5 ms·

As a possible alternative, I've recently started using Zitadel (https://zitadel.com/ https://zitadel.com/) which is a very full-fledged open source IDP, in acti

As a possible alternative, I've recently started using Zitadel (https://zitadel.com/ https://zitadel.com/) which is a very full-fledged open source IDP, in active development.

upcoming-sesame 4y ago
Ory Hydra / Kratos is another good one https://www.ory.sh https://www.ory.sh
- vsviridov 4y ago
  I guess with Zitadel they don't paywall any features, and with self-hosted option you get essentially the same thing as with hosted. I think you can probably even do multi-instance, however maybe without a management interface for that part of it... When I read Ory language, it says to me "you can try it out locally and itegrate, but we want you in our hosted solution right after" (I could be wrong, I was just glancing casually...)
  - rad_gruchalski 4y ago
    The Ory stack doesn’t hide any features behind a paywall. Their documentation is subpar, for sure. It’s a decent product but setting things up can be a bit dull. One has to thread multiple Github repos and their incomplete scattered documentation together. But once it works, it works.
- vbezhenar 4y ago
  Is there solid documentation or tutorial on deploying hydra + kratos? That's what stopped me last year. I've found some subtle pointers in some buried github issues, but nothing definitive. Which surprised me because one would thought that's the main use-case for many people and should be documented well.
  - whilenot-dev 4y ago
    there's the repository with examples: https://github.com/ory/examples https://github.com/ory/examples
dariusj18 4y ago
This looks very interesting, I have recently tried using auth0 and was so horribly disappointed with how you go from 0 to enterprise as soon as you need any modern security feature. Plus I had assumed that they had a mature product, but is chaotic and difficult to know what you are doing for even the simplest use cases.
jonas-w 4y ago
How does zitadel compare to authentik (https://goauthentik.io/ https://goauthentik.io/) or authelia (https://www.authelia.com/ https://www.authelia.com/)?
- vsviridov 4y ago
  I don't think authelia has a UI, and it also has a mode where it integrates a bit more deeply with the routing mesh, to protect apps that do not do auth themselves. Authentik I've not looked into. It also seems that they differentiate self-hosted options into free and paid with different features...
  - rad_gruchalski 4y ago
    Any service mesh will integrate with any OpenID provider. It’s a token verification and a redirect.
  - mekster 4y ago
    It took 2 minutes to read Authentik's site to find this clause in pricing FAQ. > Features from the enterprise version are periodically moved to the open source version.
zinclozenge 4y ago
Zitadel could be amazing, but as far as I can tell they don’t allow using your own UI screens, and it’s not obvious to me how you’d build a multi tenant SSO feature. They have the concept of organizations, but it’s not obvious to me how you’d route a user to the right login.
- vsviridov 4y ago
  Organizations are tied to domains, but yeah, that part is more confusing than the rest... Instance also has a domain on top of that, but there are plans for a "simple" mode, assuming single org.
  - zinclozenge 4y ago
    I mean nothing wrong with using a domain for routing, but I think most SaaSes would rather have a routing based on the email address.
    - mffap 4y ago
      That's basically what it does. You can activate Domain Discovery and verify a Domain on an organization, with that zitadel routes users to the organization based on the suffix (ie. email domain)
      - zinclozenge 4y ago
        Thanks for clarifying, I must have missed it in the docs. If you see this comment, I'm wondering if this discovery functionality will also be customizable when the custom UI screens feature gets added?
- mffap 4y ago
  You can enable Domain Discovery to route users to the correct organization. Or you send a reserved scope with the auth request to select the organization. Building an own Login UI will be available in a couple of weeks (https://github.com/zitadel/zitadel/issues/5015 https://github.com/zitadel/zitadel/issues/5015)
hardwaresofton 4y ago
Wow Zitadel looks absolutely amazing. All the features you want out of login, permissive license, good pl choice, easy to deploy, postgres-first. Since I somehow can’t resist complaining about absolute mana from heaven: The only issue I see is this reliance on event sourcing — I get the reasoning but I much prefer regular state saving + audit log approaches. Event sourcing seems like a complexity and performance liability — does anyone have any insight on the implementation/why I am wrong about my misgivings?
- vsviridov 4y ago
  The amount of events in such system isn't going to be too crazy, unless it's some massive enterprise with thousands of principals, I would imagine... It also seems cockroachdb first, but I'm glad i can use postgres. One fewer database to deploy and manage, and for my use case (basically myself and occasional friends and family) that's perfectly fine.
  - hardwaresofton 4y ago
    > The amount of events in such system isn't going to be too crazy, unless it's some massive enterprise with thousands of principals, I would imagine... Right, but it's like... why take that liability in the first place when you have a rock solid and extensible DB like Postgres under the hood. Why not take the CQRS (good idea), but not go as far as full-on Event Sourcing, and just make sure you keep an audit table log or even executed operation log? IMO in practice almost on one actually goes back in time with Event Sourcing. Also there are so many things can bite you it just seems unnecessary. I did some digging through the code, and I really wish they'd made a big DB interface and then made the event store an implementation of that. It looks like they did it the other way -- the default interface being the event store, and PG/CockroachDB being the underlying. It's a subtle difference but means a huge deal for actual swappability of backends. https://github.com/zitadel/zitadel/blob/main/internal/eventstore/v1/eventstore.go#L12 https://github.com/zitadel/zitadel/blob/main/internal/events... I have to say, the code is also REALLY confusingly laid out. I just want to find the grpc/http handler that does like "create a user". I've been searching and clicking around for 10s of minutes -- maybe I don't read enough go. > It also seems cockroachdb first, but I'm glad i can use postgres. One fewer database to deploy and manage, and for my use case (basically myself and occasional friends and family) that's perfectly fine. I think of cockroachdb as basically postgres-with-stuff-bolted-on (albeit very good stuff, cockroach seems awesome), so I still consider it postgres-first! :)

As a possible alternative, I've recently started using Zitadel (https://zitadel.com/ https://zitadel.com/) which is a very full-fledged open source IDP, in active development.

upcoming-sesame 4y ago

Ory Hydra / Kratos is another good one https://www.ory.sh https://www.ory.sh

vsviridov 4y ago
I guess with Zitadel they don't paywall any features, and with self-hosted option you get essentially the same thing as with hosted. I think you can probably even do multi-instance, however maybe without a management interface for that part of it... When I read Ory language, it says to me "you can try it out locally and itegrate, but we want you in our hosted solution right after" (I could be wrong, I was just glancing casually...)
- rad_gruchalski 4y ago
  The Ory stack doesn’t hide any features behind a paywall. Their documentation is subpar, for sure. It’s a decent product but setting things up can be a bit dull. One has to thread multiple Github repos and their incomplete scattered documentation together. But once it works, it works.
vbezhenar 4y ago
Is there solid documentation or tutorial on deploying hydra + kratos? That's what stopped me last year. I've found some subtle pointers in some buried github issues, but nothing definitive. Which surprised me because one would thought that's the main use-case for many people and should be documented well.
- whilenot-dev 4y ago
  there's the repository with examples: https://github.com/ory/examples https://github.com/ory/examples

dariusj18 4y ago

This looks very interesting, I have recently tried using auth0 and was so horribly disappointed with how you go from 0 to enterprise as soon as you need any modern security feature. Plus I had assumed that they had a mature product, but is chaotic and difficult to know what you are doing for even the simplest use cases.

jonas-w 4y ago

How does zitadel compare to authentik (https://goauthentik.io/ https://goauthentik.io/) or authelia (https://www.authelia.com/ https://www.authelia.com/)?

vsviridov 4y ago
I don't think authelia has a UI, and it also has a mode where it integrates a bit more deeply with the routing mesh, to protect apps that do not do auth themselves. Authentik I've not looked into. It also seems that they differentiate self-hosted options into free and paid with different features...
- rad_gruchalski 4y ago
  Any service mesh will integrate with any OpenID provider. It’s a token verification and a redirect.
- mekster 4y ago
  It took 2 minutes to read Authentik's site to find this clause in pricing FAQ. > Features from the enterprise version are periodically moved to the open source version.

zinclozenge 4y ago

Zitadel could be amazing, but as far as I can tell they don’t allow using your own UI screens, and it’s not obvious to me how you’d build a multi tenant SSO feature. They have the concept of organizations, but it’s not obvious to me how you’d route a user to the right login.

vsviridov 4y ago
Organizations are tied to domains, but yeah, that part is more confusing than the rest... Instance also has a domain on top of that, but there are plans for a "simple" mode, assuming single org.
- zinclozenge 4y ago
  I mean nothing wrong with using a domain for routing, but I think most SaaSes would rather have a routing based on the email address.
  - mffap 4y ago
    That's basically what it does. You can activate Domain Discovery and verify a Domain on an organization, with that zitadel routes users to the organization based on the suffix (ie. email domain)
    - zinclozenge 4y ago
      Thanks for clarifying, I must have missed it in the docs. If you see this comment, I'm wondering if this discovery functionality will also be customizable when the custom UI screens feature gets added?
mffap 4y ago
You can enable Domain Discovery to route users to the correct organization. Or you send a reserved scope with the auth request to select the organization. Building an own Login UI will be available in a couple of weeks (https://github.com/zitadel/zitadel/issues/5015 https://github.com/zitadel/zitadel/issues/5015)

hardwaresofton 4y ago

Wow Zitadel looks absolutely amazing. All the features you want out of login, permissive license, good pl choice, easy to deploy, postgres-first. Since I somehow can’t resist complaining about absolute mana from heaven: The only issue I see is this reliance on event sourcing — I get the reasoning but I much prefer regular state saving + audit log approaches. Event sourcing seems like a complexity and performance liability — does anyone have any insight on the implementation/why I am wrong about my misgivings?

vsviridov 4y ago
The amount of events in such system isn't going to be too crazy, unless it's some massive enterprise with thousands of principals, I would imagine... It also seems cockroachdb first, but I'm glad i can use postgres. One fewer database to deploy and manage, and for my use case (basically myself and occasional friends and family) that's perfectly fine.
- hardwaresofton 4y ago
  > The amount of events in such system isn't going to be too crazy, unless it's some massive enterprise with thousands of principals, I would imagine... Right, but it's like... why take that liability in the first place when you have a rock solid and extensible DB like Postgres under the hood. Why not take the CQRS (good idea), but not go as far as full-on Event Sourcing, and just make sure you keep an audit table log or even executed operation log? IMO in practice almost on one actually goes back in time with Event Sourcing. Also there are so many things can bite you it just seems unnecessary. I did some digging through the code, and I really wish they'd made a big DB interface and then made the event store an implementation of that. It looks like they did it the other way -- the default interface being the event store, and PG/CockroachDB being the underlying. It's a subtle difference but means a huge deal for actual swappability of backends. https://github.com/zitadel/zitadel/blob/main/internal/eventstore/v1/eventstore.go#L12 https://github.com/zitadel/zitadel/blob/main/internal/events... I have to say, the code is also REALLY confusingly laid out. I just want to find the grpc/http handler that does like "create a user". I've been searching and clicking around for 10s of minutes -- maybe I don't read enough go. > It also seems cockroachdb first, but I'm glad i can use postgres. One fewer database to deploy and manage, and for my use case (basically myself and occasional friends and family) that's perfectly fine. I think of cockroachdb as basically postgres-with-stuff-bolted-on (albeit very good stuff, cockroach seems awesome), so I still consider it postgres-first! :)