3 ms·

> Regarding Keycloak, it is a great project with high maturity and a lot of features, but lacks in support for B2B, cloud-native and manufacturer support. Is t

> Regarding Keycloak, it is a great project with high maturity and a lot of features, but lacks in support for B2B, cloud-native and manufacturer support. Is this really true though? Last time I checked Keycloak was a RedHat project, meets the definition of cloud-native, and RedHat does provide RedHat Single Sign-On, a Keycloak-based service that is as B2B as it gets. Also, further down the discussion you commented that the project doesn't even provide a Docker image, and instead you mention an ongoing rewrite that might provide a stand-alone binary. https://news.ycombinator.com/item?id=31409609 https://news.ycombinator.com/item?id=31409609 How does that miss allow the project to even be considered cloud-ready, let alone could native?

ffo 4y ago
Currently we provide a container image as well as K8s support. The v2 will allow us to extend our support to a plain binary as well as serverless containers (Knative et. al) Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as well as self service federation. If you feel that I am mistaken, feel free to point out the docs to that ;-)
- piaste 4y ago
  > Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as well as self service federation. (See also: https://zitadel.com/blog/zitadel-vs-keycloak https://zitadel.com/blog/zitadel-vs-keycloak) I might be misreading your post and/or the linked blog post, but I got the impression that both assume that different business customers will share the same KC realm and will only be divided by groups/roles/etc. Is that correct? We use Keycloak in a multi-tenant scenario, so each new business customer spawns its own realm, meaning it can have a fully independent configuration (SSO, OAuth2 integration, 2FA, roles, etc.). While we provide a simplified UI in our product, a sufficiently technical customer can in principle be granted a realm-level administrator user to manage their own configuration.
  - ffo 4y ago
    From the IAM perspective (If the service is an IAM) I agree. But as SaaS provider I don’t want to use multiple realms because in that case my client would need to understand multiple issuers. Also Keycloak has a cutoff of around 400 ish realms last time I checked ;-)
    - X-Istence 4y ago
      Do you have a source for the cut-off at around 400 realms?
      - ffo 4y ago
        Only my own experience and secondary sources https://keycloak.discourse.group/t/maximum-limit-of-realms/8189 https://keycloak.discourse.group/t/maximum-limit-of-realms/8... https://stackoverflow.com/questions/54465114/when-realm-count-reaches-around-470-keycloak-basically-becomes-unstable https://stackoverflow.com/questions/54465114/when-realm-coun...
    - mooreds 4y ago
      Here's more about realms and keycloak from a different HN comment thread I participated in: https://news.ycombinator.com/item?id=31266603 https://news.ycombinator.com/item?id=31266603 I don't know abraae, but they seemed familiar with Keycloak.

ffo 4y ago

Currently we provide a container image as well as K8s support. The v2 will allow us to extend our support to a plain binary as well as serverless containers (Knative et. al) Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as well as self service federation. If you feel that I am mistaken, feel free to point out the docs to that ;-)

piaste 4y ago
> Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as well as self service federation. (See also: https://zitadel.com/blog/zitadel-vs-keycloak https://zitadel.com/blog/zitadel-vs-keycloak) I might be misreading your post and/or the linked blog post, but I got the impression that both assume that different business customers will share the same KC realm and will only be divided by groups/roles/etc. Is that correct? We use Keycloak in a multi-tenant scenario, so each new business customer spawns its own realm, meaning it can have a fully independent configuration (SSO, OAuth2 integration, 2FA, roles, etc.). While we provide a simplified UI in our product, a sufficiently technical customer can in principle be granted a realm-level administrator user to manage their own configuration.
- ffo 4y ago
  From the IAM perspective (If the service is an IAM) I agree. But as SaaS provider I don’t want to use multiple realms because in that case my client would need to understand multiple issuers. Also Keycloak has a cutoff of around 400 ish realms last time I checked ;-)
  - X-Istence 4y ago
    Do you have a source for the cut-off at around 400 realms?
    - ffo 4y ago
      Only my own experience and secondary sources https://keycloak.discourse.group/t/maximum-limit-of-realms/8189 https://keycloak.discourse.group/t/maximum-limit-of-realms/8... https://stackoverflow.com/questions/54465114/when-realm-count-reaches-around-470-keycloak-basically-becomes-unstable https://stackoverflow.com/questions/54465114/when-realm-coun...
  - mooreds 4y ago
    Here's more about realms and keycloak from a different HN comment thread I participated in: https://news.ycombinator.com/item?id=31266603 https://news.ycombinator.com/item?id=31266603 I don't know abraae, but they seemed familiar with Keycloak.