5 ms·

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oi

I've been eyeing authentik[1] and authelia[2]. Authelia looks really good to me, but the fact that keycloak has connectors for angular and you need to setup oidc angular plugins with authelia for example made me a little bit wary. But I guess having a config for Keycloak makes it's easier to get started. [1] https://goauthentik.io/ https://goauthentik.io/ [2] https://www.authelia.com/ https://www.authelia.com/

james_d_elliott 3y ago
One of the Authelia principle maintainers here. If there's anything we can do to help with the configuration of Angular we'd be more than happy to via the GitHub discussions.
c0wb0yc0d3r 3y ago
For anyone, considering authentik, I want to warn you by saying "here be dragons." To start, I have protected 10+ services at any given time. Both in docker and k8s. Unless you enjoy configuring protection for each service independently, you'll have a bad time in authentik. Authentik suffers from a debilitating bug[0] where when using a single config to protect all services on subdomains (i.e. app1.example.com, app2.example.com, etc.) your users will be randomly redirected to a different service when reauthenticating after the session expires. [0]: https://github.com/goauthentik/authentik/issues/6886 https://github.com/goauthentik/authentik/issues/6886
- BeryJu 3y ago
  Hey, authentik CTO here! We’ll be addressing the bug in the release after the next one (march-April)
  - c0wb0yc0d3r 3y ago
    Good to hear, I think it'll make many users happy. For me, I've migrated back to Authelia. I moved to authentik because at the time Authelia had no user management. After all of authentik's sharp edges, I've found lldap[0], and was able to implement a pilot in a few hours. I haven't looked back, since everything was converted. [0]: https://github.com/lldap/lldap https://github.com/lldap/lldap
risson 3y ago
Authentik dev here, AMA
slenk 3y ago
I am trying to make the same decision right now. Authentik looked better to me but that bug mentioned in another reply sounds bad
kodama-lens 3y ago
Authentik has completely messed up their implementation of the oauth client credentials grant. It is not fixable without breaking changes and does not work with many tools using the cc grant. After seeing this they were completely off the table for me. https://github.com/goauthentik/authentik/issues/6139 https://github.com/goauthentik/authentik/issues/6139
- BeryJu 3y ago
  See here for the fix, which both implements the workaround suggested in the issue and also a much more standard-compliant method: https://github.com/goauthentik/authentik/pull/8471 https://github.com/goauthentik/authentik/pull/8471
- BeryJu 3y ago
  authentik CTO here; we’ll fix this in the next release (match-april), it should be possible in a non backwards incompatible way using the suggestion in this comment https://github.com/goauthentik/authentik/issues/6139#issuecomment-1791093921 https://github.com/goauthentik/authentik/issues/6139#issueco... (which does call that solution a hack but I wouldn’t necessarily agree)

james_d_elliott 3y ago

One of the Authelia principle maintainers here. If there's anything we can do to help with the configuration of Angular we'd be more than happy to via the GitHub discussions.

c0wb0yc0d3r 3y ago

For anyone, considering authentik, I want to warn you by saying "here be dragons." To start, I have protected 10+ services at any given time. Both in docker and k8s. Unless you enjoy configuring protection for each service independently, you'll have a bad time in authentik. Authentik suffers from a debilitating bug[0] where when using a single config to protect all services on subdomains (i.e. app1.example.com, app2.example.com, etc.) your users will be randomly redirected to a different service when reauthenticating after the session expires. [0]: https://github.com/goauthentik/authentik/issues/6886 https://github.com/goauthentik/authentik/issues/6886

BeryJu 3y ago
Hey, authentik CTO here! We’ll be addressing the bug in the release after the next one (march-April)
- c0wb0yc0d3r 3y ago
  Good to hear, I think it'll make many users happy. For me, I've migrated back to Authelia. I moved to authentik because at the time Authelia had no user management. After all of authentik's sharp edges, I've found lldap[0], and was able to implement a pilot in a few hours. I haven't looked back, since everything was converted. [0]: https://github.com/lldap/lldap https://github.com/lldap/lldap

risson 3y ago

Authentik dev here, AMA

slenk 3y ago

I am trying to make the same decision right now. Authentik looked better to me but that bug mentioned in another reply sounds bad

kodama-lens 3y ago

Authentik has completely messed up their implementation of the oauth client credentials grant. It is not fixable without breaking changes and does not work with many tools using the cc grant. After seeing this they were completely off the table for me. https://github.com/goauthentik/authentik/issues/6139 https://github.com/goauthentik/authentik/issues/6139

BeryJu 3y ago
See here for the fix, which both implements the workaround suggested in the issue and also a much more standard-compliant method: https://github.com/goauthentik/authentik/pull/8471 https://github.com/goauthentik/authentik/pull/8471
BeryJu 3y ago
authentik CTO here; we’ll fix this in the next release (match-april), it should be possible in a non backwards incompatible way using the suggestion in this comment https://github.com/goauthentik/authentik/issues/6139#issuecomment-1791093921 https://github.com/goauthentik/authentik/issues/6139#issueco... (which does call that solution a hack but I wouldn’t necessarily agree)