Been using it in production for a bit less than 2y now. It has improved a lot, the configuration is still kinda hard (jsonnet is really ugly IMO) and there are a lot of weird decisions (like you can change the password without knowing the current password if you have login within the last X minutes even coming from a social provider) but overall it is a solid contender in the space now.