Re:Keycloak: Open-source identity and access management
by thinkharderdev on Tuesday April 14, 2020 @07:46PM
(#22872828)
Agree on the lack of documentation. But one thing I've found really nice is that the source code is really well structured and readable. Every time the documentation has let me down I've been able to find what I needed by reading the source code. That's one of the great underrated advantages of using open source solutions, you're not completely hamstrung when the docs don't give you what you need.
Re:Keycloak: Open-source identity and access management
by bebop on Tuesday April 14, 2020 @06:28PM
(#22872261)
I would agree that a pain point is the lack of documentation, examples, and googleability of the SPI's. I have spent much longer than I would have expected integrating an existing user database.
Re:Keycloak: Open-source identity and access management
by cybrix12 on Tuesday April 14, 2020 @08:49PM
(#22873232)
It looks like Quarkus is going to be considered for one of the next major release [1].
That said, do you believe it will still be possible to extend Keycloak using the deployment-scanner?
Also, do you happen to have open-source code related to Keycloak and/or custom extensions?
Beside the poor doc, finding more open-source code is one of the best way to learn this.
[1]: https://issues.redhat.com/browse/KEYCLOAK-13068?jql=project%...
Re:Keycloak: Open-source identity and access management
by tofflos on Wednesday April 15, 2020 @03:27AM
(#22875402)
Some more scraps of information regarding Keycloak on Quarkus is available at https://www.keycloak.org/2019/10/keycloak-x.
I'm hoping this will lead to significantly faster startup times so that my integration tests will run faster.
Re:Keycloak: Open-source identity and access management
by folmar on Wednesday April 15, 2020 @03:42PM
(#22882132)
> do you believe it will still be possible to extend Keycloak using the deployment-scanner?
Even if it wouldn't bundling your keycloak-with-amenities is a 10-minutes job (1. make a pom.xml with keycloak dependency and your stuff 2. mvn package 4. there is no step 3)
If you do use the Docker images it’s pretty straightforward though.
Past that, customization could be better - not because it doesn’t support it but because many of the SPI’s are poorly documented at best, or totally undocumented at worst. You’ll need to read the code and understand Java EE to do anything not supported out of the box, which, to be fair is a lot - but I’m having to spend far more time looking through code than I’d like to add a Steam login for PCGamingWiki, as an example. Thankfully I’ve dabbled with Java EE before so it’s no big deal to me, but something to consider if you wanna do something simple like add extra profile fields.
EDIT: one major nag I have is that the LDAP integration has an annoying bug related to renaming of users. Keycloak can be configured to use a GUID in an LDAP store as the link between a Keycloak user profile and an LDAP object, but when the username changes it will delete and recreate the account instead of updating the username. This creates a whole new sub identifier in the JWT assertions, which has caused me headaches.
I have a bug on file for this which just recently got updated targeting a fix in 10.0, so hopefully this gets fixed soon.