3 ms·
I can’t understand your first sentence even after reading it ten times. Maybe it is too long for me. To the second sentence: I don’t know what the benefit is e
by roboben 3y ago
I can’t understand your first sentence even after reading it ten times. Maybe it is too long for me.
To the second sentence: I don’t know what the benefit is either but in some environments you are not able to use any cloud provider or other external service to realize the auth layer so you are stuck with things like keycloak. Hope this thread discusses some other solutions which you can self host.
- vxNsr 3y agoI know the two main competitors that have been adopted by the self hosted community are authentik and authelia, they’re both somewhat under developed for enterprise but at the same time still difficult to grasp for non-full time devOps people. At least in my opinion.
- jsmith99 3y agoI use authentik for self hosted - it's great but still too powerful and configurable for me or most people who are not auth experts to customise. Just creating a password reset flow requires integrating a dozen moving parts. The only explanation how to do it is a yaml file or a YouTube tutorial. Setting up basic forward auth or OIDC was super easy though.
- Lacerda69 3y agouse cases that require _everything_ "on-premise" are often government/military, big healthcare, or just huge enterprises that want to control everything (and can afford a team that only runs their auth service). I mentioned Ory above but you get both options - either as a managed service or run on your own infra
- p_l 3y agoOr just places that don't want to give data to external, VC-funded or worse, vendors. I have clients that definitely prefer combination of open source + owner-controlled + lower costs ;)
- saynay 3y agoYep, this is why I have been evaluating it recently. Have a customer that wants SAML 2.0 support, others that want LDAP support, 2FA support, and multi-tenancy support, while being something we can self-host. The other main suggestions I have seen - ORY or Zitadel - tend to be missing at least one of those (from what I can tell). Keycloak looks like a big complicated monster, so I would prefer to stay away except that it looks like I will be required to have all that complexity to support all the use-cases we are looking at.
- selcuka 3y agoCurious. I'm not using Zitadel yet, but we are planning to. It seems to support all of those features. What was the missing part for you? https://zitadel.com/docs/apis/saml/endpoints https://zitadel.com/docs/apis/saml/endpoints https://zitadel.com/docs/guides/integrate/identity-providers/ldap https://zitadel.com/docs/guides/integrate/identity-providers... https://zitadel.com/docs/concepts/features/selfservice#mfa--2fa https://zitadel.com/docs/concepts/features/selfservice#mfa--... https://zitadel.com/docs/guides/migrate/introduction#multi-tenancy-architecture https://zitadel.com/docs/guides/migrate/introduction#multi-t... https://zitadel.com/blog/zitadel-as-sso-provider-for-selfhosting https://zitadel.com/blog/zitadel-as-sso-provider-for-selfhos...
- saynay 3y agoAs far as I can tell, Zitadel cannot be used as a SAML client, only as a provider. One of my requirements is that we use customer-provided (and controlled) SAML for SSO. Otherwise it was looking very promising.
- nebulousthree 3y agoThey mean that the software relies on the user understanding its, or the industry-it-serves's, jargon, to be used effectively.
- _cenw 3y agoWhich is extra funny when Keycloak is sticking to jargon out of RFCs that nobody else in the SaaS identity space is using. Hooking up Keycloak to a SAML consumer that only documents SaaS configuration is a fun game of try until it works most of the time.