6 ms·

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik

I recently went down this road for my home lab and went with Authelia Keycloak works, but it's a behemoth and still needs further services to work with traefik forward auth. Authelia works great, you don't get a UI to edit users, and it's not a two-way sync between a backing LDAP server, but the fact that it can be configured with a static file + environment variables makes it a great fit for a lot of cases. If you're just looking to add auth to some services, and SSO to those that can work with it, I'd suggest starting with Authelia.

rendaw 3y ago
Tangential, but are there any alternatives to LDAP today? I googled around and found nothing. Simpler schema, JSON, http, etc. I can't believe nobody has attempted to recreate it when people have for basically everything else. AFAICT the only real other standard is Active Directory. And secondly, is there a standard or protocol for offloading access control? I see Authelia allows you to contol access by url patterns, but I'd expect e.g. a fileserver to instead reach out to the LDAP server and check permissions based on the authenticated user id and keys in the database. This seems like the opposite of oauth2 which is for a server getting access itself to a 3rd party service.
jscyo 3y ago
[dead]
ffsm8 3y ago
> I [...] went with Authelia Great choice! > keycloak [...]'s a behemoth Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables. It starts within <3s on my toy server since they refractored it a few years ago and uses less then 100mb ram (again, toy server, not many users etc) Idk, calling that a behemoth is kinda a stretch at that point...? The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it .. but you're kinda forced to with how they've designed their docker image. Not an issue for enterprise as they're gonna be doing that anyway, but annoying for home servers
- c-hendricks 3y ago
  Behemoth may be a bit of a stretch, but the container is 20x the size of authelia, it's minimum recommendations are 512mb ram, and 1g of disk space. Compared to Authelia, which is using 30mb of ram and 500k disk space, yeah it's big. Not to mention, only the admin user being configurable via environment variables isn't enough. With Authelia, I can share my homelab setup and with a couple of environment variable changes, people can have SSO integrated. There's no need to write guides or grab screenshots to help them get set up.
- raziel2p 3y ago
  have you looked at the codebase? it's been a while but I was implementing Keycloak a few years ago and it was shocking how big the codebase is and how difficult it is to change things to add what felt like basic functionality. making plugins didn't seem like a viable option either. oh not to mention the statefulnes of it, it was almost impossible to destroy and re create an instance from scratch without a bunch of manual point and click via the UI.
  - theK 3y ago
    Had a similar experience and even filed a couple of bugs back then. I don't know the current state but back then it felt like having something that looked like halfway modern Java but still carried around large amounts of old school JEE cruft. Probably was the migration to quarkus though. So it probably got better?
  - diurnalist 3y ago
    Keycloak solves a complex problem. It is built on a plugin architecture, so plugins are certainly a viable option and this is documented in more detail here[0]. In general I have found the Keycloak docs thorough and well-written. When I operated Keycloak I built a few plugins to solve specific needs/assumptions we had around IdP when migrating to Keycloak from a bespoke solution. Re: your second point, the docs also describe this in detail[1]. Having the realm data exist in a simple form that can be exported/imported was very useful. However, I would have liked if they thought more about how to do live backup/restore; perhaps that is easier now than it was at the time. [0]: https://www.keycloak.org/docs/latest/server_development/index.html#_providers https://www.keycloak.org/docs/latest/server_development/inde... [1]: https://www.keycloak.org/server/importExport#_importing_a_realm_during_startup https://www.keycloak.org/server/importExport#_importing_a_re...
mooreds 3y ago
Disclosure: I work for FusionAuth. If you are looking for SSO + easy configuration + an admin UI (which admittedly has a mid 2000s UX look and feel), you should check out FusionAuth. It's free to download and run yourself[0], docker friendly[1], has a variety of configuration choices[2] (including terraform[3] to manage your OIDC/other settings). Worth noting that it is free to use, but not open source[4]. 0: https://fusionauth.io/download https://fusionauth.io/download 1: https://fusionauth.io/docs/get-started/download-and-install/docker https://fusionauth.io/docs/get-started/download-and-install/... 2: https://fusionauth.io/docs/operate/deploy/configuration-management https://fusionauth.io/docs/operate/deploy/configuration-mana... 3: https://fusionauth.io/docs/operate/deploy/terraform https://fusionauth.io/docs/operate/deploy/terraform 4: https://fusionauth.io/license-faq#28 https://fusionauth.io/license-faq#28
- NeckBeardPrince 3y ago
  So if you self-host you still have to pay to have 2FA?
  - mooreds 3y ago
    TOTP 2FA is free. SMS and email MFA are part of the paid plans. From https://fusionauth.io/docs/lifecycle/authenticate-users/multi-factor-authentication#types-of-mfa-supported https://fusionauth.io/docs/lifecycle/authenticate-users/mult... > However, the Authenticator/TOTP implementation is not a premium feature.
  - mffap 3y ago
    If you look for 2FA with otp, email, sms and also passkeys foe self-hosting, then give zitadel a spin. All features are included in the open source version. Should also work nicely with docker compose + nginx. In case you have issues, join the chat. https://github.com/zitadel/zitadel https://github.com/zitadel/zitadel
- mmcnl 3y ago
  How do I integrate this with a reverse proxy like Caddy and their forward_auth directive? I want to secure my apps on the proxy layer, not the app layer.
natrys 3y ago
I also went down this road recently. Personally I had gone with caddy-security[1] which is simply a plugin for Caddy. [1] https://github.com/greenpau/caddy-security https://github.com/greenpau/caddy-security
- jallbrit 3y ago
  I also went down this road recently, and discovered caddy-security, but I have security concerns [0]. Software always has vulnerabilities, but this was enough to scare me off. Something like keycloak or authentia seems more tested and secure. [0] https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ https://blog.trailofbits.com/2023/09/18/security-flaws-in-an...
  - natrys 3y ago
    > Software always has vulnerabilities Yeah, that's an unfortunate reality, but > The caddy-security plugin maintainers confirmed that there were no near-term plans to act on the reported vulnerabilities. Ouch. That's a red flag, thanks for pointing it out. I guess it's time to check out Authelia (I think that's what you meant by authentia?).
BeryJu 3y ago
Authelia has a very unique advantage of its small footprint, which is something that neither Keycloak nor authentik (which I work for as a disclaimer) can really fit into. It’s a very good usecase for a homelab environment and if you don’t need/want features of the “bigger” solutions!
mmcnl 3y ago
I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns. [0] https://github.com/lldap/lldap https://github.com/lldap/lldap [1] https://www.authelia.com/integration/proxies/caddy/ https://www.authelia.com/integration/proxies/caddy/
- ciceryadam 3y ago
  Newest arch package is just over 4 months old - Last Updated: 2023-10-09 03:25 (UTC): https://aur.archlinux.org/packages/authelia https://aur.archlinux.org/packages/authelia
  - enasterosophes 3y ago
    That's not a new release of authelia. Authelia's releases are at https://github.com/authelia/authelia/releases https://github.com/authelia/authelia/releases The updates to the AUR package were not about new releases since 2022: aur/authelia $ git log ad4e6ca^..HEAD 2c5029d (2023-10-09) Amir Zarrinkafsh ECDB8EF9E77E4EBF (HEAD -> authelia, origin/authelia) Fix frozek lockfile issue with pnpm 246d77c (2023-01-22) Amir Zarrinkafsh ECDB8EF9E77E4EBF Utilise pnpm instead of yarn ad4e6ca (2022-12-21) Amir Zarrinkafsh Update to v4.37.5
    - ciceryadam 3y ago
      I stand corrected, thanks!
  - james_d_elliott 3y ago
    If you'd like a newer build of the pre-release they are available. Feel free to reach out on GitHub Discussions (may not see it here but see how we go).
- 3y ago

rendaw 3y ago

Tangential, but are there any alternatives to LDAP today? I googled around and found nothing. Simpler schema, JSON, http, etc. I can't believe nobody has attempted to recreate it when people have for basically everything else. AFAICT the only real other standard is Active Directory. And secondly, is there a standard or protocol for offloading access control? I see Authelia allows you to contol access by url patterns, but I'd expect e.g. a fileserver to instead reach out to the LDAP server and check permissions based on the authenticated user id and keys in the database. This seems like the opposite of oauth2 which is for a server getting access itself to a 3rd party service.

jscyo 3y ago

[dead]

ffsm8 3y ago

> I [...] went with Authelia Great choice! > keycloak [...]'s a behemoth Really? It prefers a database, sure, but you can also store on disk. And you can also configure the main user with env variables. It starts within <3s on my toy server since they refractored it a few years ago and uses less then 100mb ram (again, toy server, not many users etc) Idk, calling that a behemoth is kinda a stretch at that point...? The thing that annoys me about keycloak is how they decided to ship it. I really don't want to maintain a CI Pipeline to deploy it .. but you're kinda forced to with how they've designed their docker image. Not an issue for enterprise as they're gonna be doing that anyway, but annoying for home servers

c-hendricks 3y ago
Behemoth may be a bit of a stretch, but the container is 20x the size of authelia, it's minimum recommendations are 512mb ram, and 1g of disk space. Compared to Authelia, which is using 30mb of ram and 500k disk space, yeah it's big. Not to mention, only the admin user being configurable via environment variables isn't enough. With Authelia, I can share my homelab setup and with a couple of environment variable changes, people can have SSO integrated. There's no need to write guides or grab screenshots to help them get set up.
raziel2p 3y ago
have you looked at the codebase? it's been a while but I was implementing Keycloak a few years ago and it was shocking how big the codebase is and how difficult it is to change things to add what felt like basic functionality. making plugins didn't seem like a viable option either. oh not to mention the statefulnes of it, it was almost impossible to destroy and re create an instance from scratch without a bunch of manual point and click via the UI.
- theK 3y ago
  Had a similar experience and even filed a couple of bugs back then. I don't know the current state but back then it felt like having something that looked like halfway modern Java but still carried around large amounts of old school JEE cruft. Probably was the migration to quarkus though. So it probably got better?
- diurnalist 3y ago
  Keycloak solves a complex problem. It is built on a plugin architecture, so plugins are certainly a viable option and this is documented in more detail here[0]. In general I have found the Keycloak docs thorough and well-written. When I operated Keycloak I built a few plugins to solve specific needs/assumptions we had around IdP when migrating to Keycloak from a bespoke solution. Re: your second point, the docs also describe this in detail[1]. Having the realm data exist in a simple form that can be exported/imported was very useful. However, I would have liked if they thought more about how to do live backup/restore; perhaps that is easier now than it was at the time. [0]: https://www.keycloak.org/docs/latest/server_development/index.html#_providers https://www.keycloak.org/docs/latest/server_development/inde... [1]: https://www.keycloak.org/server/importExport#_importing_a_realm_during_startup https://www.keycloak.org/server/importExport#_importing_a_re...

mooreds 3y ago

Disclosure: I work for FusionAuth. If you are looking for SSO + easy configuration + an admin UI (which admittedly has a mid 2000s UX look and feel), you should check out FusionAuth. It's free to download and run yourself[0], docker friendly[1], has a variety of configuration choices[2] (including terraform[3] to manage your OIDC/other settings). Worth noting that it is free to use, but not open source[4]. 0: https://fusionauth.io/download https://fusionauth.io/download 1: https://fusionauth.io/docs/get-started/download-and-install/docker https://fusionauth.io/docs/get-started/download-and-install/... 2: https://fusionauth.io/docs/operate/deploy/configuration-management https://fusionauth.io/docs/operate/deploy/configuration-mana... 3: https://fusionauth.io/docs/operate/deploy/terraform https://fusionauth.io/docs/operate/deploy/terraform 4: https://fusionauth.io/license-faq#28 https://fusionauth.io/license-faq#28

NeckBeardPrince 3y ago
So if you self-host you still have to pay to have 2FA?
- mooreds 3y ago
  TOTP 2FA is free. SMS and email MFA are part of the paid plans. From https://fusionauth.io/docs/lifecycle/authenticate-users/multi-factor-authentication#types-of-mfa-supported https://fusionauth.io/docs/lifecycle/authenticate-users/mult... > However, the Authenticator/TOTP implementation is not a premium feature.
- mffap 3y ago
  If you look for 2FA with otp, email, sms and also passkeys foe self-hosting, then give zitadel a spin. All features are included in the open source version. Should also work nicely with docker compose + nginx. In case you have issues, join the chat. https://github.com/zitadel/zitadel https://github.com/zitadel/zitadel
mmcnl 3y ago
How do I integrate this with a reverse proxy like Caddy and their forward_auth directive? I want to secure my apps on the proxy layer, not the app layer.

natrys 3y ago

I also went down this road recently. Personally I had gone with caddy-security[1] which is simply a plugin for Caddy. [1] https://github.com/greenpau/caddy-security https://github.com/greenpau/caddy-security

jallbrit 3y ago
I also went down this road recently, and discovered caddy-security, but I have security concerns [0]. Software always has vulnerabilities, but this was enough to scare me off. Something like keycloak or authentia seems more tested and secure. [0] https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ https://blog.trailofbits.com/2023/09/18/security-flaws-in-an...
- natrys 3y ago
  > Software always has vulnerabilities Yeah, that's an unfortunate reality, but > The caddy-security plugin maintainers confirmed that there were no near-term plans to act on the reported vulnerabilities. Ouch. That's a red flag, thanks for pointing it out. I guess it's time to check out Authelia (I think that's what you meant by authentia?).

BeryJu 3y ago

Authelia has a very unique advantage of its small footprint, which is something that neither Keycloak nor authentik (which I work for as a disclaimer) can really fit into. It’s a very good usecase for a homelab environment and if you don’t need/want features of the “bigger” solutions!

mmcnl 3y ago

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns. [0] https://github.com/lldap/lldap https://github.com/lldap/lldap [1] https://www.authelia.com/integration/proxies/caddy/ https://www.authelia.com/integration/proxies/caddy/

ciceryadam 3y ago
Newest arch package is just over 4 months old - Last Updated: 2023-10-09 03:25 (UTC): https://aur.archlinux.org/packages/authelia https://aur.archlinux.org/packages/authelia
- enasterosophes 3y ago
  That's not a new release of authelia. Authelia's releases are at https://github.com/authelia/authelia/releases https://github.com/authelia/authelia/releases The updates to the AUR package were not about new releases since 2022: aur/authelia $ git log ad4e6ca^..HEAD 2c5029d (2023-10-09) Amir Zarrinkafsh ECDB8EF9E77E4EBF (HEAD -> authelia, origin/authelia) Fix frozek lockfile issue with pnpm 246d77c (2023-01-22) Amir Zarrinkafsh ECDB8EF9E77E4EBF Utilise pnpm instead of yarn ad4e6ca (2022-12-21) Amir Zarrinkafsh Update to v4.37.5
  - ciceryadam 3y ago
    I stand corrected, thanks!
- james_d_elliott 3y ago
  If you'd like a newer build of the pre-release they are available. Feel free to reach out on GitHub Discussions (may not see it here but see how we go).
3y ago