4 ms·

I've just started using Keycloak to provide OpenID for F# Safe stack applications. Wow the learning curve was steep on that one. Not having ever touched OpenID

by xupybd 4y ago

I've just started using Keycloak to provide OpenID for F# Safe stack applications. Wow the learning curve was steep on that one. Not having ever touched OpenID or anything other than forms based authentication and not knowing ASP.Net very well. But it's neat to get it all up and running. Still a few issues with getting Keycloak to redirect to HTTPS but we will get there.

rad_gruchalski 4y ago
Maybe this will be helpful? https://gruchalski.com/posts/2022-02-20-keycloak-1700-with-tls-behind-envoy/ https://gruchalski.com/posts/2022-02-20-keycloak-1700-with-t.... I’m the author.
- xupybd 4y ago
  Thank you! That looks like the exact problem I'm facing. I'll try it out today! Thanks again!
- andix 4y ago
  That’s exactly what needs to be done. It is also in the keycloak documentation, but not as easy to find as in your post.
  - rad_gruchalski 4y ago
    Thanks. I have recently rolled out Keycloak on k8s with Istio and ACME cert-manager. I’m going to write an article about it and post here when I find some time.
andix 4y ago
The most disappointing problem with asp.net for me was, that there is no backchannel logout. So you can’t easily force-logout users from oidc/keycloak. Everything else was going pretty smooth, although the authentication documentation for asp.net really sucks.
- xupybd 4y ago
  Yeah I've hit that. So if you log them out in your application that will remove the cookies and they won't show as logged in but the next redirect to Keycloak shows an error. The documentation sucks for ASP.net and it's far worse for the Safe stack. You have to understand the stack so you have to read up on the following. ASP.net Giraffe Saturn Fable remoting Keycloak OpenID Once you have a good understanding of all of those you can start to understand the half a dozen blog posts that attempt something similar.
  - andix 4y ago
    You can do a logout via redirect though. So you have to call SignOutAsync on the oidc scheme, and then the user will get redirected to a logout page. Need to enable SaveTokens in session though, because you need the logout token for that. If you have any issues, please ask and I will post some (short!) code snippets here :) Ps: I also love f#, but I concluded that it’s not worth using it for asp.net. There are just too many f# specific things you need to figure out first. Just going with c# is the safer bet. But you can still use f# for your service layer and for tests!
pharmakom 4y ago
Been doing similar stuff and found that ASP.Net stuff wasn’t worth the hassle compared to a custom set of functions on top of Giraffe.
- xupybd 4y ago
  Yeah you're right. I built my own auth, forms based with blowfish encryption is a few hours. Then I felt like I was doing it wrong. So I looked at OpenID. It's been two weeks and it just working. It'll take me. A few days to document it well enough to be happy I can keep it running. I made a poor choice and introduced too much complexity.

by xupybd 4y ago

rad_gruchalski 4y ago

Maybe this will be helpful? https://gruchalski.com/posts/2022-02-20-keycloak-1700-with-tls-behind-envoy/ https://gruchalski.com/posts/2022-02-20-keycloak-1700-with-t.... I’m the author.

xupybd 4y ago
Thank you! That looks like the exact problem I'm facing. I'll try it out today! Thanks again!
andix 4y ago
That’s exactly what needs to be done. It is also in the keycloak documentation, but not as easy to find as in your post.
- rad_gruchalski 4y ago
  Thanks. I have recently rolled out Keycloak on k8s with Istio and ACME cert-manager. I’m going to write an article about it and post here when I find some time.

andix 4y ago

The most disappointing problem with asp.net for me was, that there is no backchannel logout. So you can’t easily force-logout users from oidc/keycloak. Everything else was going pretty smooth, although the authentication documentation for asp.net really sucks.

xupybd 4y ago
Yeah I've hit that. So if you log them out in your application that will remove the cookies and they won't show as logged in but the next redirect to Keycloak shows an error. The documentation sucks for ASP.net and it's far worse for the Safe stack. You have to understand the stack so you have to read up on the following. ASP.net Giraffe Saturn Fable remoting Keycloak OpenID Once you have a good understanding of all of those you can start to understand the half a dozen blog posts that attempt something similar.
- andix 4y ago
  You can do a logout via redirect though. So you have to call SignOutAsync on the oidc scheme, and then the user will get redirected to a logout page. Need to enable SaveTokens in session though, because you need the logout token for that. If you have any issues, please ask and I will post some (short!) code snippets here :) Ps: I also love f#, but I concluded that it’s not worth using it for asp.net. There are just too many f# specific things you need to figure out first. Just going with c# is the safer bet. But you can still use f# for your service layer and for tests!

pharmakom 4y ago

Been doing similar stuff and found that ASP.Net stuff wasn’t worth the hassle compared to a custom set of functions on top of Giraffe.

xupybd 4y ago
Yeah you're right. I built my own auth, forms based with blowfish encryption is a few hours. Then I felt like I was doing it wrong. So I looked at OpenID. It's been two weeks and it just working. It'll take me. A few days to document it well enough to be happy I can keep it running. I made a poor choice and introduced too much complexity.