Keycloak – Open-Source Identity and Access Management Interview

Re:Keycloak – Open-Source Identity and Access Management Int... by roboben on Sunday June 18, 2023 @05:34PM (#36384740)

I don’t get it. Keycloak feels like some clunky 90s enterprise software and I mean it only in a bad way. Had to run it on openshift and it was hell. It’s not really made for containers, clustering is basically impossible, it needs to know it’s default route and I can’t remember the exact issue but found myself patching some obscure startup scripts which templated some XML to start that thing. Can’t recommend but I’d be happy to hear alternatives which are actually modern.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by Glyptodon on Sunday June 18, 2023 @05:38PM (#36384775)

It's on my list of things that assumes out of the box that you know waaaaaay more about dozens of details than you actually are likely to unless you've already used it for 10 years. To the point that I don't even know what the benefit of using it vs. other options is at all.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by roboben on Sunday June 18, 2023 @05:43PM (#36384823)

I can’t understand your first sentence even after reading it ten times. Maybe it is too long for me.

To the second sentence: I don’t know what the benefit is either but in some environments you are not able to use any cloud provider or other external service to realize the auth layer so you are stuck with things like keycloak. Hope this thread discusses some other solutions which you can self host.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by nebulousthree on Sunday June 18, 2023 @06:00PM (#36384952)

They mean that the software relies on the user understanding its, or the industry-it-serves's, jargon, to be used effectively.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by asmor on Monday June 19, 2023 @03:44AM (#36388390)

Which is extra funny when Keycloak is sticking to jargon out of RFCs that nobody else in the SaaS identity space is using. Hooking up Keycloak to a SAML consumer that only documents SaaS configuration is a fun game of try until it works most of the time.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by Lacerda69 on Sunday June 18, 2023 @05:57PM (#36384931)

use cases that require _everything_ "on-premise" are often government/military, big healthcare, or just huge enterprises that want to control everything (and can afford a team that only runs their auth service).

I mentioned Ory above but you get both options - either as a managed service or run on your own infra

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by p_l on Sunday June 18, 2023 @06:31PM (#36385207)

Or just places that don't want to give data to external, VC-funded or worse, vendors.

I have clients that definitely prefer combination of open source + owner-controlled + lower costs ;)

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by saynay on Sunday June 18, 2023 @07:18PM (#36385543)

Yep, this is why I have been evaluating it recently. Have a customer that wants SAML 2.0 support, others that want LDAP support, 2FA support, and multi-tenancy support, while being something we can self-host. The other main suggestions I have seen - ORY or Zitadel - tend to be missing at least one of those (from what I can tell).

Keycloak looks like a big complicated monster, so I would prefer to stay away except that it looks like I will be required to have all that complexity to support all the use-cases we are looking at.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by selcuka on Monday June 19, 2023 @02:34AM (#36387963)

Curious. I'm not using Zitadel yet, but we are planning to. It seems to support all of those features. What was the missing part for you?

https://zitadel.com/docs/apis/saml/endpoints

https://zitadel.com/docs/guides/integrate/identity-providers...

https://zitadel.com/docs/concepts/features/selfservice#mfa--...

https://zitadel.com/docs/guides/migrate/introduction#multi-t...

https://zitadel.com/blog/zitadel-as-sso-provider-for-selfhos...

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by saynay on Wednesday June 21, 2023 @09:37AM (#36418283)

As far as I can tell, Zitadel cannot be used as a SAML client, only as a provider. One of my requirements is that we use customer-provided (and controlled) SAML for SSO. Otherwise it was looking very promising.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by vxNsr on Sunday June 18, 2023 @05:51PM (#36384893)

I know the two main competitors that have been adopted by the self hosted community are authentik and authelia, they’re both somewhat under developed for enterprise but at the same time still difficult to grasp for non-full time devOps people. At least in my opinion.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by jsmith99 on Sunday June 18, 2023 @06:02PM (#36384977)

I use authentik for self hosted - it's great but still too powerful and configurable for me or most people who are not auth experts to customise. Just creating a password reset flow requires integrating a dozen moving parts. The only explanation how to do it is a yaml file or a YouTube tutorial.

Setting up basic forward auth or OIDC was super easy though.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by Lacerda69 on Sunday June 18, 2023 @05:47PM (#36384856)

Have you had a look at Ory (Kratos)? Its a "cloud-native"/modern alternative to Keycloak: https://github.com/ory/kratos

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by rad_gruchalski on Sunday June 18, 2023 @06:16PM (#36385113)

Ory Kratos is nowhere near Keycloak. First of all, one needs at least Kratos+Hydra (there’s an integration method now out of the box yay) but Keycloak still has a flexibility advantage. Keycloak has many more features out of the box comparing to the complete Ory stack.

The only thing nicer in Kratos from Keycloak is the standalone self-service UI with JSON identity declaration. If someone from the Keycloak team is reading this, please, let’s have a talk about bringing that feature to Keycloak, then Keycloak will be perfect. The template approach is a bit of a hassle.

Source: deployed both stacks in production systems.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by mnming on Wednesday June 21, 2023 @05:19AM (#36416267)

Another significant advantage of Kratos is that it's written in Golang, so it takes little to none resources for simple use cases.

Also my experience with Keycloak in the past was that you can't do zero downtime deployment, or true configuration as code.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by dijit on Sunday June 18, 2023 @06:12PM (#36385076)

I have, and we went back to keycloak- everything the parent says is true, however Ory/Kratos is a lesson in half finished solutions and poor documentation.

we really tried quite hard, since it was backed by CNCF, but it could just be a case of being a tad too immature for prime time.

it seems keycloak is now CNCF though

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by adeptima on Sunday June 18, 2023 @07:06PM (#36385459)

Found Ory (Kratos) customised registration flow as something over-engineered for my personal use cases.

Very impressive ecosystem nevertheless.

Show HN: Ory Kratos https://news.ycombinator.com/item?id=31679811

Most HN comments are still relevant

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by Keyframe on Monday June 19, 2023 @03:44AM (#36388384)

What's nice about Ory Kratos/Hydra/Oathkeeper is that you can set 'groups' for your individual clients. In Keycloack that'd have to be a realm per client and if you have more than a couple, screw it. Don't know if something changed with Keycloack in last two years, but that's what nudged us towards Ory. Also, not sure how fast keycloack can get (plus caching) if you want to put it on-front of an API as an auth and throttle solution (you probably can't).

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by tecleandor on Sunday June 18, 2023 @06:10PM (#36385059)

Were you using Keycloak also as the identity provider?

IIRC, if you're using an external identity provider, and you want clustering, you can just deploy Keycloak containers and load balance between them. You can then load a shared cache if you want (or need).

My memory is fuzzy right now, but although it isn't the leanest solution, I don't remember it as terrible. Ours wasn't a very custom solution anyway, we just hit an LDAP in the back and that was all.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by Delotono on Sunday June 18, 2023 @06:12PM (#36385079)

They completely reworked the code base and made it k8s compatible

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by rad_gruchalski on Sunday June 18, 2023 @06:21PM (#36385137)

Most of those issues have been sorted out in recent versions. It’s all container-ready now with pretty solid k8s story.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by jeroenhd on Sunday June 18, 2023 @06:33PM (#36385225)

I just docker-compose up'd the server and configured it. I don't know when you last needed to mess with it, but the containerised version seems quite easy.

Configuration sucked, but that's because Keycloak can do an awful lot.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by ownagefool on Sunday June 18, 2023 @06:37PM (#36385243)

Whilst I agree keycloak is a lil clunky, I had it working clustered in k8s ~8 years ago.

I do recall the gossip protocol presenting problems back then, but now I believe the helm chart just works.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by ashtonmeuser on Sunday June 18, 2023 @07:01PM (#36385429)

BC gov?

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by xnyanta on Sunday June 18, 2023 @08:05PM (#36385818)

Are we using the same piece of software? I have it deployed in production on kubernetes using the bitnami helm chart and everything works like a charm, clustering etc. No need to modify any XML or care about network routes.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by ponyous on Monday June 19, 2023 @02:08AM (#36387811)

How do you handle backups? I was considering doing the same, but found that backing up different systems inside k8s can be difficult.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by seletz on Monday June 19, 2023 @02:20AM (#36387876)

We use KC with PostgreSQL as backend data store. Backup is done by backing up the PostgreSQL database.

If you actually want to transport configuration across environments (DEV, QA, PROD), then you want to export realms and have it load by KC on startup or import it using the UI.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by jdsleppy on Monday June 19, 2023 @07:32AM (#36389807)

There's a good Terraform provider for consistent configuration across environments, too.

[ Parent | on HN ]

Re:Keycloak – Open-Source Identity and Access Management Int... by mooreds on Sunday June 18, 2023 @09:45PM (#36386401)

Disclosure: I work for FusionAuth.

We've had a number of folks migrate from Keycloak due to some of this clunkiness, but I do know they've done some major overhauls recently (moving to Quarkus amongst other things).

It also used to be super resource intensive if you have a large number of realms (which is what Keycloak calls tenants and Cognito calls user pools). From this 2022 link, more than 100-200 can cause issues: https://github.com/keycloak/keycloak/discussions/11074

[ Parent | on HN ]