a reason why: https://lists.jboss.org/pipermail/keycloak-user/2019-March/017476.html https://lists.jboss.org/pipermail/keycloak-user/2019-March/0...
n3t 5y ago
Can I use Keycloak for the following use case? I have a few services on my family server (say, Gitea, Grafana, finance tracking app etc.). I'd like to have a SSO but also limit which users can use which services (e.g. my significant other can use Grafana but no Gitea). Is integrating above services with Keycloak enough? Or would I need another components? Or maybe I've got it wrong and should reconsider the architecture?
- fjni 5y ago
  This will work. But learning curve is steep as others have said.
- p_l 5y ago
  It will definitely work - Keycloak can provide its own user database, or it can use external one, as well as do some crazier things that go outside of the scope you mentioned. In simplest setup (non-HA, local user database), you would create users inside Keycloak, assign them to different groups, then create applications (which handle configuration for individual applications like grafana and gitea) and create rules that specify that only users that belong to specific group can login to specific application. You can also allow linking multiple external SSOs this way to single keycloak identity, and even include login through kerberos5 or client certificates.
- mooreds 5y ago
  This is a very common auth situation (wanting to have a central place to control access to multiple applications). The biggest hurdle I see is do all of your apps support SAML or OAuth/OIDC for authentication/authorization? The SSO tax is a real thing.
doctor_eval 5y ago
My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly (at the time). This meant we needed to know not only about Keycloak itself, but also about Wildfly's special quirks, the clustering system (Infinispan??), Java and Docker. Now it's packaged with Quarkus, which is another dependency to learn about, and to be honest despite the quality of the finished product, all those dependencies have become pretty off-putting. So while I can recommend Keycloak's functionality, if you're not already deploying Java apps as part of your job, I suspect it will present a pretty serious administrative burden to deploy into serious production.
- maxbaines 5y ago
  For me this is all kind of opaque, apart from a theme put into a folder and some Environment Variables set i don't touch anything in Keycloak, first had no requirement to consider it and second very likely would be doing something maybe not best practice i.e oidc, oauth based. Its the only java app we run in stack, but doesn't matter to me in Docker and within Windows we run a portable java from a subfolder of keycloak so not System wide in Path
- littlecranky67 5y ago
  Was working at a Java shop once which used Keycloak as a central IAM solution. As an FE Dev, I was tasked to customize/style the login-page provided by Keycloak, and quickly faced what you described: Pretty heavily Java-based, even to edit HTML templates I had to recompile using a full blown Java/JVM stack. As an FE dev without Java background, this became pretty difficult. But once we finished that with the help of some of the BE Java devs, it ran (and still runs) quite stable and also the KeycloakJS adapter I integrated was alright without much surprises.
  - spacemanmatt 5y ago
    Java backend/React frontend dev here. I customized Keycloak 10 login page a while back, and it did not require anything but markup. My Keycloak 18 instance runs the same customization now, unchanged.
deependra 5y ago
https://wso2.com/asgardeo/ https://wso2.com/asgardeo/
- burn_321 5y ago
  Isn't it a bit expensive? I mean both wso2 subscription and asgardeo tiers.
jcroll 5y ago
Spring has an oauth2 authorization server that is currently in early release: https://github.com/spring-projects/spring-authorization-server https://github.com/spring-projects/spring-authorization-serv... I'm building something with it currently and it's quite nice, especially if you are already familiar with spring security. Documentation is quite sparse tho.
bfm 5y ago
Relevant discussion comparing KeyCloak to the Ory stack https://news.ycombinator.com/item?id=25763320 https://news.ycombinator.com/item?id=25763320
dbrgn 5y ago
Does someone here know how Keycloak compares to Gluu?
- mooreds 5y ago
  From what I've heard, Keycloak is better supported and has a bigger community that Gluu (12k stars vs 300 stars on GH). They are both open source and in Java. I've heard from users that Gluu can be a resource hog.
deependra 5y ago
Another Opensource IAM provider is WSO2. Now they offer a cloud solution too. https://wso2.com/asgardeo/ https://wso2.com/asgardeo/
- topspin 5y ago
  I've used both the opensource WSO2 and Keycloak. That latter is better designed and suffers fewer glitches, which is important when dealing with the complexities of oidc/oauth2. It's not that WSO2 doesn't do what it says on the tin; it works. Keycloak just works so well it's almost fun. One feature Keycloak lacks compared to WSO2 is SCIM (System for Cross-domain Identity Management). That actually matters to me. There is a third party Keycloak extension[1] that implements SCIM, but I can't speak to it. [1] https://github.com/Captain-P-Goldfish/scim-for-keycloak https://github.com/Captain-P-Goldfish/scim-for-keycloak
contactgalaxy 5y ago
[flagged]
fjni 5y ago
My biggest issue in the version I was evaluating: Some service providers use “email” as username (in fact many do.) Keycloak doesn’t make it easy to prohibit users from changing their own email, making it trivial to impersonate someone else and gain access one shouldn’t have. https://keycloak.discourse.group/t/hide-disable-email-changes-on-client-account-area/2241/6 https://keycloak.discourse.group/t/hide-disable-email-change...
- mooreds 5y ago
  Did they offer some kind of verification path? So you could only allow an email change if the user proved they owned the new email account by clicking a link or entering a code sent to that account? Seems like a natural option. Of course, allowing you to disallow email changes seems pretty reasonable too.
  - fjni 5y ago
    The issue if I remember correctly was that you could require the email to be verified. But while that verification was pending, it would already use the new email as the user’s asserted attribute.
- sascha_sl 5y ago
  Keycloak actually makes it very easy now, assuming you have account-api and account2 feature flags set (default these days). You remove "manage-account" inside the "account" client from the default roles. Do mind this breaks the account console for those users (which is what you probably want anyway).
  - fjni 5y ago
    I don’t remember exactly, but I think this also took away the ability for users to manage their factors (I.e. register a new hardware token)
kitsune_ 5y ago
Documentation is its weak point, other than that it works as intended.
littlecranky67 5y ago
As others mentioned, Keycloak is a good choice if you need a self-hosted IAM solution and are familiar with Java development. If you don't need selfhosted, I can recommend using Amazon AWS Cognito as a OAuth2/IAM solution - it is included in the free tier for up to 50.000 MAUs, plus the signup/lost password mails etc. are sent through Amazon SES, which heavily increases the inboxing rate. You could always transition later to a self-hosted solution like keycloak. Given both are OAuth2, that transition should be smooth.
- mooreds 5y ago
  What are your main reasons for recommending Cognito? That it is free and easy to get going with? Have you customized the user login experience? I only ask because I've heard folks talk about how Cognito does the basics right (which is great, no one should roll their own auth) and is quick to get started with, and is serverless and free (unless you want SAML connections). But once you get past the basics, it turns into a ton of hassle. And there's been little progress in feature set/docs/etc (though last year they did do a UI refresh). * https://twitter.com/zackkanter/status/1488297503455956992 https://twitter.com/zackkanter/status/1488297503455956992 * https://fusionauth.io/blog/2020/11/18/reconinfosec-fusionauth https://fusionauth.io/blog/2020/11/18/reconinfosec-fusionaut... They also don't let you export your password hashes, so when you transition to a self hosted solution, you must force your users to reset their passwords (or perform a drip migration). I wrote about these options here: https://fusionauth.io/blog/2022/02/07/how-to-migrate-from-cognito https://fusionauth.io/blog/2022/02/07/how-to-migrate-from-co... Disclosure, I work for a Cognito competitor, FusionAuth.
  - littlecranky67 5y ago
    Yes, I mostly recommend it because it is free and I've used before, plus I've been on several projects where we used Keycloak. For me, Cognito's 50.000 monthly active users is probably all I will ever need, and as you said, its quick to get started. Keycloak is the other way around, you will have to invest beforehand into learning and running it. Also, if you allow self-signup by your users, Email inboxing is a serious issue. So even if you run Keycloak yourself, you must think how you are going to deliver emails - which will bring you to other SaaS services like MailChimp or AWS SES anyway. I can't speak about FusionAuth or Auth0, but yes, other SaaS might be as good as Cognito as well - but I do not know their free tiers. Disclaimer: I am not working for any of those, just a small side-gig SaaS builder/WebDev speaking of my experience.
spicyusername 5y ago
For those that may not be aware, Keycloak is the upstream of Red Hat's SSO solution "Red Hat Single Sign-On", so there is a lot of weight behind it's development.
d4a 5y ago
I have been using Keycloak for the past couple of years in my homelab for SSO. It works really well, but there's a bit of a learning curve.
- mooreds 5y ago
  What would you say have been the positives and negatives of it? Is the learning curve above and beyond OIDC/OAuth? How much did you have to customize it?
  - sascha_sl 5y ago
    Keycloak just assumes you know OIDC terminology, and it has some quirks that you might not expect (e.g. until recently, client credential grants created a refresh token). It also, concerningly, uses some OIDC terminology outside of OIDC. There are two kinds of scopes in Keycloak. OIDC scopes (that are a set of mappers and represent permissions) and which client and realm roles can be included in a token (including the famous "Full Scope allowed" option that'll dump all roles into your token if you use the default OIDC scope). A lot of behavior is also just implicit. Particularly in the Authentication Flow Editor. You just gotta know what you want if you want to customize them. The Audience mapper is another tricky one, relying on the (not OIDC) scope to figure out which client to put into the "aud" claim.
Loic 5y ago
Slightly out of topic, but based on Caddy, has anybody experience with Caddy Security[0]? It is very easy to install but hard to find other users. [0]: https://github.com/greenpau/caddy-security https://github.com/greenpau/caddy-security
- francislavoie 5y ago
  (Caddy maintainer here) I don't use that plugin myself but AFAICT most users ask questions on the GitHub repo so probably best to ask for help there if you need it. As an aside, I've been working on making the Forward Auth usecase viable with Caddy, and we just got it working today https://github.com/caddyserver/caddy/pull/4739 https://github.com/caddyserver/caddy/pull/4739
  - Loic 5y ago
    Thank you, my question was more a kind of bottle to the sea, if anybody was using it. I was able to configure the plugin nicely and get gitea as a source of users and groups to control access to other applications. And by the way, thank you, I am really impressed by the quality of Caddy.
orthoxerox 5y ago
Keycloak is a great piece of software if you have to authenticate against AD (on prem, not Azure AD). It's the best way to isolate all the crap like "user accounts live in this OU, but admin accounts live only in that OU. Oh, and we also have another domain where contractors live in the same OUs. And the groups that map to application roles are the same, but live in differently named OUs" and provide a simple OAuth 2.0/OIDC authentication/authorization interface to all this mess.
jcmontx 5y ago
I like IdentityServer4 even though is not supported anymore
sirmike_ 5y ago
Have used and brought keycloak into many companies over the years as a solution. Steep learning curve a little. But it essentially works as designed either as the IDP (rare in my exp) or as a IAM broker more common. Big companies need it because their hands are tied to old and inflexible vendor's APIs. However they can with some effort craft a branded and modern UI/UX. Backend works with just about anything old Auth related whilst supporting a newer modern Auth schemes. I am surprised IBM has not made RHEL ruin it yet. To say IBM is a slightly better steward of their open source efforts than Oracle never leaves one with much comfort.
- sascha_sl 5y ago
  The secret to making keycloak UI/UX good is to disregard the account console and build your own with the new accounts API (which the accounts2 console also uses). Also, if you just use one broker you can skip the login experience entirely.
- 0xbadcafebee 5y ago
  RedHat never needed anyone's help to ruin things. Their solutions are poorly designed bloated crap that "can get the job done" if you run them within a RedHat platform and don't mind banging your head against a brick wall. Just because they're open source darlings doesn't mean we can't call a spade a spade.
spacemanmatt 5y ago
I've been running Keycloak for 4 years now, starting with version 10. I like a well-disciplined stack and Keycloak is a star. And that's huge considering my other big players are Vert.x and PostgreSQL.
mberning 5y ago
This part of the IAM space (SSO and AuthN) is so crowded with products, both paid and open source. When you look at governance, certification, lifecycle management, approvals, etc. there is almost nothing by comparison. A couple not so great commercial products and very little open source. Hopefully that changes.
- ffo 5y ago
  Agreed, I mean that's why we built our solution completely open source in an open saas model and certified [1] our solution. We even provide our pentest results publicly, after mitigation of course [2]. The value we provide, when you are using our cloud, is the operational peace of mind, global scalability with data residency and access to deep technological knowledge. We wrote some word about that in our blog [3] as well. 1. https://zitadel.ch/blog/openid-connect-certification https://zitadel.ch/blog/openid-connect-certification 2. https://zitadel.ch/blog/pentest-results-h1-2021 https://zitadel.ch/blog/pentest-results-h1-2021 3. https://zitadel.ch/blog/saas-vs-self-hosted https://zitadel.ch/blog/saas-vs-self-hosted
  - mberning 5y ago
    That is very cool. It looks like you actually have a lot of overlap with an identity orchestration solution, such as Strata.
    - ffo 5y ago
      Hm, interesting it need to check that ;-)
- mooreds 5y ago
  > When you look at governance, certification, lifecycle management, approvals, etc What do you mean by these? Are you talking about SOC2/ISO27001 when you say certification? Are you talking about provisioning/deprovisioning users (SCIM, etc) when you say lifecycle management? What do you mean by approvals? Role changes requiring designated approval, or something else?
sharkbird2 5y ago
Keycloak is great, using it in several projects. The only thing I've been missing is support for IdP discovery services, such as https://seamlessaccess.org/ https://seamlessaccess.org/
la6472 5y ago
First of all it is not clear if it is stand alone OR SAAS product?
- sascha_sl 5y ago
  It's the open source project that RedHat SSO is derived from, in the same way that OKD is the open source project that OpenShift is derived from.
- mooreds 5y ago
  It is typically self-hosted. A quick google turned up this Keycloak SaaS offering: https://www.cloud-iam.com/ https://www.cloud-iam.com/
deleted 5y ago
[deleted]
burn_321 5y ago
Anyone who has used wso2 identity server? It's an open source identity solution with many customizations available, but it requires a license for commercial use though.
s1mon 5y ago
Does Keycloak or any of the alternatives mentioned here do a good job of supporting localization? What about customization of the email messages for lost password flows?
- mooreds 5y ago
  Can't speak for Keycloak, but FusionAuth supports localization of both user facing HTML and email/SMS messages. (Not the admin screens, alas.) More details here: https://fusionauth.io/docs/v1/tech/core-concepts/localization-and-internationalization https://fusionauth.io/docs/v1/tech/core-concepts/localizatio... 15 languages have user facing translations: https://github.com/FusionAuth/fusionauth-localization/ https://github.com/FusionAuth/fusionauth-localization/ Disclosure: I work for FusionAuth.
- donatzsky 5y ago
  Ory Kratos and Hydra are API only and so don't provide a UI. Localisation then is entirely up to you.
- adlerhurst 5y ago
  zitadel allows to change the texts of emails and login texts, but at the moment only for languages already supported at the moment of writing en, it, de disclaimer: I'm one of the authors of ZITADEL
zmmmmm 5y ago
Recently deployed Keycloak as a front end to hide legacy auth in our org and put OAuth in front of it. Despite the apparent complexity under the hood, it works great and no complaints so far. By and large, it just does what it says on the tin and works.
pax 5y ago
Slightly off-topic: Could anybody recommend a lightweight, self-hosted php IAM that would handle new accounts (with email confirmation), password recovery, maybe user groups? I've been using Wordpress a couple of times just for the user management, not very proud of that but I didn't know better :/
- mooreds 5y ago
  Geez, I don't know of any. If you have to stick with PHP (as opposed to using some of the other solutions mentioned in comments), I'd probably look to a framework. For example, here's Laravel's offering: https://laravel.com/docs/9.x/authentication#authentication-quickstart https://laravel.com/docs/9.x/authentication#authentication-q...
- mekster 5y ago
  SSO is not a blogging system. You don't choose by the language.
  - pax 5y ago
    I'm not looking for SSO. Did I use IAM wrongly? I'm talking about tiny apps that do require a protected back-end access, generally for somewhat bootstrapped CSOs. Not looking for anything fancy, but rather quick and dirty. For example, updating a SQLite db via gSheets API. PHP as that's default for shared hosting.
advaitruia 5y ago
Other open source auth solutions: Ory, SuperTokens.com , Supabase / GoTrue If anyone has evaluated these / Keycloak, I'd be happy to have a discussion on it
- mekster 5y ago
  What are your experiences? There are also Authentik, Authelia, Dex and gluu. There was a bad review of gluu in Reddit. https://www.reddit.com/r/selfhosted/comments/fxotbi/experiences_with_keycloak_alternatives/fn1u3p4/ https://www.reddit.com/r/selfhosted/comments/fxotbi/experien...
- adlerhurst 5y ago
  i'm biased but another solution is zitadel. Would be happy to discuss :)
navbaker 5y ago
Transitioning a preexisting web stack in our corporate network from Identity Server to Keycloak has been my extremely rough intro to the world of auth. I would say I’m almost there, but have one issue holding me up. We have a few different data enclaves, including one that requires users to sign an NDA and be added to an AD group. I’ve been searching high and low to see if Keycloak has a simple flag to say “don’t let anyone in that isn’t a member of this AD group”. Does that exist or do I have to create groups in Keycloak itself and add users manually?
- cpitman 5y ago
  Sounds like you want to configure a Group Mapper: https://www.keycloak.org/docs/latest/server_admin/#_ldap_mappers https://www.keycloak.org/docs/latest/server_admin/#_ldap_map...
oauea 5y ago
I think keycloak is fantastic. The only thing I don't really like is how the user profile is deeply baked into the code. It seems they're working on improving this, but at least currently, it is not possible to have users that do not use a "First name" and a "Last name". Which is rather annoying when using it for things like game servers, where people just want to go by their username.
MrTawti 5y ago
I used Keycloak about 4 or 5 years ago in a former job. It did work very well. Note however, that we did not need to customize anything nor did we have to deal with scaling (in house web-app where it was rare to have more than 100 people using on it at any given day). Right now, I'm looking into https://supertokens.com/ https://supertokens.com/ I have not used it in any capacity but it does seem much more approachable -at least to me- and allows for much flexibility (code wise on your own Backend). I would be interested in hearing if anyone here has any feedback.
- advaitruia 5y ago
  I'm of the project creators. Happy to discuss your specific use case and evaluate different providers. Some recent feeedback: "Hi yes, we are testing SuperTokens right now, and we are loving it Thanks for the great tool btw. it is really comfortable to integrate it into the project. at first we decided to use Keycloak, spent a week to customize it for our needs. It was soooo painful :sweat_smile: then we started looking for alternatives" "Been using it a bit for a pet project and I am quite impressed of how many integrations and documentation I find on its page. Also, really easy to use!" Just in case you are wondering where I found out about SuperTokens, it was on HackerNews"
deleted 5y ago
[deleted]
EtienneK 5y ago
Keycloak is great! Just wish it didn't need so much RAM (2GB at least).
jcadam 5y ago
Keycloak is great if you need an SSO solution. We had a large number of small in-house applications at my previous job and managing logins was becoming a pain. At my current job we use Okta. While the documentation is better, I don't think I prefer it over KC.
mekster 5y ago
I've integrated keycloak for SSO between several self hosted apps and boy I had no idea what I was doing but copy paste config from left and right from various sites which worked in the end but does SSO have to be this complicated? Can someone recommend a simpler solution to integrate SSO with online tools (like NextCloud, Discourse, Wiki.js, Gitea etc)? Does anyone have experience with Authentik?
- zmxz 5y ago
  I've used many solutions, even built my own in the end. Problem is that there's no software that can make SSO easy to understand if you don't know everything about SSO to begin with. SSO is not that complicated to work with, the docs are just stupidly difficult to read and the point of the whole process is rarely explained. Learning how without knowing why is nearly impossible.
  - mooreds 5y ago
    > even built my own in the end. Can you tell me more about this? Did you end up building your own from the ground up, or leveraging existing libraries? Is it open source/available for others to use?
JacobiX 5y ago
I've integrated keycloak for SSO in our apps, we have a one-to-one mapping between keycloak realms and the tenants in our apps, works great and it can glue together many disparate IdP/auth solutions: onelogin, LDAP/AD, etc. At one moment we needed to implement a custom OTP method, so we developed a plugin by implementing a simple SPI (the auth flow is configurable). It is a very stable piece of software, we have a combination of Terraform+ansible scripts to deploy it, and once it is done we forget about it until we need to upgrade the version using the same scripts. The biggest drawback IMHO is the documentation quality ...
jcon321 5y ago
have a keycloak dev server been running for 6 years with literally 0 maintenance... it's a well crafted piece of software
offminded 5y ago
I had to decide between Keycloak and Supertokens just last week.. Gone through both of their documentation and repos and decided to go with Supertokens. Backend and Frontend flexibility and their instant Discord support to my questions was a huge plus for me.
- advaitruia 5y ago
  Awesome! One of the project creators here, glad to hear you're having a good experience so far
miovoid 5y ago
It’s Java based :—(
- nickserv 5y ago
  I'm not a big fan of Java personally, as in I would not start a side project with it. But in this case it's actually a great choice. Static typing, stable, mature, good performance, known by tons of engineers all over the world... And heavily used in the enterprise market which has a very real need for SSO.
- sigzero 5y ago
  Yup, and to me that's great and goes into the "pros" and not "cons" column.
miovoid 5y ago
It’s Java based :-(
rad_gruchalski 5y ago
Went through so many of these systems and keep coming back to keycloak exactly because of its monolithic architecture and authorisation services. There are so many great things in keycloak, I very much like SPIs and authorisation services (uma2).
seymon 5y ago
I which all the keycloak login and email themes would be more flexible and could use custom client attributes, realm settings etc. Another missing thing is multi tenancy within a realm. Because managing a huge number of realms is a configuration nightmare.
password4321 5y ago
Is Keycloak something that is intended to be exposed publicly, or is this something typically used behind a VPN or equivalent protection?
- mooreds 5y ago
  It depends on what your needs are. If you are using it for CIAM (customer identity and access management) then you are probably going to be putting it on the internet. If using it for internal IAM (identity and access management, also known as workforce identity) you can keep it inside your network. I believe Keycloak works either way.
  - password4321 5y ago
    Thanks. I was mostly wondering how comfortable "Hacker News" is exposing it publicly... going on zero experience and just gut feeling I put it at about the same level as RDP.
    - mooreds 5y ago
      Ah, I get what you are asking. I think it's far more secure than RDP because the protocols it's based on have learned lessons from RDP. Here's a document they have about securing Keycloak: https://www.keycloak.org/docs/latest/server_admin/#mitigating-security-threats https://www.keycloak.org/docs/latest/server_admin/#mitigatin... I too would be interested to hear from any folks running this software in prod how they deal with securing a public endpoint.
vosper 5y ago
Is Keycloak a good option if I want to setup a SAML Service Provider using user records from my own MySQL database? I've looked at Okta and Keycloak and it's not really obvious to whether I'm supposed to give up my User table and let the auth system handle it, or whether the user data ends up being spread between my DB and the auth system (I think that's how Okta would be implemented). I know I could roll my own with PassportJS or something, but I'd like all the nice Okta stuff (MFA, password policies, SAML SSO, maybe federation) but integrated with my existing DB. Or is that just too much to ask?
- mooreds 5y ago
  Are you asking if you can use Keycloak with your own user table? Typically these identity providers want to own the user, so would expect you to port the user info, including password hashes, into them. If you have data that is user related but not auth related (application specific data), I've seen a few patterns: * Push it all into the auth provider. Not sure about keycloak, but some providers have the ability to store arbitrary data (a blob, basically) about a user. * Create a table in your database with an identifier provided by Keycloak, preferably an immutable one. Then when a user logs in, you can find their identifier, then look up the application specific data. If you want to have all PII in one place, the former option is best. If you want to maximize your flexibility, the latter is what I'd suggest. If you want to keep the user data in your database, I'd look at a library (as you suggest). It's a different class of solution than a standalone auth provider like Keycloak.
  - vosper 5y ago
    > Are you asking if you can use Keycloak with your own user table? Yes, that's what I'm asking. Because my User table has relationships with the rest of my database, and I want to keep that (user X owns application-item Y; User X created Comment Z on application-item Y, etc... you get it). > Create a table in your database with an identifier provided by Keycloak, preferably an immutable one. Then when a user logs in, you can find their identifier, then look up the application specific data. This looks like a good option to me. I'd be fine with PII in Keycloak, and app-specific stuff in my database, provided there's a solid link between the two. If the user wants to change their email, that goes into Keyclock, and if they do something else that is connected to the application function that goes into the app DB. Thanks!
amaccuish 5y ago
I like Keyloack, but omg it's ridiculously difficult when using the docker container to import a CA cert. May Java Keystore burn in hell.
altonaut 5y ago
Is there a minimal config to run and setup keycloak with docker for local development? Most sources suggest exporting and reusing a reale-export.json, but it is missing the user datas and includes lots of (default) options and random uuids. There is a example repo, but it seems out of date and missing some settings: https://github.com/keycloak/keycloak-demo/blob/master/demo-realm.json https://github.com/keycloak/keycloak-demo/blob/master/demo-r...
sigzero 5y ago
Is there a comparison somewhere of Keycloak vs ForgeRock AM?
gumarn_y 5y ago
[dead]
vcryan 5y ago
I'm a fan of KeyCloak and use in prod. My biggest complaint though, is the storage of configuration in a database. This makes deployment complex, because you can't just deploy code, you must also mutate your database on each deploy (in many cases). I'm looking into a more modern approach, perhaps disallowing any system admin access (only user admin) and requiring all configurations changes to be applied via code using the API... please provide any recommendations for a better approach!

388 points by memorable 5y ago

Odd name... no relation to KeyWhiz? https://square.github.io/keywhiz/ https://square.github.io/keywhiz/

We tried using keycloak in a startup where I worked. It needed a loooooooot of memory and was very slow to start. It probably needed some JVM tuning, but we were just deploying as a stateful set (for the postgres). The docker images were also huge. We had to use another FOSS project called Gatekeeper as an authentication software along with keycloak, which got obsoleted and replaced with a different project (lukedo proxy or some such). The community support was also relatively not that active like other FOSS project that we used (for other areas of the stack). Overall, the experience was not so great that we decided to ditch both keycloak and gatekeeper. This was about a couple of years back. Not sure what the current status is. Some other alternatives that we wanted to try were from the Ory project (Kratos etc.) But we just went with some proprietary AUTH solution in our startup.

Datagenerator 5y ago
Which?
sz4kerto 5y ago
Keycloak is now running on Quarkus, so startup times are much faster (few seconds). But -- KC is not something you start up often (in production). It's reliable, flexible and actively developed, so not a bad choice as a self-hosted IAM solution.
- vetinari 5y ago
  With Quarkus, they went into other extreme -- if you are using docker, to get as fast startup as possible, you have to build your image with your configuration/modules used baked in. Overall, I'm pretty satisfied. There are some bumps, but they are not Keycloak fault (having two different keytabs for two different host names for two different container images sharing same IP and reverse name not matching is kind of difficult).
  - pharmakom 5y ago
    There is an auto-build option so building a custom Docker image is an optimisation.
nird 5y ago
We have been using it for 6-7 years now. Have been able to run very stable and integrated a lot of external IdP's to offer proper SSO on mulitple of our software stacks. Added a lot of other open source pieces of software we run for our backoffice needs (hashi vault, adminbro, etc.). So far very happy with it. Running in clustered mode without issues and as such little issues with the startup times. It probably helps that we have a solid background in Java based development and deployment and are less worried about the amount of memory it uses for the full suite.
- lifeisstillgood 5y ago
  This fascinated me - where and how does this fit into other identity providers (and thence into SSO). I kind of yearn for client certificates everywhere simply because I can grok how that remains secure as we pass through layer after layer. the rest I just worry about
  - bayesian_horse 5y ago
    keycloak can broker between identity providers. It can use social logins as identity providers, connect to ldap, kerberos and others for user federation, and then provide SAML and OpenIDC to other applications.
    - nird 5y ago
      Exactly this. OIDC and SAML integrations with customers IdP's. Map identity metadata from the customer into our realm so they can provide data in any way they want and we map it down to our standard which allows our applications to stay clean when using this metadata for business logic. We have also added an event plugin to keycloak to push login events to a queue for other services to consume. We also offer local keycloak identities in case a customer does not or can not provide their own identities, and have added haveibeenpwnd logic to check password strength/reuse for these local keycloak identities.
    - paulmd 5y ago
      As someone who has superficially looked into it a couple times and gotten pushed away by the complexity: what do you recommend for a backend? Is there another container that provides an LDAP service I could use? Or Kerberos? I am rebuilding my homelab soon and I am interested in having centralized auth across all systems and as many applications as feasible, using my centralized fileserver as an IDP source via some application or another, as well as using Keycloak for some one-off projects where I don't really want to write a user layer.
RandomBK 5y ago
In my experience, Keycloak is best treated as a "pet" in the "pet v.s. cattle" spectrum. It takes a while to warm up, so you don't want to be constantly restarting it. I deployed it out-of-sync with the main application deployments. As an open source option, it's quite powerful and full-featured. It's also quite configurable. If I had one feature ask, it's that it doesn't play well with infrastructure-as-code ideas. While you can load a new realm from a JSON, it's harder to keep changes synced after that.

base698 5y ago

Recently been using it and have been happy with it. Being able to plug some of our existing providers in and have one solution to integrate with has been the big win.

maxbaines 5y ago

Using Keycloak for all authentication both in the cloud under Linux and within Windows Enterprise Environments. Use it for SSO for Node-RED, Grafana, Aspnet & VueJS apps. Was fairly easy to move from Auth0.

xupybd 5y ago

I've been investigating an authorization application to use with the SAFE stack. I'm testing Keycloak and it looks good so far.

pharmakom 5y ago
Similar scenario here. Drop me a comment if you want to share anything learned.

pharmakom 5y ago

My biggest complaint with Keycloak is that the documentation is poor. You will need to set various flags to fit your use-case. Lots of googling and SO to get things running. Some of the options have changed since 17.x so many guides are outdated.

sascha_sl 5y ago
This was definitely true for the Wildfly/JBoss version, but on Quarkus configuring Keycloak is mostly trivial now[1]. The only options I had to set outside environment variables in production are related to Infinispan discovery. [1]: https://www.keycloak.org/server/all-config https://www.keycloak.org/server/all-config

whazor 5y ago

Authentik is also worth checking out: https://goauthentik.io/ https://goauthentik.io/ The biggest benefit is that Authentik supports Forward Auth out of box. This means that you might not need oauth2proxy.

gabereiser 5y ago
I’ve been a keycloak advocate since my jboss days (really the only good thing that came out of jboss). I have never heard of authentik and I’m so glad you mentioned it, it looks amazing! I had been contemplating doing a similar project but this would satisfy that need. Thank you.
- dugite-code 5y ago
  Just be careful with Athentik, it is an extremely young, rapidly developing project. So expect the odd pitfall
  - gabereiser 5y ago
    Yeah, needs battle hardening, but I like what they are doing and the features it offers so bookmarked and starred!
p_l 5y ago
Arguably best is to not have proxied oauth at all and instead implement oauth in your software.
CGamesPlay 5y ago
This looks awesome! I dropped Keycloak because it's 2 GiB of RAM was too much for me to commit to SSO on my tiny VPS, so I just switched to static htpasswd management. But this looks like it might be a great replacement. It seems to support groups/selective access to services through group membership, which is great. Does it support username authentication or does it require that an LDAP server or other OIDP is used as a source of truth?
- 5y ago

davidcollantes 5y ago

We are currently using Shibboleth, and would love to get away from using java/Tomcat. It looks like Keycloak also uses java. Is there an alternative to this that doesn't require it?

yawniek 5y ago
possibly https://www.ory.sh/ https://www.ory.sh/
- sascha_sl 5y ago
  ORY is amazing, but it also requires significiant investment. It's a headless API (so you never have to touch OAuth/OIDC internals) for building your own IdP.
bfm 5y ago
We are currently evaluating self hosting supabase auth.
ffo 5y ago
Maybe https://github.com/zitadel/zitadel https://github.com/zitadel/zitadel could be an alternative to you. Its written in Go, can be self-hosted or used from a cloud service. It will also soon (end of May) provide SAML 2.0 support besides the current OpenID Connect and OAuth support. Disclaimer: I am one of the authors ;-)
- sigzero 5y ago
  Make sure you get v2 on the HN front page!
  - ffo 5y ago
    Will do ;-)
- francislavoie 5y ago
  Does it/will it support Forward Auth style usage for plugging in with reverse proxies? Asking as a Caddy maintainer, I'm working on this right now and we've been working with Authelia to test it out, would be cool to get it working with another Go auth server! See https://github.com/caddyserver/caddy/pull/4739 https://github.com/caddyserver/caddy/pull/4739

brightball 5y ago

Does it support webAuthn?

bayesian_horse 5y ago
Yes
jeroenhd 5y ago
Yes, I've seen it used both as primary factor and as a second authentication factor (I'm not sure you would ever need it as 2FA, but whatever). Requires some setup, though.
mooreds 5y ago
Yup. Here's the doco for configuring it: https://www.keycloak.org/docs/latest/server_admin/#_webauthn https://www.keycloak.org/docs/latest/server_admin/#_webauthn
- brightball 5y ago
  Thanks! Didn’t see it when I was browsing.

schipplock 5y ago

In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Keycloaks documentation seems vast, but isn't. There is also no way to search inside their documentation. It's a pity. A better documentation is contained in the administration web ui itself. There are so many "hints" and tooltips for almost every option there is. It really helped me a lot. Keycloak is good software. It never failed for me. Even upgrading from 7.x.x to 16.x.x somehow just worked. Yes, their docker image is fat, but it's also very flexible. Now that they are basing Keycloak on Quarkus instead on Wildfly, the docker image should shrink in size. quay.io/keycloak/keycloak 18.0.0 a6bd0f949af0 15 hours ago 562MB quay.io/keycloak/keycloak 18.0.0-legacy 421e95f49589 46 hours ago 753MB ok, still big :). Beware: they aren't using Docker Hub anymore. Newer versions are on Quay only (https://quay.io/repository/keycloak/keycloak https://quay.io/repository/keycloak/keycloak). I'm happy with Keycloak. Also nice folks around Keycloak.

imglorp 5y ago
We're still on the older one and looking forward to the Quarkus improvement specifically for boot times. Even with an empty DB, the old one takes several minutes to load and come up. It's the long pole in our install. Very happy with KC otherwise. We make heavy use of its nice API to create providers and clients at install time.
chrisoverzero 5y ago
> Beware: they aren't using Docker Hub anymore. Newer versions are on Quay only Oh, right, Quaycloak.
- zeepzeep 5y ago
  Quaaludes... what?
mooreds 5y ago
> Beware: they aren't using Docker Hub anymore. Do you know why? Is it because of the docker hub pricing changes? I found this discussion on the mailing list but didn't see a reason why: https://lists.jboss.org/pipermail/keycloak-user/2019-March/017476.html https://lists.jboss.org/pipermail/keycloak-user/2019-March/0...

n3t 5y ago

Can I use Keycloak for the following use case? I have a few services on my family server (say, Gitea, Grafana, finance tracking app etc.). I'd like to have a SSO but also limit which users can use which services (e.g. my significant other can use Grafana but no Gitea). Is integrating above services with Keycloak enough? Or would I need another components? Or maybe I've got it wrong and should reconsider the architecture?

fjni 5y ago
This will work. But learning curve is steep as others have said.
p_l 5y ago
It will definitely work - Keycloak can provide its own user database, or it can use external one, as well as do some crazier things that go outside of the scope you mentioned. In simplest setup (non-HA, local user database), you would create users inside Keycloak, assign them to different groups, then create applications (which handle configuration for individual applications like grafana and gitea) and create rules that specify that only users that belong to specific group can login to specific application. You can also allow linking multiple external SSOs this way to single keycloak identity, and even include login through kerberos5 or client certificates.
mooreds 5y ago
This is a very common auth situation (wanting to have a central place to control access to multiple applications). The biggest hurdle I see is do all of your apps support SAML or OAuth/OIDC for authentication/authorization? The SSO tax is a real thing.

doctor_eval 5y ago

My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly (at the time). This meant we needed to know not only about Keycloak itself, but also about Wildfly's special quirks, the clustering system (Infinispan??), Java and Docker. Now it's packaged with Quarkus, which is another dependency to learn about, and to be honest despite the quality of the finished product, all those dependencies have become pretty off-putting. So while I can recommend Keycloak's functionality, if you're not already deploying Java apps as part of your job, I suspect it will present a pretty serious administrative burden to deploy into serious production.

maxbaines 5y ago
For me this is all kind of opaque, apart from a theme put into a folder and some Environment Variables set i don't touch anything in Keycloak, first had no requirement to consider it and second very likely would be doing something maybe not best practice i.e oidc, oauth based. Its the only java app we run in stack, but doesn't matter to me in Docker and within Windows we run a portable java from a subfolder of keycloak so not System wide in Path
littlecranky67 5y ago
Was working at a Java shop once which used Keycloak as a central IAM solution. As an FE Dev, I was tasked to customize/style the login-page provided by Keycloak, and quickly faced what you described: Pretty heavily Java-based, even to edit HTML templates I had to recompile using a full blown Java/JVM stack. As an FE dev without Java background, this became pretty difficult. But once we finished that with the help of some of the BE Java devs, it ran (and still runs) quite stable and also the KeycloakJS adapter I integrated was alright without much surprises.
- spacemanmatt 5y ago
  Java backend/React frontend dev here. I customized Keycloak 10 login page a while back, and it did not require anything but markup. My Keycloak 18 instance runs the same customization now, unchanged.

deependra 5y ago

https://wso2.com/asgardeo/ https://wso2.com/asgardeo/

burn_321 5y ago
Isn't it a bit expensive? I mean both wso2 subscription and asgardeo tiers.

jcroll 5y ago

Spring has an oauth2 authorization server that is currently in early release: https://github.com/spring-projects/spring-authorization-server https://github.com/spring-projects/spring-authorization-serv... I'm building something with it currently and it's quite nice, especially if you are already familiar with spring security. Documentation is quite sparse tho.

bfm 5y ago

Relevant discussion comparing KeyCloak to the Ory stack https://news.ycombinator.com/item?id=25763320 https://news.ycombinator.com/item?id=25763320

dbrgn 5y ago

Does someone here know how Keycloak compares to Gluu?

mooreds 5y ago
From what I've heard, Keycloak is better supported and has a bigger community that Gluu (12k stars vs 300 stars on GH). They are both open source and in Java. I've heard from users that Gluu can be a resource hog.

deependra 5y ago

Another Opensource IAM provider is WSO2. Now they offer a cloud solution too. https://wso2.com/asgardeo/ https://wso2.com/asgardeo/

topspin 5y ago
I've used both the opensource WSO2 and Keycloak. That latter is better designed and suffers fewer glitches, which is important when dealing with the complexities of oidc/oauth2. It's not that WSO2 doesn't do what it says on the tin; it works. Keycloak just works so well it's almost fun. One feature Keycloak lacks compared to WSO2 is SCIM (System for Cross-domain Identity Management). That actually matters to me. There is a third party Keycloak extension[1] that implements SCIM, but I can't speak to it. [1] https://github.com/Captain-P-Goldfish/scim-for-keycloak https://github.com/Captain-P-Goldfish/scim-for-keycloak

contactgalaxy 5y ago

[flagged]

fjni 5y ago

My biggest issue in the version I was evaluating: Some service providers use “email” as username (in fact many do.) Keycloak doesn’t make it easy to prohibit users from changing their own email, making it trivial to impersonate someone else and gain access one shouldn’t have. https://keycloak.discourse.group/t/hide-disable-email-changes-on-client-account-area/2241/6 https://keycloak.discourse.group/t/hide-disable-email-change...

mooreds 5y ago
Did they offer some kind of verification path? So you could only allow an email change if the user proved they owned the new email account by clicking a link or entering a code sent to that account? Seems like a natural option. Of course, allowing you to disallow email changes seems pretty reasonable too.
- fjni 5y ago
  The issue if I remember correctly was that you could require the email to be verified. But while that verification was pending, it would already use the new email as the user’s asserted attribute.
sascha_sl 5y ago
Keycloak actually makes it very easy now, assuming you have account-api and account2 feature flags set (default these days). You remove "manage-account" inside the "account" client from the default roles. Do mind this breaks the account console for those users (which is what you probably want anyway).
- fjni 5y ago
  I don’t remember exactly, but I think this also took away the ability for users to manage their factors (I.e. register a new hardware token)

kitsune_ 5y ago

Documentation is its weak point, other than that it works as intended.

littlecranky67 5y ago

As others mentioned, Keycloak is a good choice if you need a self-hosted IAM solution and are familiar with Java development. If you don't need selfhosted, I can recommend using Amazon AWS Cognito as a OAuth2/IAM solution - it is included in the free tier for up to 50.000 MAUs, plus the signup/lost password mails etc. are sent through Amazon SES, which heavily increases the inboxing rate. You could always transition later to a self-hosted solution like keycloak. Given both are OAuth2, that transition should be smooth.

mooreds 5y ago
What are your main reasons for recommending Cognito? That it is free and easy to get going with? Have you customized the user login experience? I only ask because I've heard folks talk about how Cognito does the basics right (which is great, no one should roll their own auth) and is quick to get started with, and is serverless and free (unless you want SAML connections). But once you get past the basics, it turns into a ton of hassle. And there's been little progress in feature set/docs/etc (though last year they did do a UI refresh). * https://twitter.com/zackkanter/status/1488297503455956992 https://twitter.com/zackkanter/status/1488297503455956992 * https://fusionauth.io/blog/2020/11/18/reconinfosec-fusionauth https://fusionauth.io/blog/2020/11/18/reconinfosec-fusionaut... They also don't let you export your password hashes, so when you transition to a self hosted solution, you must force your users to reset their passwords (or perform a drip migration). I wrote about these options here: https://fusionauth.io/blog/2022/02/07/how-to-migrate-from-cognito https://fusionauth.io/blog/2022/02/07/how-to-migrate-from-co... Disclosure, I work for a Cognito competitor, FusionAuth.
- littlecranky67 5y ago
  Yes, I mostly recommend it because it is free and I've used before, plus I've been on several projects where we used Keycloak. For me, Cognito's 50.000 monthly active users is probably all I will ever need, and as you said, its quick to get started. Keycloak is the other way around, you will have to invest beforehand into learning and running it. Also, if you allow self-signup by your users, Email inboxing is a serious issue. So even if you run Keycloak yourself, you must think how you are going to deliver emails - which will bring you to other SaaS services like MailChimp or AWS SES anyway. I can't speak about FusionAuth or Auth0, but yes, other SaaS might be as good as Cognito as well - but I do not know their free tiers. Disclaimer: I am not working for any of those, just a small side-gig SaaS builder/WebDev speaking of my experience.

spicyusername 5y ago

For those that may not be aware, Keycloak is the upstream of Red Hat's SSO solution "Red Hat Single Sign-On", so there is a lot of weight behind it's development.

d4a 5y ago

I have been using Keycloak for the past couple of years in my homelab for SSO. It works really well, but there's a bit of a learning curve.

mooreds 5y ago
What would you say have been the positives and negatives of it? Is the learning curve above and beyond OIDC/OAuth? How much did you have to customize it?
- sascha_sl 5y ago
  Keycloak just assumes you know OIDC terminology, and it has some quirks that you might not expect (e.g. until recently, client credential grants created a refresh token). It also, concerningly, uses some OIDC terminology outside of OIDC. There are two kinds of scopes in Keycloak. OIDC scopes (that are a set of mappers and represent permissions) and which client and realm roles can be included in a token (including the famous "Full Scope allowed" option that'll dump all roles into your token if you use the default OIDC scope). A lot of behavior is also just implicit. Particularly in the Authentication Flow Editor. You just gotta know what you want if you want to customize them. The Audience mapper is another tricky one, relying on the (not OIDC) scope to figure out which client to put into the "aud" claim.

Loic 5y ago

Slightly out of topic, but based on Caddy, has anybody experience with Caddy Security[0]? It is very easy to install but hard to find other users. [0]: https://github.com/greenpau/caddy-security https://github.com/greenpau/caddy-security

francislavoie 5y ago
(Caddy maintainer here) I don't use that plugin myself but AFAICT most users ask questions on the GitHub repo so probably best to ask for help there if you need it. As an aside, I've been working on making the Forward Auth usecase viable with Caddy, and we just got it working today https://github.com/caddyserver/caddy/pull/4739 https://github.com/caddyserver/caddy/pull/4739
- Loic 5y ago
  Thank you, my question was more a kind of bottle to the sea, if anybody was using it. I was able to configure the plugin nicely and get gitea as a source of users and groups to control access to other applications. And by the way, thank you, I am really impressed by the quality of Caddy.

orthoxerox 5y ago

Keycloak is a great piece of software if you have to authenticate against AD (on prem, not Azure AD). It's the best way to isolate all the crap like "user accounts live in this OU, but admin accounts live only in that OU. Oh, and we also have another domain where contractors live in the same OUs. And the groups that map to application roles are the same, but live in differently named OUs" and provide a simple OAuth 2.0/OIDC authentication/authorization interface to all this mess.

jcmontx 5y ago

I like IdentityServer4 even though is not supported anymore

sirmike_ 5y ago

Have used and brought keycloak into many companies over the years as a solution. Steep learning curve a little. But it essentially works as designed either as the IDP (rare in my exp) or as a IAM broker more common. Big companies need it because their hands are tied to old and inflexible vendor's APIs. However they can with some effort craft a branded and modern UI/UX. Backend works with just about anything old Auth related whilst supporting a newer modern Auth schemes. I am surprised IBM has not made RHEL ruin it yet. To say IBM is a slightly better steward of their open source efforts than Oracle never leaves one with much comfort.

sascha_sl 5y ago
The secret to making keycloak UI/UX good is to disregard the account console and build your own with the new accounts API (which the accounts2 console also uses). Also, if you just use one broker you can skip the login experience entirely.
0xbadcafebee 5y ago
RedHat never needed anyone's help to ruin things. Their solutions are poorly designed bloated crap that "can get the job done" if you run them within a RedHat platform and don't mind banging your head against a brick wall. Just because they're open source darlings doesn't mean we can't call a spade a spade.

spacemanmatt 5y ago

I've been running Keycloak for 4 years now, starting with version 10. I like a well-disciplined stack and Keycloak is a star. And that's huge considering my other big players are Vert.x and PostgreSQL.

mberning 5y ago

This part of the IAM space (SSO and AuthN) is so crowded with products, both paid and open source. When you look at governance, certification, lifecycle management, approvals, etc. there is almost nothing by comparison. A couple not so great commercial products and very little open source. Hopefully that changes.

ffo 5y ago
Agreed, I mean that's why we built our solution completely open source in an open saas model and certified [1] our solution. We even provide our pentest results publicly, after mitigation of course [2]. The value we provide, when you are using our cloud, is the operational peace of mind, global scalability with data residency and access to deep technological knowledge. We wrote some word about that in our blog [3] as well. 1. https://zitadel.ch/blog/openid-connect-certification https://zitadel.ch/blog/openid-connect-certification 2. https://zitadel.ch/blog/pentest-results-h1-2021 https://zitadel.ch/blog/pentest-results-h1-2021 3. https://zitadel.ch/blog/saas-vs-self-hosted https://zitadel.ch/blog/saas-vs-self-hosted
- mberning 5y ago
  That is very cool. It looks like you actually have a lot of overlap with an identity orchestration solution, such as Strata.
  - ffo 5y ago
    Hm, interesting it need to check that ;-)
mooreds 5y ago
> When you look at governance, certification, lifecycle management, approvals, etc What do you mean by these? Are you talking about SOC2/ISO27001 when you say certification? Are you talking about provisioning/deprovisioning users (SCIM, etc) when you say lifecycle management? What do you mean by approvals? Role changes requiring designated approval, or something else?

sharkbird2 5y ago

Keycloak is great, using it in several projects. The only thing I've been missing is support for IdP discovery services, such as https://seamlessaccess.org/ https://seamlessaccess.org/

la6472 5y ago

First of all it is not clear if it is stand alone OR SAAS product?

sascha_sl 5y ago
It's the open source project that RedHat SSO is derived from, in the same way that OKD is the open source project that OpenShift is derived from.
mooreds 5y ago
It is typically self-hosted. A quick google turned up this Keycloak SaaS offering: https://www.cloud-iam.com/ https://www.cloud-iam.com/

deleted 5y ago

[deleted]

burn_321 5y ago

Anyone who has used wso2 identity server? It's an open source identity solution with many customizations available, but it requires a license for commercial use though.

s1mon 5y ago

Does Keycloak or any of the alternatives mentioned here do a good job of supporting localization? What about customization of the email messages for lost password flows?

mooreds 5y ago
Can't speak for Keycloak, but FusionAuth supports localization of both user facing HTML and email/SMS messages. (Not the admin screens, alas.) More details here: https://fusionauth.io/docs/v1/tech/core-concepts/localization-and-internationalization https://fusionauth.io/docs/v1/tech/core-concepts/localizatio... 15 languages have user facing translations: https://github.com/FusionAuth/fusionauth-localization/ https://github.com/FusionAuth/fusionauth-localization/ Disclosure: I work for FusionAuth.
donatzsky 5y ago
Ory Kratos and Hydra are API only and so don't provide a UI. Localisation then is entirely up to you.
adlerhurst 5y ago
zitadel allows to change the texts of emails and login texts, but at the moment only for languages already supported at the moment of writing en, it, de disclaimer: I'm one of the authors of ZITADEL

zmmmmm 5y ago

Recently deployed Keycloak as a front end to hide legacy auth in our org and put OAuth in front of it. Despite the apparent complexity under the hood, it works great and no complaints so far. By and large, it just does what it says on the tin and works.

pax 5y ago

Slightly off-topic: Could anybody recommend a lightweight, self-hosted php IAM that would handle new accounts (with email confirmation), password recovery, maybe user groups? I've been using Wordpress a couple of times just for the user management, not very proud of that but I didn't know better :/

mooreds 5y ago
Geez, I don't know of any. If you have to stick with PHP (as opposed to using some of the other solutions mentioned in comments), I'd probably look to a framework. For example, here's Laravel's offering: https://laravel.com/docs/9.x/authentication#authentication-quickstart https://laravel.com/docs/9.x/authentication#authentication-q...
mekster 5y ago
SSO is not a blogging system. You don't choose by the language.
- pax 5y ago
  I'm not looking for SSO. Did I use IAM wrongly? I'm talking about tiny apps that do require a protected back-end access, generally for somewhat bootstrapped CSOs. Not looking for anything fancy, but rather quick and dirty. For example, updating a SQLite db via gSheets API. PHP as that's default for shared hosting.

advaitruia 5y ago

Other open source auth solutions: Ory, SuperTokens.com , Supabase / GoTrue If anyone has evaluated these / Keycloak, I'd be happy to have a discussion on it

mekster 5y ago
What are your experiences? There are also Authentik, Authelia, Dex and gluu. There was a bad review of gluu in Reddit. https://www.reddit.com/r/selfhosted/comments/fxotbi/experiences_with_keycloak_alternatives/fn1u3p4/ https://www.reddit.com/r/selfhosted/comments/fxotbi/experien...
adlerhurst 5y ago
i'm biased but another solution is zitadel. Would be happy to discuss :)

navbaker 5y ago

Transitioning a preexisting web stack in our corporate network from Identity Server to Keycloak has been my extremely rough intro to the world of auth. I would say I’m almost there, but have one issue holding me up. We have a few different data enclaves, including one that requires users to sign an NDA and be added to an AD group. I’ve been searching high and low to see if Keycloak has a simple flag to say “don’t let anyone in that isn’t a member of this AD group”. Does that exist or do I have to create groups in Keycloak itself and add users manually?

cpitman 5y ago
Sounds like you want to configure a Group Mapper: https://www.keycloak.org/docs/latest/server_admin/#_ldap_mappers https://www.keycloak.org/docs/latest/server_admin/#_ldap_map...

oauea 5y ago

I think keycloak is fantastic. The only thing I don't really like is how the user profile is deeply baked into the code. It seems they're working on improving this, but at least currently, it is not possible to have users that do not use a "First name" and a "Last name". Which is rather annoying when using it for things like game servers, where people just want to go by their username.

MrTawti 5y ago

I used Keycloak about 4 or 5 years ago in a former job. It did work very well. Note however, that we did not need to customize anything nor did we have to deal with scaling (in house web-app where it was rare to have more than 100 people using on it at any given day). Right now, I'm looking into https://supertokens.com/ https://supertokens.com/ I have not used it in any capacity but it does seem much more approachable -at least to me- and allows for much flexibility (code wise on your own Backend). I would be interested in hearing if anyone here has any feedback.

advaitruia 5y ago
I'm of the project creators. Happy to discuss your specific use case and evaluate different providers. Some recent feeedback: "Hi yes, we are testing SuperTokens right now, and we are loving it Thanks for the great tool btw. it is really comfortable to integrate it into the project. at first we decided to use Keycloak, spent a week to customize it for our needs. It was soooo painful :sweat_smile: then we started looking for alternatives" "Been using it a bit for a pet project and I am quite impressed of how many integrations and documentation I find on its page. Also, really easy to use!" Just in case you are wondering where I found out about SuperTokens, it was on HackerNews"

deleted 5y ago

[deleted]

EtienneK 5y ago

Keycloak is great! Just wish it didn't need so much RAM (2GB at least).

jcadam 5y ago

Keycloak is great if you need an SSO solution. We had a large number of small in-house applications at my previous job and managing logins was becoming a pain. At my current job we use Okta. While the documentation is better, I don't think I prefer it over KC.

mekster 5y ago

I've integrated keycloak for SSO between several self hosted apps and boy I had no idea what I was doing but copy paste config from left and right from various sites which worked in the end but does SSO have to be this complicated? Can someone recommend a simpler solution to integrate SSO with online tools (like NextCloud, Discourse, Wiki.js, Gitea etc)? Does anyone have experience with Authentik?

zmxz 5y ago
I've used many solutions, even built my own in the end. Problem is that there's no software that can make SSO easy to understand if you don't know everything about SSO to begin with. SSO is not that complicated to work with, the docs are just stupidly difficult to read and the point of the whole process is rarely explained. Learning how without knowing why is nearly impossible.
- mooreds 5y ago
  > even built my own in the end. Can you tell me more about this? Did you end up building your own from the ground up, or leveraging existing libraries? Is it open source/available for others to use?

JacobiX 5y ago

I've integrated keycloak for SSO in our apps, we have a one-to-one mapping between keycloak realms and the tenants in our apps, works great and it can glue together many disparate IdP/auth solutions: onelogin, LDAP/AD, etc. At one moment we needed to implement a custom OTP method, so we developed a plugin by implementing a simple SPI (the auth flow is configurable). It is a very stable piece of software, we have a combination of Terraform+ansible scripts to deploy it, and once it is done we forget about it until we need to upgrade the version using the same scripts. The biggest drawback IMHO is the documentation quality ...

jcon321 5y ago

have a keycloak dev server been running for 6 years with literally 0 maintenance... it's a well crafted piece of software

offminded 5y ago

I had to decide between Keycloak and Supertokens just last week.. Gone through both of their documentation and repos and decided to go with Supertokens. Backend and Frontend flexibility and their instant Discord support to my questions was a huge plus for me.

advaitruia 5y ago
Awesome! One of the project creators here, glad to hear you're having a good experience so far

miovoid 5y ago

It’s Java based :—(

nickserv 5y ago
I'm not a big fan of Java personally, as in I would not start a side project with it. But in this case it's actually a great choice. Static typing, stable, mature, good performance, known by tons of engineers all over the world... And heavily used in the enterprise market which has a very real need for SSO.
sigzero 5y ago
Yup, and to me that's great and goes into the "pros" and not "cons" column.

miovoid 5y ago

It’s Java based :-(

rad_gruchalski 5y ago

Went through so many of these systems and keep coming back to keycloak exactly because of its monolithic architecture and authorisation services. There are so many great things in keycloak, I very much like SPIs and authorisation services (uma2).

seymon 5y ago

I which all the keycloak login and email themes would be more flexible and could use custom client attributes, realm settings etc. Another missing thing is multi tenancy within a realm. Because managing a huge number of realms is a configuration nightmare.

password4321 5y ago

Is Keycloak something that is intended to be exposed publicly, or is this something typically used behind a VPN or equivalent protection?

mooreds 5y ago
It depends on what your needs are. If you are using it for CIAM (customer identity and access management) then you are probably going to be putting it on the internet. If using it for internal IAM (identity and access management, also known as workforce identity) you can keep it inside your network. I believe Keycloak works either way.
- password4321 5y ago
  Thanks. I was mostly wondering how comfortable "Hacker News" is exposing it publicly... going on zero experience and just gut feeling I put it at about the same level as RDP.
  - mooreds 5y ago
    Ah, I get what you are asking. I think it's far more secure than RDP because the protocols it's based on have learned lessons from RDP. Here's a document they have about securing Keycloak: https://www.keycloak.org/docs/latest/server_admin/#mitigating-security-threats https://www.keycloak.org/docs/latest/server_admin/#mitigatin... I too would be interested to hear from any folks running this software in prod how they deal with securing a public endpoint.

vosper 5y ago

Is Keycloak a good option if I want to setup a SAML Service Provider using user records from my own MySQL database? I've looked at Okta and Keycloak and it's not really obvious to whether I'm supposed to give up my User table and let the auth system handle it, or whether the user data ends up being spread between my DB and the auth system (I think that's how Okta would be implemented). I know I could roll my own with PassportJS or something, but I'd like all the nice Okta stuff (MFA, password policies, SAML SSO, maybe federation) but integrated with my existing DB. Or is that just too much to ask?

mooreds 5y ago
Are you asking if you can use Keycloak with your own user table? Typically these identity providers want to own the user, so would expect you to port the user info, including password hashes, into them. If you have data that is user related but not auth related (application specific data), I've seen a few patterns: * Push it all into the auth provider. Not sure about keycloak, but some providers have the ability to store arbitrary data (a blob, basically) about a user. * Create a table in your database with an identifier provided by Keycloak, preferably an immutable one. Then when a user logs in, you can find their identifier, then look up the application specific data. If you want to have all PII in one place, the former option is best. If you want to maximize your flexibility, the latter is what I'd suggest. If you want to keep the user data in your database, I'd look at a library (as you suggest). It's a different class of solution than a standalone auth provider like Keycloak.
- vosper 5y ago
  > Are you asking if you can use Keycloak with your own user table? Yes, that's what I'm asking. Because my User table has relationships with the rest of my database, and I want to keep that (user X owns application-item Y; User X created Comment Z on application-item Y, etc... you get it). > Create a table in your database with an identifier provided by Keycloak, preferably an immutable one. Then when a user logs in, you can find their identifier, then look up the application specific data. This looks like a good option to me. I'd be fine with PII in Keycloak, and app-specific stuff in my database, provided there's a solid link between the two. If the user wants to change their email, that goes into Keyclock, and if they do something else that is connected to the application function that goes into the app DB. Thanks!

amaccuish 5y ago

I like Keyloack, but omg it's ridiculously difficult when using the docker container to import a CA cert. May Java Keystore burn in hell.

altonaut 5y ago

Is there a minimal config to run and setup keycloak with docker for local development? Most sources suggest exporting and reusing a reale-export.json, but it is missing the user datas and includes lots of (default) options and random uuids. There is a example repo, but it seems out of date and missing some settings: https://github.com/keycloak/keycloak-demo/blob/master/demo-realm.json https://github.com/keycloak/keycloak-demo/blob/master/demo-r...

sigzero 5y ago

Is there a comparison somewhere of Keycloak vs ForgeRock AM?

gumarn_y 5y ago

[dead]

vcryan 5y ago

I'm a fan of KeyCloak and use in prod. My biggest complaint though, is the storage of configuration in a database. This makes deployment complex, because you can't just deploy code, you must also mutate your database on each deploy (in many cases). I'm looking into a more modern approach, perhaps disallowing any system admin access (only user admin) and requiring all configurations changes to be applied via code using the API... please provide any recommendations for a better approach!