Authelia is an open-source authentication/authorization server with 2FA/SSO

Re:Authelia is an open-source authentication/authorization s... by mooreds on Wednesday March 10, 2021 @08:54AM (#26411197)

One thing that is missing from this list is open source language specific libraries. Projects such as https://oauthlib.readthedocs.io/en/latest/oauth2/server.html and https://github.com/doorkeeper-gem/doorkeeper

Depending on your use case, for example if you only have one application, you might be better off running something embedded in your app, or independent but using the same runtime/deployment environment. Then, when you are ready to add another app or integration, you should be able to introduce a standalone auth system more easily if appropriate (because all your auth interactions should be relatively standardized). I'm a big fan of standalone auth systems as a way to simplify access control and give a single view of a user/customer, but you can also succeed using open source embedded libraries.

When the moment comes to introduce a standalone system, you should consider a few dimensions (this list pulled from a previous comment of mine: https://news.ycombinator.com/item?id=26360048 ):

   * open source or not
   * standalone application or library/framework you integrate
   * self hosted or SaaS
   * authentication, authorization, user management or all three?
   * standards coverage
   * SSO support
   * integrations with other auth tech (LDAP)
   * which OAuth grants are supported
   * cost
   * operational complexity/support for your deployment environment
   * specific features if needed (for example, customization of the look and feel with themes, or customization of the login flow with something like Keycloak's plugin system)
   * documentation and developer experience

These dimensions all matter to varying degrees depending on your team and needs.

Disclosure: I work for https://fusionauth.io/ which has open source supporting libraries and docs, but which is itself not open source.

EDIT: added cost, operational complexity and customization to the list.

[ Parent | on HN ]

Re:Authelia is an open-source authentication/authorization s... by hardwaresofton on Wednesday March 10, 2021 @09:19AM (#26411457)

I actually did exclude those on purpose, because I think they're somewhat out of scope -- arguably the point of running something like Authelia/Keratin/Dex/Keycloak/etc is to not write a single line of auth code, even if it's just wiring up a module/component.

That said, here are some more in the space that I personally have earmarked:

- (all-in-one) jsso2[0]

- (all-in-one, embeddable) a12n-server[1]

- (embeddable) node-oidc-provider[2]

- (embeddable) node-oauth2-server[3]

- (all-in-one, embeddable) authboss[4]

- (proxy) vouch-proxy for NGINX[5]

- (proxy) Grant with support for over 200 provider (!!)[6]

[0]: https://github.com/jrockway/jsso2

[1]: https://github.com/curveball/a12n-server

[2]: https://github.com/panva/node-oidc-provider

[3]: https://github.com/oauthjs/node-oauth2-server

[4]: https://github.com/volatiletech/authboss

[5]: https://github.com/vouch/vouch-proxy

[6]: https://github.com/simov/grant

[ Parent | on HN ]

Re:Authelia is an open-source authentication/authorization s... by core-questions on Wednesday March 10, 2021 @05:56PM (#26417590)

I am using vouch-proxy as it is a very simple addon that lets me use my existing OpenID Connect compatible IDP for authentication on anything fronted by Nginx. This works really well for services not really designed to have their own auth.

The only downside is that it seems to require a second DNS entry for the vouch portion of the process. Awkward configuration in some ways. But, the price is right, and the Nginx config is reasonably clean once you understand what it's doing.

[ Parent | on HN ]