5 ms·

Is there an easy way to deploy Ory? Even just to test? At the moment I'm using Keycloak at work, authentik for side projects and authelia for personal ones wh

by pratio 3y ago

Is there an easy way to deploy Ory? Even just to test? At the moment I'm using Keycloak at work, authentik for side projects and authelia for personal ones where I don't need anything complicated. I couldn't find a deployment guide or a quick docker-compose. Also, If this link is still up-to date the self-hosted version is missing user and configuration management UIs https://www.ory.sh/ory-network-or-self-hosting-explained-use-cases/ https://www.ory.sh/ory-network-or-self-hosting-explained-use... Any reason to pick this over keycloak? we're planning to deploy passkeys and web-auth and it's also supported https://keycloak.ch/keycloak-tutorials/tutorial-passkey/ https://keycloak.ch/keycloak-tutorials/tutorial-passkey/ https://keycloak.ch/keycloak-tutorials/tutorial-webauthn/ https://keycloak.ch/keycloak-tutorials/tutorial-webauthn/

aeneas_ory 3y ago
For experimenting on your own machine, you can run Ory Kratos + the default user-facing UI in Docker. You can find the Docker Quickstart here: https://www.ory.sh/docs/kratos/quickstart https://www.ory.sh/docs/kratos/quickstart Generally, all self-hosting docs are in the self-hosting section of the docs: https://www.ory.sh/docs/ecosystem/projects https://www.ory.sh/docs/ecosystem/projects Ory Kratos does not do everything that we offer in the managed service. In particular the admin UI is not available (but the APIs and business logic are!), and the things we built around multi-region and multi-tenancy are not available in the open source self-hosted version. > Any reason to pick this over keycloak? Keycloak is an awesome open-source project! I never used Keycloak myself in a large production system. Here is a bit of feedback we hear from users who approach us. Keycloak - is great for small-to-medium user bases (e.g. for employee management which it was originally designed for) but has issues when scaling to millions of users / customer-facing - has a larger footprint due to Java - has no managed service - is tied to IBM (can be both good and bad, as we see with the RHEL changes. Can happen to any project though) Generally speaking, Ory is more componetized and domain driven. If you don't want OAuth2, you don't need it. If you only want OAuth2, you don't need to also use sign in from Ory. And so on! There's probably more differences but I think others with operational Keycloak experience can answer this better than me. Generally speaking, both projects have their place. If you're looking more for web-based customer identity management I would go in Ory's direction. If it's about enterprise employee management, Keycloak is an easier plug-and-play solution.
- pratio 3y ago
  Thank you so much for the links. I'll give it a shot this weekend. - You're probably right about Keycloak having a larger footprint. - We have between 400 to 500k users and it hasn't been an issue. - Can't comment on the IBM connection, I just don't know enough about it. - We do use multiple auth methods and deploying that was really easy. So it's definitely an easier plug-and-play solution, we've deployed it with k8s.
- stackthat0x 3y ago
  > Ory Kratos does not do everything that we offer in the managed service. In particular the admin UI is not available (but the APIs and business logic are!), and the things we built around multi-region and multi-tenancy are not available in the open source self-hosted version. Does the managed service use the same repo as Kratos with additional services not available to open source or do you use a forked/modified version of Kratos?
  - aeneas_ory 3y ago
    It’s mostly what’s on master plus ~15% additional code for multi-region and multi-tenancy. Other components such as the Ory Console are not open source
    - stackthat0x 3y ago
      Thanks for the reply much appreciated!!!
v3ss0n 3y ago
Authentik and authlia are the easiest for me.
- pratio 3y ago
  Absolutely, Authentik when you need complicated workflows but if you just need to put a login screen in front of page and use OIDC or LDAP with 2FA Authelia's got you covered.

by pratio 3y ago

aeneas_ory 3y ago

For experimenting on your own machine, you can run Ory Kratos + the default user-facing UI in Docker. You can find the Docker Quickstart here: https://www.ory.sh/docs/kratos/quickstart https://www.ory.sh/docs/kratos/quickstart Generally, all self-hosting docs are in the self-hosting section of the docs: https://www.ory.sh/docs/ecosystem/projects https://www.ory.sh/docs/ecosystem/projects Ory Kratos does not do everything that we offer in the managed service. In particular the admin UI is not available (but the APIs and business logic are!), and the things we built around multi-region and multi-tenancy are not available in the open source self-hosted version. > Any reason to pick this over keycloak? Keycloak is an awesome open-source project! I never used Keycloak myself in a large production system. Here is a bit of feedback we hear from users who approach us. Keycloak - is great for small-to-medium user bases (e.g. for employee management which it was originally designed for) but has issues when scaling to millions of users / customer-facing - has a larger footprint due to Java - has no managed service - is tied to IBM (can be both good and bad, as we see with the RHEL changes. Can happen to any project though) Generally speaking, Ory is more componetized and domain driven. If you don't want OAuth2, you don't need it. If you only want OAuth2, you don't need to also use sign in from Ory. And so on! There's probably more differences but I think others with operational Keycloak experience can answer this better than me. Generally speaking, both projects have their place. If you're looking more for web-based customer identity management I would go in Ory's direction. If it's about enterprise employee management, Keycloak is an easier plug-and-play solution.

pratio 3y ago
Thank you so much for the links. I'll give it a shot this weekend. - You're probably right about Keycloak having a larger footprint. - We have between 400 to 500k users and it hasn't been an issue. - Can't comment on the IBM connection, I just don't know enough about it. - We do use multiple auth methods and deploying that was really easy. So it's definitely an easier plug-and-play solution, we've deployed it with k8s.
stackthat0x 3y ago
> Ory Kratos does not do everything that we offer in the managed service. In particular the admin UI is not available (but the APIs and business logic are!), and the things we built around multi-region and multi-tenancy are not available in the open source self-hosted version. Does the managed service use the same repo as Kratos with additional services not available to open source or do you use a forked/modified version of Kratos?
- aeneas_ory 3y ago
  It’s mostly what’s on master plus ~15% additional code for multi-region and multi-tenancy. Other components such as the Ory Console are not open source
  - stackthat0x 3y ago
    Thanks for the reply much appreciated!!!

v3ss0n 3y ago

Authentik and authlia are the easiest for me.

pratio 3y ago
Absolutely, Authentik when you need complicated workflows but if you just need to put a login screen in front of page and use OIDC or LDAP with 2FA Authelia's got you covered.