4 ms·

Have you had a look at Ory (Kratos)? Its a "cloud-native"/modern alternative to Keycloak: https://github.com/ory/kratos https://github.com/ory/kratos

dijit 3y ago
I have, and we went back to keycloak- everything the parent says is true, however Ory/Kratos is a lesson in half finished solutions and poor documentation. we really tried quite hard, since it was backed by CNCF, but it could just be a case of being a tad too immature for prime time. it seems keycloak is now CNCF though
rad_gruchalski 3y ago
Ory Kratos is nowhere near Keycloak. First of all, one needs at least Kratos+Hydra (there’s an integration method now out of the box yay) but Keycloak still has a flexibility advantage. Keycloak has many more features out of the box comparing to the complete Ory stack. The only thing nicer in Kratos from Keycloak is the standalone self-service UI with JSON identity declaration. If someone from the Keycloak team is reading this, please, let’s have a talk about bringing that feature to Keycloak, then Keycloak will be perfect. The template approach is a bit of a hassle. Source: deployed both stacks in production systems.
- mnming 3y ago
  Another significant advantage of Kratos is that it's written in Golang, so it takes little to none resources for simple use cases. Also my experience with Keycloak in the past was that you can't do zero downtime deployment, or true configuration as code.
adeptima 3y ago
Found Ory (Kratos) customised registration flow as something over-engineered for my personal use cases. Very impressive ecosystem nevertheless. Show HN: Ory Kratos https://news.ycombinator.com/item?id=31679811 https://news.ycombinator.com/item?id=31679811 Most HN comments are still relevant
Keyframe 3y ago
What's nice about Ory Kratos/Hydra/Oathkeeper is that you can set 'groups' for your individual clients. In Keycloack that'd have to be a realm per client and if you have more than a couple, screw it. Don't know if something changed with Keycloack in last two years, but that's what nudged us towards Ory. Also, not sure how fast keycloack can get (plus caching) if you want to put it on-front of an API as an auth and throttle solution (you probably can't).

dijit 3y ago

I have, and we went back to keycloak- everything the parent says is true, however Ory/Kratos is a lesson in half finished solutions and poor documentation. we really tried quite hard, since it was backed by CNCF, but it could just be a case of being a tad too immature for prime time. it seems keycloak is now CNCF though

rad_gruchalski 3y ago

Ory Kratos is nowhere near Keycloak. First of all, one needs at least Kratos+Hydra (there’s an integration method now out of the box yay) but Keycloak still has a flexibility advantage. Keycloak has many more features out of the box comparing to the complete Ory stack. The only thing nicer in Kratos from Keycloak is the standalone self-service UI with JSON identity declaration. If someone from the Keycloak team is reading this, please, let’s have a talk about bringing that feature to Keycloak, then Keycloak will be perfect. The template approach is a bit of a hassle. Source: deployed both stacks in production systems.

mnming 3y ago
Another significant advantage of Kratos is that it's written in Golang, so it takes little to none resources for simple use cases. Also my experience with Keycloak in the past was that you can't do zero downtime deployment, or true configuration as code.

adeptima 3y ago

Found Ory (Kratos) customised registration flow as something over-engineered for my personal use cases. Very impressive ecosystem nevertheless. Show HN: Ory Kratos https://news.ycombinator.com/item?id=31679811 https://news.ycombinator.com/item?id=31679811 Most HN comments are still relevant

Keyframe 3y ago

What's nice about Ory Kratos/Hydra/Oathkeeper is that you can set 'groups' for your individual clients. In Keycloack that'd have to be a realm per client and if you have more than a couple, screw it. Don't know if something changed with Keycloack in last two years, but that's what nudged us towards Ory. Also, not sure how fast keycloack can get (plus caching) if you want to put it on-front of an API as an auth and throttle solution (you probably can't).