4 ms·
Ohh, looks extremely promising, I've been after something with a bit more flexibility than Dex while not being Keycloak/Java etc, an LDAP backend would be aweso
by throwaway67743 3y ago
Ohh, looks extremely promising, I've been after something with a bit more flexibility than Dex while not being Keycloak/Java etc, an LDAP backend would be awesome as well though (another thing thats lacking is a simple ldap server, perhaps with sql as db, openldap is excessive and glauth isn't there)
- bo0tzz 3y agoHave you had a look at Authentik? It might fit your needs.
- throwaway67743 3y agoI think I did and when I couldn't find useful installation details I gave up, I don't use docker or kubernetes, so if projects can't be bothered to make information available for a generic install, I immediately lose interest.
- jauntywundrkind 3y agoI do plenty of native installs, and I find Docker based instructions to be a pretty nice universal codex for how things work. Docker entryscripts sometimes have significant magic baked in (alas), but quite often Docker is a distribution mechanism more than anything else. The Docker guides are - 9 times out of 10 - more than informative enough to show how to DIY in any other of the dozens if not hundreds of other system types you might have. If you want to resist using the easy thing, I personally think it behooves you to not bounce so quick. You don't have to use it, and it's good nearly universal documentation as to how to operate the thing.
- throwaway67743 3y agoIt means I have to sit and read through the Dockerfile (or compose, in many cases, which is even worse) and figure out what its doing and what magic variables I need to provide etc, when just providing a binary download url and an example (or reference) config does just fine, not everyone uses docker
- codegeek 3y ago"using the easy thing" Easy != Simple. Not everyone wants to play around with Dockerfiles, docker compose and what not. Sometimes a plain binary is preferred. I say this as someone who likes docker for certain use cases but docker is not my solution for everything.
- BodyCulture 3y agoapt install more easy and with auto updates safe! Docker too complicated, networking, security, dependencies, all messy after all these years. Apt rules!
- throwaway67743 3y agoPodman makes this better, as it doesn't trash my ipt/nft rules in the process, and its essentially stateless amongst other useful things
- apitman 3y agoHow's the network performance on podman? It defaults to slirp4netns right?
- throwaway67743 3y agoProbably for user containers, but I've only ran it as root generally to avoid those sorts of limitations so haven't noticed any issues - I rarely use docker and only use for quick testing and then switch to non-docker installs
- eriksjolund 3y agoRootless Podman uses slirp4netns by default. The default will soon change to pasta. Pasta has better performance than slirp4netns. For best performance if your container supports it, use systemd socket activation because the traffic over the activated socket will have native network performance.
- apitman 3y agoI'd never heard of that systemd trick. Interesting, thanks.
- eriksjolund 3y agoHere are some documentation and demos from me and others if you're interested: https://github.com/eriksjolund/podman-networking-docs https://github.com/eriksjolund/podman-networking-docs https://github.com/eriksjolund/podman-nginx-socket-activation https://github.com/eriksjolund/podman-nginx-socket-activatio... https://github.com/eriksjolund/socket-activate-httpd https://github.com/eriksjolund/socket-activate-httpd https://github.com/eriksjolund/mariadb-podman-socket-activation/tree/main https://github.com/eriksjolund/mariadb-podman-socket-activat... https://github.com/PhracturedBlue/podman-socket-activated-services https://github.com/PhracturedBlue/podman-socket-activated-se...
- XorNot 3y agoWhat's wrong with glauth? I forked it so I could build in the /etc/passwd support and it's been working great.
- grepfru_it 3y agoLike raw /etc/passwd support or passwd support via PAM? Should always use PAM over reading passwd/shadow directly
- throwaway67743 3y agoI stand corrected, looks like its come a long way since I last checked - will have to give it another go
- nitnelave 3y agoHave you had a look at LLDAP for a super simple LDAP backend with SQL behind? That or kanidm if you want OIDC built in.
- throwaway67743 3y agoI hadn't seen that, thanks! even has clear information on how to build natively and has a reference config
- rescbr 3y agoI’ve found running Samba as a Domain Controller pretty straightforward for this exact use case.
- BodyCulture 3y agoAs userdb for keycloak? Please write about it!
- rescbr 3y agoHaven't tried specifically with keycloak, but it should work. Keycloak advertises LDAP and MS Active Directory compatibility. If I find the time, I can test and write up about this integration.