Keycloak SSO with Docker Compose and Nginx

Re:Keycloak SSO with Docker Compose and Nginx by raffraffraff on Sunday February 11, 2024 @09:42AM (#39335273)

My boss recently called Keycloak "the gift that keeps on giving", but he was actually commenting on how there's a new ticket in jira for figuring out how the f*?k to do something.

Having said that, I have terraform that creates an EKS cluster, deploys Keycloak , creates clients (SAML/OIDC), adds external identity providers, sets up an AWS IAM Identity Provider for it etc. That makes it extremely easy to use once you've figured out (a) what it can do, (b) how to do it in the ui, (c) how to get mrparkers Terraform provider to do it for you.

[ Parent | on HN ]

Re:Keycloak SSO with Docker Compose and Nginx by davidgf on Monday February 12, 2024 @05:04AM (#39343262)

By any chance, is that Terraform open sourced somewhere? It's for a friend :)

[ Parent | on HN ]

Re:Keycloak SSO with Docker Compose and Nginx by raffraffraff on Monday February 12, 2024 @09:54AM (#39345399)

haha, nope unfortunately. But I also use an odd method of keeping my terraform code dry via Hiera (yes, the Puppet thing). If you're interested I can find out if it's ok to open source it.

[ Parent | on HN ]

Re:Keycloak SSO with Docker Compose and Nginx by davidgf on Wednesday February 14, 2024 @06:43AM (#39368753)

That would be really helpful. At the company I'm working for, we are transitioning to Keycloak, and one question that I have no answer for yet is how to standardize deployments across environments. Ideally, I would love to apply DevOps best practices, and try to script the provisioning of as many components as I can (clients, flows, etc.), avoiding config drift between environments. The only solution I found out for now is configuring the realm as I like and exporting it into JSON through the admin UI, placing the resulting file in the appropriate directory, and supplying the --import-realm flag at startup. That seems very fragile.

[ Parent | on HN ]

Re:Keycloak SSO with Docker Compose and Nginx by raffraffraff on Friday February 16, 2024 @04:41AM (#39395007)

Ping my email, it's my username at Gmail. I'm happy to go through the wonky shite that I use. Be warned, I've wrapped a subset of Keycloak features that I use. But that includes realms, clients, identity providers, users, groups and a certain amount of extra stuff like client scope user attributes.

At a previous company we also used the exported JSON, and it's fine to spin up a reason, but horrible for ongoing admin.

[ Parent | on HN ]