6 ms·

My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already

My company used Keycloak for a long time (I'm not there any more) and I agree with everyone here, it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary. While Keycloak is a great out-of-the-box solution, my #1 complaint at the time was how heavyweight it was, which was a burden for development, followed closely by its packaging as a J2EE app and bundling with Wildfly (at the time). This meant we needed to know not only about Keycloak itself, but also about Wildfly's special quirks, the clustering system (Infinispan??), Java and Docker. Now it's packaged with Quarkus, which is another dependency to learn about, and to be honest despite the quality of the finished product, all those dependencies have become pretty off-putting. So while I can recommend Keycloak's functionality, if you're not already deploying Java apps as part of your job, I suspect it will present a pretty serious administrative burden to deploy into serious production.

maxbaines 5y ago
For me this is all kind of opaque, apart from a theme put into a folder and some Environment Variables set i don't touch anything in Keycloak, first had no requirement to consider it and second very likely would be doing something maybe not best practice i.e oidc, oauth based. Its the only java app we run in stack, but doesn't matter to me in Docker and within Windows we run a portable java from a subfolder of keycloak so not System wide in Path
littlecranky67 5y ago
Was working at a Java shop once which used Keycloak as a central IAM solution. As an FE Dev, I was tasked to customize/style the login-page provided by Keycloak, and quickly faced what you described: Pretty heavily Java-based, even to edit HTML templates I had to recompile using a full blown Java/JVM stack. As an FE dev without Java background, this became pretty difficult. But once we finished that with the help of some of the BE Java devs, it ran (and still runs) quite stable and also the KeycloakJS adapter I integrated was alright without much surprises.
- spacemanmatt 5y ago
  Java backend/React frontend dev here. I customized Keycloak 10 login page a while back, and it did not require anything but markup. My Keycloak 18 instance runs the same customization now, unchanged.
- oauea 5y ago
  > even to edit HTML templates I had to recompile using a full blown Java/JVM stack Next time check the docs and turn off the theme cache: https://www.keycloak.org/docs/latest/server_development/#creating-a-theme https://www.keycloak.org/docs/latest/server_development/#cre... > While creating a theme it’s a good idea to disable caching as this makes it possible to edit theme resources directly from the themes directory without restarting Keycloak.
- psnehanshu 5y ago
  Why customize the FE when you can use the keycloak-js[1] NPM library to integrate with any JS framework? [1] https://www.npmjs.com/package/keycloak-js https://www.npmjs.com/package/keycloak-js
  - littlecranky67 5y ago
    Because that is not how you customize the login/signup page that lives inside Keycloak (and its Docker image, if you use docker).
    - psnehanshu 5y ago
      Sorry, my misunderstanding.
ffo 5y ago
You might want to have a look on zitadel [1] If you are intrigued into the differences, you can read some of them here [2] Oh and judging from your username: it could be interesting to you... because we use eventsourcing and cqrs ;-) Disclaimer: I am one of the authors 1. https://github.com/zitadel/zitadel/ https://github.com/zitadel/zitadel/ 2. https://zitadel.ch/blog/zitadel-vs-keycloak https://zitadel.ch/blog/zitadel-vs-keycloak
- sebmellen 5y ago
  What is your opinion on ORY, specifically ORY Kratos? We have been building on Kratos for some time now and find that it is not super well documented, but it is still a very pleasant experience and their ORY Cloud project is backed by support from their team. How does Zitadel differ/compare? Do you have similar goals as an organization?
  - ffo 5y ago
    Well to keep it brief, we see it the following way. Use: - ZITADEL: If you want turnkey solution built for the cloud with a great support for B2B, a strong audit trail and self-hosting, but also the option for SaaS - Ory: If you want flexibility to customize all the stuff but are aware that it is not as turnkey as ZITADEL and Keycloak - Keycloak: If you want turnkey with a high maturity and a lot of features but some lack in regard to B2B, cloud native and support This more or less reflects my opinion about Ory. I like the way they built their suite because its totally flexible. But it dislike the fact that it does not feel like a turnkey solution and needs some more work than plugin in a OIDC client. So what we think and aim for is that ZITADEL combines the best of Auth0 and Keycloak [1] while bringing some unique features to the table. For example an unlimited audit trail (built with event sourcing), great self-service capabilities for B2B and B2C cases (customers can manage their own org, user, federation, access) and the possibility to soon run "serverless" (well at least as serverless container). With our cloud service we also allow customer soon to move their data around (see data location [2]). And all of this while being totally open source. 1. Funny image for this https://twitter.com/ffo_sesp/status/1519655412752162818?s=20&t=9RKg_pqBj5PD8gGaYKsejQ https://twitter.com/ffo_sesp/status/1519655412752162818?s=20... 2. https://zitadel.ch/pricing/v2 https://zitadel.ch/pricing/v2
mooreds 5y ago
We hear comments like this a lot. Keycloak has a lot of functionality but also a lot of quirks. We have a product, FusionAuth, that folks often consider at the same time. Similarities between our products: * Overall base feature set (OAuth, OIDC, SAML, user management, authentication, RBAC) is similar. * Both written in Java. * Both use container technology to hide Java from you :) * Both offer commercial support (Redhat SSO is the commercial offering for Keycloak, FusionAuth has paid editions with support). FusionAuth is much less expensive (compare https://marketplace.redhat.com/en-us/products/red-hat-single-sign-on/pricing https://marketplace.redhat.com/en-us/products/red-hat-single... with https://fusionauth.io/pricing https://fusionauth.io/pricing .) * Both offer the ability to self-host. * Both develop in the open (we use GitHub issues, they use a mailing list). Differences: * They're OSS, we are free as in beer. * I haven't found a compelling hosting solution for Keycloak, most folks self host. FusionAuth offers a hosted product if you'd like. * Keycloak has more niche features (CAS SSO support) and a bigger community. * FusionAuth has better, more straightforward docs. * FusionAuth user UI customization is easier. * FusionAuth supports a number of languages with client libraries for easier config management. I only saw a python client library for Keycloak. * FusionAuth supports unlimited tenants, limited only by your server's resources. We have folks running thousands of tenants. Last time I looked Keycloak had issues around 400 realms (their term for tenants): https://keycloak.discourse.group/t/maximum-limit-of-realms/8189 https://keycloak.discourse.group/t/maximum-limit-of-realms/8... Disclosure: I work for FusionAuth.
- oauea 5y ago
  > Disclosure: I work for FusionAuth. Don't worry, that was obvious.
  - mooreds 5y ago
    Ha ha, fair enough. I've found it better to err on the side of transparency.
    - freedomben 5y ago
      I would offer two suggestions that might improve reception: 1. Put that disclaimer at the top 2. Shrink it to no more than a couple sentences and link to a blog post or something for the detailed comparison. It looks pre-canned and kind of spammy the way it is now
advaitruia 5y ago
> my #1 complaint at the time was how heavyweight it was, which was a burden for development What do you mean by "heavyweight"? I ask because Java in other large open source projects (Elastic Search, Cassandra, Android) and it really depends on how its being used (by Keycloak as well) I've also come across GraalVM which can significantly reduce Java memory consumption (if that is something you are referring to)
- doctor_eval 5y ago
  Well just bear in mind that this was about 4 years ago (we were fairly early adopters apparently), and I understand that my comments here are probably no longer fair, and probably don't apply to KC at it is today. But since you asked, basically Keycloak was by far the single largest component of our stack, which didn't sit well with me because by any measure, our application was far more complex than Keycloak. At the time we were transitioning away from JEE to JSE microservices, and Keycloak was a full-blown JEE application with all the heaviness that we were successfully leaving behind; it took over a minute to start, while our other Java services would launch in less than a second. Of course this didn't impact production at all - but most engineering time is spent in development and testing, where this was a real problem, especially if we were experimenting with and learning about new features. All of this contributed to my perception of heaviness.
  - advaitruia 4y ago
    Fair enough, thank you for the explanation! Seems like your other Java services were not an issue though?
voidcommonstock 5y ago
Another OAuth2 server, that's well on the other side of the heavyweight spectrum vs. keycloak: https://github.com/curveball/a12n-server https://github.com/curveball/a12n-server
jbaczuk 5y ago
I knew I could smell Java when I went to their website...
- marcosdumay 5y ago
  Languages (actually, ecosystems) do have specific smells. You can perceive them on every artifact. It's an interesting observation.

maxbaines 5y ago

For me this is all kind of opaque, apart from a theme put into a folder and some Environment Variables set i don't touch anything in Keycloak, first had no requirement to consider it and second very likely would be doing something maybe not best practice i.e oidc, oauth based. Its the only java app we run in stack, but doesn't matter to me in Docker and within Windows we run a portable java from a subfolder of keycloak so not System wide in Path

littlecranky67 5y ago

Was working at a Java shop once which used Keycloak as a central IAM solution. As an FE Dev, I was tasked to customize/style the login-page provided by Keycloak, and quickly faced what you described: Pretty heavily Java-based, even to edit HTML templates I had to recompile using a full blown Java/JVM stack. As an FE dev without Java background, this became pretty difficult. But once we finished that with the help of some of the BE Java devs, it ran (and still runs) quite stable and also the KeycloakJS adapter I integrated was alright without much surprises.

spacemanmatt 5y ago
Java backend/React frontend dev here. I customized Keycloak 10 login page a while back, and it did not require anything but markup. My Keycloak 18 instance runs the same customization now, unchanged.
oauea 5y ago
> even to edit HTML templates I had to recompile using a full blown Java/JVM stack Next time check the docs and turn off the theme cache: https://www.keycloak.org/docs/latest/server_development/#creating-a-theme https://www.keycloak.org/docs/latest/server_development/#cre... > While creating a theme it’s a good idea to disable caching as this makes it possible to edit theme resources directly from the themes directory without restarting Keycloak.
psnehanshu 5y ago
Why customize the FE when you can use the keycloak-js[1] NPM library to integrate with any JS framework? [1] https://www.npmjs.com/package/keycloak-js https://www.npmjs.com/package/keycloak-js
- littlecranky67 5y ago
  Because that is not how you customize the login/signup page that lives inside Keycloak (and its Docker image, if you use docker).
  - psnehanshu 5y ago
    Sorry, my misunderstanding.

ffo 5y ago

You might want to have a look on zitadel [1] If you are intrigued into the differences, you can read some of them here [2] Oh and judging from your username: it could be interesting to you... because we use eventsourcing and cqrs ;-) Disclaimer: I am one of the authors 1. https://github.com/zitadel/zitadel/ https://github.com/zitadel/zitadel/ 2. https://zitadel.ch/blog/zitadel-vs-keycloak https://zitadel.ch/blog/zitadel-vs-keycloak

sebmellen 5y ago
What is your opinion on ORY, specifically ORY Kratos? We have been building on Kratos for some time now and find that it is not super well documented, but it is still a very pleasant experience and their ORY Cloud project is backed by support from their team. How does Zitadel differ/compare? Do you have similar goals as an organization?
- ffo 5y ago
  Well to keep it brief, we see it the following way. Use: - ZITADEL: If you want turnkey solution built for the cloud with a great support for B2B, a strong audit trail and self-hosting, but also the option for SaaS - Ory: If you want flexibility to customize all the stuff but are aware that it is not as turnkey as ZITADEL and Keycloak - Keycloak: If you want turnkey with a high maturity and a lot of features but some lack in regard to B2B, cloud native and support This more or less reflects my opinion about Ory. I like the way they built their suite because its totally flexible. But it dislike the fact that it does not feel like a turnkey solution and needs some more work than plugin in a OIDC client. So what we think and aim for is that ZITADEL combines the best of Auth0 and Keycloak [1] while bringing some unique features to the table. For example an unlimited audit trail (built with event sourcing), great self-service capabilities for B2B and B2C cases (customers can manage their own org, user, federation, access) and the possibility to soon run "serverless" (well at least as serverless container). With our cloud service we also allow customer soon to move their data around (see data location [2]). And all of this while being totally open source. 1. Funny image for this https://twitter.com/ffo_sesp/status/1519655412752162818?s=20&t=9RKg_pqBj5PD8gGaYKsejQ https://twitter.com/ffo_sesp/status/1519655412752162818?s=20... 2. https://zitadel.ch/pricing/v2 https://zitadel.ch/pricing/v2

mooreds 5y ago

We hear comments like this a lot. Keycloak has a lot of functionality but also a lot of quirks. We have a product, FusionAuth, that folks often consider at the same time. Similarities between our products: * Overall base feature set (OAuth, OIDC, SAML, user management, authentication, RBAC) is similar. * Both written in Java. * Both use container technology to hide Java from you :) * Both offer commercial support (Redhat SSO is the commercial offering for Keycloak, FusionAuth has paid editions with support). FusionAuth is much less expensive (compare https://marketplace.redhat.com/en-us/products/red-hat-single-sign-on/pricing https://marketplace.redhat.com/en-us/products/red-hat-single... with https://fusionauth.io/pricing https://fusionauth.io/pricing .) * Both offer the ability to self-host. * Both develop in the open (we use GitHub issues, they use a mailing list). Differences: * They're OSS, we are free as in beer. * I haven't found a compelling hosting solution for Keycloak, most folks self host. FusionAuth offers a hosted product if you'd like. * Keycloak has more niche features (CAS SSO support) and a bigger community. * FusionAuth has better, more straightforward docs. * FusionAuth user UI customization is easier. * FusionAuth supports a number of languages with client libraries for easier config management. I only saw a python client library for Keycloak. * FusionAuth supports unlimited tenants, limited only by your server's resources. We have folks running thousands of tenants. Last time I looked Keycloak had issues around 400 realms (their term for tenants): https://keycloak.discourse.group/t/maximum-limit-of-realms/8189 https://keycloak.discourse.group/t/maximum-limit-of-realms/8... Disclosure: I work for FusionAuth.

oauea 5y ago
> Disclosure: I work for FusionAuth. Don't worry, that was obvious.
- mooreds 5y ago
  Ha ha, fair enough. I've found it better to err on the side of transparency.
  - freedomben 5y ago
    I would offer two suggestions that might improve reception: 1. Put that disclaimer at the top 2. Shrink it to no more than a couple sentences and link to a blog post or something for the detailed comparison. It looks pre-canned and kind of spammy the way it is now

advaitruia 5y ago

> my #1 complaint at the time was how heavyweight it was, which was a burden for development What do you mean by "heavyweight"? I ask because Java in other large open source projects (Elastic Search, Cassandra, Android) and it really depends on how its being used (by Keycloak as well) I've also come across GraalVM which can significantly reduce Java memory consumption (if that is something you are referring to)

doctor_eval 5y ago
Well just bear in mind that this was about 4 years ago (we were fairly early adopters apparently), and I understand that my comments here are probably no longer fair, and probably don't apply to KC at it is today. But since you asked, basically Keycloak was by far the single largest component of our stack, which didn't sit well with me because by any measure, our application was far more complex than Keycloak. At the time we were transitioning away from JEE to JSE microservices, and Keycloak was a full-blown JEE application with all the heaviness that we were successfully leaving behind; it took over a minute to start, while our other Java services would launch in less than a second. Of course this didn't impact production at all - but most engineering time is spent in development and testing, where this was a real problem, especially if we were experimenting with and learning about new features. All of this contributed to my perception of heaviness.
- advaitruia 4y ago
  Fair enough, thank you for the explanation! Seems like your other Java services were not an issue though?

voidcommonstock 5y ago

Another OAuth2 server, that's well on the other side of the heavyweight spectrum vs. keycloak: https://github.com/curveball/a12n-server https://github.com/curveball/a12n-server

jbaczuk 5y ago

I knew I could smell Java when I went to their website...

marcosdumay 5y ago
Languages (actually, ecosystems) do have specific smells. You can perceive them on every artifact. It's an interesting observation.