4 ms·

Building an entire directory app is hard though. And you want it to be highly resilient, right? What do you recommend?

mynameisnoone 3y ago
FreeIPA is pretty good for internal users when money is tight. It's a FOSS almost AD but for *NIX and it does HA. For the SSO part, Shibboleth2 or CAS.
smitty1110 3y ago
Keycloak [1]. Rock solid, supports everything, trusted everywhere. 1: https://www.keycloak.org/ https://www.keycloak.org/
- ExoticPearTree 3y ago
  I have to disagree with your assessment. It's not that rock solid, "supports everything" is a very vague term and "trusted everywhere" I'm not even sure that that is supposed to mean.
- lambda_garden 3y ago
  The docs are really poor. It makes me less confident that I have configured everything correctly.
- broast 3y ago
  They're desperate to get off keycloak at my org. Not sure the specifics, but our users complain about Auth issues often, and the keycloak web interface is painfully slow too.
  - elevation 3y ago
    I’ve read you need to partition usage to limit each keycloak instance to about 1500 total users to avoid performance issues. Does this hold true in your org?
    - dividuum 3y ago
      Not saying this isn't true, but wtf? How could such a laughable number of users cause any kind of performance issue?
      - elevation 3y ago
        It looks like it's 'entities' and not just 'users'. From the docs [0]: Keycloak allows you to create any number of realms and any number of clients and users in them. But you need to be thoughtful as you scale up because as the number of entities grows, Keycloak slows down. When you log in as a superuser in the admin panel, even if you have only 1,500 realms, it will take a few minutes or even crash on timeout. Creating a new realm will take about 20 to 30 seconds. You need to change your logic and interaction with Keycloak. [0]: https://www.redhat.com/architect/oauth-20-authentication-keycloak https://www.redhat.com/architect/oauth-20-authentication-key...
    - mooreds 3y ago
      I work for a competitor. I haven't heard that, but have heard of perf problems with > 1000 realms (tenants). https://keycloak.discourse.group/t/maximum-limit-of-realms/8189/6 https://keycloak.discourse.group/t/maximum-limit-of-realms/8... has some details, though comments are 1-2 years old so may be out of date.
    - smitty1110 3y ago
      I work with an org that has 10's of thousands of users on keycloak, so there must be a way around the problem. I'm not administering the instance for this project, so I have no direct insight into how they deal with it.
Timshel 3y ago
There was a recent discussion on Obligator recently, I did not test it. But they have a nice table with a list of providers : https://github.com/lastlogin-io/obligator#comparison-is-the-thief-of-joy https://github.com/lastlogin-io/obligator#comparison-is-the-...
mooreds 3y ago
I work for FusionAuth which has a free community edition[0], so I'm a bit biased. You can read some of our community stories talking about what folks have built on top of it[1]. Other alternatives I've heard mentioned for self-hosting include: * Ory * Platform specific OSS (Devise for Rails, Passport/NextAuth for javascript, Spring Security for Java, etc) * IdentityServer (may have to pay something now, not sure) * Keycloak (as other comments have mentioned) * Supertokens 0: https://fusionauth.io/download https://fusionauth.io/download 1: https://fusionauth.io/blog/tag/community-story/ https://fusionauth.io/blog/tag/community-story/

FreeIPA is pretty good for internal users when money is tight. It's a FOSS almost AD but for *NIX and it does HA. For the SSO part, Shibboleth2 or CAS.

smitty1110 3y ago

Keycloak [1]. Rock solid, supports everything, trusted everywhere. 1: https://www.keycloak.org/ https://www.keycloak.org/

ExoticPearTree 3y ago
I have to disagree with your assessment. It's not that rock solid, "supports everything" is a very vague term and "trusted everywhere" I'm not even sure that that is supposed to mean.
lambda_garden 3y ago
The docs are really poor. It makes me less confident that I have configured everything correctly.
broast 3y ago
They're desperate to get off keycloak at my org. Not sure the specifics, but our users complain about Auth issues often, and the keycloak web interface is painfully slow too.
- elevation 3y ago
  I’ve read you need to partition usage to limit each keycloak instance to about 1500 total users to avoid performance issues. Does this hold true in your org?
  - dividuum 3y ago
    Not saying this isn't true, but wtf? How could such a laughable number of users cause any kind of performance issue?
    - elevation 3y ago
      It looks like it's 'entities' and not just 'users'. From the docs [0]: Keycloak allows you to create any number of realms and any number of clients and users in them. But you need to be thoughtful as you scale up because as the number of entities grows, Keycloak slows down. When you log in as a superuser in the admin panel, even if you have only 1,500 realms, it will take a few minutes or even crash on timeout. Creating a new realm will take about 20 to 30 seconds. You need to change your logic and interaction with Keycloak. [0]: https://www.redhat.com/architect/oauth-20-authentication-keycloak https://www.redhat.com/architect/oauth-20-authentication-key...
  - mooreds 3y ago
    I work for a competitor. I haven't heard that, but have heard of perf problems with > 1000 realms (tenants). https://keycloak.discourse.group/t/maximum-limit-of-realms/8189/6 https://keycloak.discourse.group/t/maximum-limit-of-realms/8... has some details, though comments are 1-2 years old so may be out of date.
  - smitty1110 3y ago
    I work with an org that has 10's of thousands of users on keycloak, so there must be a way around the problem. I'm not administering the instance for this project, so I have no direct insight into how they deal with it.

Timshel 3y ago

There was a recent discussion on Obligator recently, I did not test it. But they have a nice table with a list of providers : https://github.com/lastlogin-io/obligator#comparison-is-the-thief-of-joy https://github.com/lastlogin-io/obligator#comparison-is-the-...

mooreds 3y ago

I work for FusionAuth which has a free community edition[0], so I'm a bit biased. You can read some of our community stories talking about what folks have built on top of it[1]. Other alternatives I've heard mentioned for self-hosting include: * Ory * Platform specific OSS (Devise for Rails, Passport/NextAuth for javascript, Spring Security for Java, etc) * IdentityServer (may have to pay something now, not sure) * Keycloak (as other comments have mentioned) * Supertokens 0: https://fusionauth.io/download https://fusionauth.io/download 1: https://fusionauth.io/blog/tag/community-story/ https://fusionauth.io/blog/tag/community-story/